nix/thinkpad/configuration.nix

{ config, pkgs, ... }:

{
  imports = [
    ./hardware-configuration.nix
    ../common/configuration/main.nix
  ];

  sound.enable = true;

  hardware = {
    bluetooth.enable = true;
    pulseaudio.enable = true;
  };

  boot = {
    loader = {
      efi.canTouchEfiVariables = true;

      systemd-boot = {
        enable = true;
        consoleMode = "auto";
      };
    };

    kernelPackages = pkgs.linuxPackages_latest;
    kernelParams = [ 
      "quiet"
      "splash"
      "vga=current"
      "mitigations=off"
      "udev.log_level=3"
    ];

    loader.timeout = 0;
    initrd.verbose = false;
    consoleLogLevel = 0;
    plymouth.enable = true;
  };

  networking = {
    hostName = "sijmen-laptop";
    networkmanager.enable = true;
    firewall = {
      allowedTCPPorts = [
        22      # ssh
        22000   # syncthing sync
        51414   # transmission
        57621   # spotify connect
      ];

      allowedUDPPorts = [
        21027   # syncthing discovery
        22000   # syncthing sync
        51820   # wireguard
      ];
    };

    wireguard.interfaces.wg0 = {
      ips = [ "10.100.0.2/32" ];
      listenPort = 51820;

      privateKeyFile = "/home/sijmen/wireguard-keys/private";

      peers = [{
          publicKey = "zu9vXxxg4wm0R4yWQ2HPaAwJbizuccGYbBB/StwSsm4=";

          # Forward all the traffic via VPN.
          #allowedIPs = [ "0.0.0.0/0" ];
          # Or forward only particular subnets
          allowedIPs = [ "10.100.0.0/24" ];

          # Set this to the server IP and port.
          endpoint = "143.178.219.107:51820";
          persistentKeepalive = 25;
        }
      ];
    };
  };

  services = {
    throttled.enable = true;

    xserver = {
      enable = true;
      displayManager.gdm.enable = true;
      desktopManager.gnome.enable = true;
    };

    syncthing = {
      overrideDevices = true;
      overrideFolders = true;

      devices = {
        nas.id = "5XADATO-6ZKNZFK-YIX2TU3-RTUOAXR-OMWOAH6-OIUB7LE-TWM5B3C-W2I2FQU";
        desktop-fedora.id = "RE3BCEP-2FVDNPA-C72KDCX-5NRTLD4-DEJZAIX-PJAMJAN-LJDFHOY-WOXNPQW";
      };

      folders = {
        "vhuse-qjbcl" = {
          path = "${config.users.users.sijmen.home}/Sync";
          devices = [ "nas" "desktop-fedora" ];
        };
      };
    };

    fwupd = {
      enableTestRemote = true;
    };
  };

  environment = {
    gnome.excludePackages = (with pkgs; [
      gnome-photos
      gnome-tour
    ]) ++ (with pkgs.gnome; [
      gnome-calendar
      gnome-music
      epiphany        # web browser
      geary           # email reader
      totem           # video player
      tali            # poker game
      iagno           # go game
      hitori          # sudoku game
      atomix          # puzzle game
    ]);

    systemPackages = with pkgs; [
      gnome.adwaita-icon-theme
      ifuse
      libimobiledevice
      libheif
    ];
  };

  programs.steam = {
    enable = true;
    remotePlay.openFirewall = true;
    dedicatedServer.openFirewall = true;
  };

  home-manager.users.sijmen.imports = [ ../common/dconf.nix ];

  system.stateVersion = "22.05";
}