{ config, lib, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
      ../../modules/ssh.nix
      ../../modules/docker.nix
      ../../modules/syncthing.nix
      ../../modules/tailscale.nix
      ../../modules/homelab/zfs.nix
      ../../modules/homelab/smb.nix
      ../../modules/homelab/nfs.nix
    ];

  # use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # setup hostname and networking stack
  networking.hostName = "snowbelle"; # Define your hostname.
  networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.

  # set timezone
  time.timeZone = "America/Chicago";

  # define shell
  programs.zsh.enable = true;
  users.defaultUserShell = pkgs.zsh;

  # define blake group
  users.groups.blake = {};

  # create blake user
  users.users.blake = {
    isNormalUser = true;
    extraGroups = [ "wheel" "networkmanager" "docker" ]; # Enable ‘sudo’ for the user.
    shell = pkgs.zsh;
    group = "blake";
  };


  # package install list
  environment.systemPackages = with pkgs; [
    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
    rsync
    wget
    git
    iptables
    nftables
  ];

  # enable flakes
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  # enable nvidia gpu passthrough to docker
  #hardware.nvidia-container-toolkit.enable = true;

  # Open ports in the firewall.
  networking.firewall.allowedTCPPorts = [
    22      # ssh
    80      # http
    111     # portmapper for nfs
    139     # smb
    443     # https
    445     # cifs
    1883
    2049    # nfs
    2222    # syncthing
    3001    # uptime kuma
    3030
    3131
    3232
    3333
    3434
    3535
    3636
    3737
    3838
    3939
    5050
    5656
    7070
    7567
    7777
    9090
    25777
    25565
    25566
    25567
  ];

  #networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  networking.firewall.enable = true;

  system.stateVersion = "25.05"; # Did you read the comment?

}