config.nix

let domain = "nix.own";
in { config, pkgs, lib, ... }: {
  imports = [

    # Include virtual hardware configuration
    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>

    # Default users
    #../../common/user-profiles/root.nix
    ../../common/user-profiles/pinpox.nix

    # Include reusables
    # ../../common/borg/home.nix
    # ../../common/sound.nix
    ../../common/openssh.nix
    ../../common/environment.nix
    # ../../common/xserver.nix
    # ../../common/networking.nix
    # ../../common/bluetooth.nix
    # ../../common/fonts.nix
    ../../common/locale.nix
    # ../../common/yubikey.nix
    # ../../common/virtualization.nix
    ../../common/zsh.nix
  ];

  config = {
    fileSystems."/" = {
      device = "/dev/disk/by-label/nixos";
      fsType = "ext4";
      autoResize = true;
    };

    # TODO enable  firewall
    networking.firewall.enable = false;

    boot.growPartition = true;
    boot.kernelParams = [ "console=ttyS0" ];
    boot.loader.grub.device = "/dev/vda";
    boot.loader.timeout = 0;

    programs.ssh.startAgent = false;

    environment.systemPackages = with pkgs; [
      nix-index
      htop
      neovim
      nixfmt
      git
      wget
      gnumake
      ripgrep
      go
      python
      ctags
    ];

    networking.hostName = "porree";

    security.acme.acceptTerms = true;

    security.acme.certs = {
      "pablo.tools" = {
        #webroot = "/var/www/challenges/";
        email = "letsencrypt@pablo.tools";
        extraDomainNames = [ "pass.pablo.tools" ];
      };
    };

    services.nginx = {
      enable = true;

      virtualHosts = {

        "pablo.tools" = {
          addSSL = true;
          enableACME = true;
          root = "/var/www/pablo-tools";
        };

        "pass.pablo.tools" =  {
          addSSL = true;
          useACMEHost = "pablo.tools";
          locations."/" = {
            proxyPass = "https://127.0.0.1:8000";
            proxyWebsockets = true; # needed if you need to use WebSocket
          };
        };
      };
    };

    services.bitwarden_rs = {
    enable = true;
    config = {
	  domain = "https://pass.pablo.tools";
	  signupsAllowed = true;
	};

    environmentFile = /var/lib/bitwarden_rs/envfile;
    };
  };
}