nix/hosts/server/configuration.nix

{
  config,
  pkgs,
  lib,
  ...
}:

{
  imports = [
    ./modules/atproto-pds.nix
    ./modules/wafrn.nix
    ./modules/cloudflare.nix
    ./modules/tangled.nix
    ../../modules/force.nix
    ./modules/gitea.nix
    ./modules/vaultwarden.nix
    ./slop/openclaw.nix
    ./slop/brave.nix
  ];

  # gcc. shit breaks. wtf
  environment.sessionVariables.LD_LIBRARY_PATH = "${pkgs.gcc15}/lib";

  services.vscode-server.enable = true;

  # Avoid clobber failures in Home Manager activations (e.g., openclaw user).
  home-manager.backupFileExtension = "hmbackup";

  systemd.services.ocbwoy3-start-pm2 = {
    enable = true;
    description = "Start PM2";
    after = [ "network.target" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "forking";
      User = "ocbwoy3";
      LimitNOFILE = "infinity";
      LimitNPROC = "infinity";
      LimitCORE = "infinity";
      Environment = "PM2_HOME=/home/ocbwoy3/.pm2";
      PIDFile = "/home/ocbwoy3/.pm2/pm2.pid";
      Restart = "on-failure";

      ExecStart = "${pkgs.pm2}/bin/pm2 resurrect";
      ExecReload = "${pkgs.pm2}/bin/pm2 reload all";
      ExecStop = "${pkgs.pm2}/bin/pm2 kill";
    };
  };

  services.openssh.settings = lib.mkDefault {
    PubkeyAuthentication = "yes";
    TrustedUserCAKeys = "/etc/ssh/ca.pub";
    PermitRootLogin = lib.mkDefault "prohibit-password";
    KbdInteractiveAuthentication = lib.mkDefault false;
  };

  services.openssh = {
    enable = lib.mkForce true;
  };

  environment.systemPackages = with pkgs; [
    fastfetch
    hyfetch
    pm2
    steam-run
    opencode
    bun
    nodejs
    node-gyp
    playwright
    chromium
    brave
    (pkgs.callPackage ./slop/rocksky-cli.nix { })
  ];

  users.users.ocbwoy3 = {
    initialPassword = "thisisapassword42069!"; # not the type passwords i use
    isNormalUser = true;
    extraGroups = [
      "wheel"
      "networkmanager"
      "docker"
    ];
    shell = pkgs.zsh;
  };

  nixpkgs.overlays = [
    (final: prev: {
      nixos-rebuild = prev.writeShellScriptBin "nixos-rebuild" ''
                set -euo pipefail

                action="''${1:-}"
                case "$action" in
                  switch|boot|test|build|dry-activate)
                    needs_flake=1
                    ;;
                  *)
                    needs_flake=0
                    ;;
                esac

                has_flake=0
                for arg in "$@"; do
                  case "$arg" in
                    --flake|--flake=*)
                      has_flake=1
                      break
                      ;;
                  esac
                done

                if [ "$needs_flake" -eq 1 ] && [ "$has_flake" -eq 0 ]; then
                  cat >&2 <<'EOF'

        🚨🚨🚨 WARNING: DANGEROUS SYSTEM REBUILD 🚨🚨🚨
        This host is FLAKE-MANAGED. Do not attempt to rebuild the system from /etc/nixos.

        Please ensure you are running THIS EXACT COMMAND inside /home/ocbwoy3/config:

           sudo nixos-rebuild switch --flake /home/ocbwoy3/config#server --impure --cores 4 -L --upgrade

        Aborting unsafe nixos-rebuild invocation.
        EOF
                  exit 64
                fi

                exec ${prev.nixos-rebuild}/bin/nixos-rebuild "$@"
      '';
    })
  ];

  virtualisation.docker = {
    enable = true;
    daemon.settings = {
      "log-driver" = "local";
      "log-opts" = {
        "max-size" = "10m";
        "max-file" = "3";
      };
      "live-restore" = true;
    };
  };

  systemd.services.docker.serviceConfig = {
    CPUQuota = "200%";
    MemoryMax = "12G";
  };

  services.mongodb = {
    enable = true;
    enableAuth = false;
    package = pkgs.mongodb-ce;
    replSetName = "rs0"; # dangerous
    bind_ip = "0.0.0.0";
  };

  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      22
      443
      3000
      3001
      4067
      8080
      25565
    ];
    allowedUDPPorts = [
      22
      443
      3000
      3001
      4067
      8080
      25565
    ];
  };

  # Lock /etc/nixos to read-only mode (config lives in /home/ocbwoy3/config).
  systemd.tmpfiles.rules = [
    "z /etc/nixos 0555 root root - -"
  ];

  # Force resolver config to Cloudflare only.
  networking.nameservers = lib.mkForce [
    "1.1.1.1"
    "1.0.0.1"
  ];
  environment.etc."resolv.conf".text = lib.mkForce ''
    nameserver 1.1.1.1
    nameserver 1.0.0.1
  '';

  catppuccin = {
    enable = true;
    flavor = "mocha";
    accent = "blue";
    gitea.enable = false;
  };

  system.stateVersion = "23.05"; # DO NOT TOUCH

}