{ config, lib, pkgs, self, ... }:

{
  imports = [
    ./hardware.nix
    ../../modules/eink-dashboard.nix
    ../../modules/eink-renderer.nix
  ];

  networking.hostName = "dayplanner";
  networking.domain = "local";

  # WiFi or wired. Default to DHCP — set static IP via your router if you want predictability.
  networking.networkmanager.enable = true;
  networking.firewall.enable = true;
  networking.firewall.allowedTCPPorts = [ 22 ];

  time.timeZone = "Europe/Amsterdam";

  users.users.ruben = {
    isNormalUser = true;
    extraGroups = [ "wheel" "gpio" "spi" "dialout" ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEiY+6AEuKQHyt4Mpg/IbyoIkhg76u3xFPdXGpTsmwxT ruben.hensen@protonmail.com"
    ];
  };

  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = false;
    settings.PermitRootLogin = "no";
  };

  # Pull-deploy: every commit on `main` lands on the Pi within ~60 s.
  # The remote URL must be reachable from the Pi (push to GitHub/Gitea).
  services.comin = {
    enable = true;
    remotes = [{
      name = "origin";
      url = "https://git.rubenhensen.nl/ruben/eink.git";
      branches.main.name = "main";
    }];
    hostname = "dayplanner";
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 14d";
  };

  environment.systemPackages = with pkgs; [
    git
    htop
    vim
  ];

  eink.dashboard.enable = true;
  eink.dashboard.caldavUser = "ruben";
  eink.renderer.enable = true;
  eink.renderer.dashboardUrl = "http://127.0.0.1:3000";

  system.stateVersion = "25.11";
}