desktop.nix

# basic minimal profile for desktops

{ config, pkgs, lib, inputs, ... }:

let
  # Default openssh doesn't include GSSAPI support, so we need to override sshfs
  # to use the openssh_gssapi package instead. This is annoying because the
  # sshfs package's openssh argument is nested in another layer of callPackage,
  # so we override callPackage instead to override openssh.
  sshfs = pkgs.sshfs.override {
    callPackage = fn: args: (pkgs.callPackage fn args).override {
      openssh = pkgs.openssh_gssapi;
    };
  };
in
{

  # Colmena tagging
  deployment.tags = [ "desktop" ];
  system.nixos.variant_id = "ocf-desktop";

  ocf = {
    # TODO: need ensure host keys can't be stolen by booting an external drive...
    acme.enable = false;

    etc.enable = true;
    tmpfsHome.enable = true;
    network.wakeOnLan.enable = true;
    logged-in-users-exporter.enable = true;

    graphical.enable = true;
    graphical.extra = true;
  };

  boot = {
    loader.systemd-boot.consoleMode = "max";
    loader.timeout = 0;
    initrd.systemd.enable = true;

    # zen kernel for a more responsive desktop
    kernelPackages = pkgs.linuxPackages_zen;
  };

  # Enable support SANE scanners
  hardware.sane.enable = true;

  zramSwap.enable = true;

  documentation.dev.enable = true;

  security.pam = {
    # Mount ~/remote
    services.login.pamMount = true;
    services.login.rules.session.mount.order = config.security.pam.services.login.rules.session.krb5.order + 50;
    mount.extraVolumes = [ ''<volume fstype="fuse" path="${lib.getExe sshfs}#%(USER)@tsunami:" mountpoint="~/remote/" options="follow_symlinks,UserKnownHostsFile=/dev/null,StrictHostKeyChecking=no" pgrp="ocf" />'' ];

    # Trim spaces from username
    services.login.rules.auth.trimspaces = {
      control = "requisite";
      modulePath = "${pkgs.ocf-pam_trimspaces}/lib/security/pam_trimspaces.so";
      order = 0;
    };

    # This contains a bunch of KDE, etc. configs
    makeHomeDir.skelDirectory = "/etc/skel";
  };

  environment.systemPackages = with pkgs; [
    lf
    dua
    tree
    tmux

    # COSMIC Applets
    ocf-cosmic-applets
    cosmic-ext-applet-external-monitor-brightness

    # IRC password prompt
    kdePackages.kdialog
  ];

  services = {
    avahi.enable = true;

    pipewire = {
      enable = true;
      pulse.enable = true;
      jack.enable = true;
      alsa.enable = true;
    };
  };

  security.rtkit.enable = true;
  services.pulseaudio.enable = false;

  # needed for accessing totp codes on yubikey via yubico authenticator
  services.pcscd.enable = true;

  virtualisation.podman.enable = true;

  # enable secure attention key (also enables unraw/xlate)
  boot.kernel.sysctl."kernel.sysrq" = 4;

  # Needed for generic Linux programs
  # More info: https://nix.dev/guides/faq#how-to-run-non-nix-executables
  programs.nix-ld.enable = true;

  # Enable ticket forwarding on desktops (no password when sshing to other ocf hosts from the desktops thru supernova!)
  # disabled on everything else bc they dont need to jump through hosts like that...
  programs.ssh.extraConfig = lib.mkOverride 90 ''
    CanonicalizeHostname yes
    CanonicalDomains ocf.berkeley.edu
    Host *.ocf.berkeley.edu *.ocf.io 169.229.226.* 2607:f140:8801::*
        GSSAPIAuthentication yes
        GSSAPIKeyExchange yes
        GSSAPIDelegateCredentials yes
  '';
  # TODO: only forward kerberos tickets to login servers (currently supernova and tsunami)!
}