dotfiles/system/system-yarn.nix

{
  config,
  pkgs,
  lib,
  username,
  inputs,
  ...
}:
{
  imports = [
    ./disk_yarn.nix
    ./common.nix
    ./impermanence.nix
    ./no-rgb.nix
    ./vr.nix

    inputs.impermanence.nixosModules.impermanence
    inputs.jovian-nixos.nixosModules.default
  ];

  fileSystems."/media/games" = {
    device = "/dev/disk/by-uuid/1878136e-765d-4784-b204-3536ab4fdac8";
    fsType = "f2fs";
    options = [ "nofail" ];
  };

  systemd.targets = {
    sleep.enable = false;
    suspend.enable = false;
    hibernate.enable = false;
    hybrid-sleep.enable = false;
  };

  networking.hostId = "abf570f9";

  # Static IP for consistent SSH access
  networking.networkmanager.ensureProfiles.profiles.enp7s0-static = {
    connection = {
      id = "enp7s0-static";
      type = "ethernet";
      interface-name = "enp7s0";
      autoconnect = true;
    };
    ipv4 = {
      method = "manual";
      address1 = "192.168.1.223/24,192.168.1.1";
      dns = "1.1.1.1;9.9.9.9;";
    };
    ipv6.method = "disabled";
  };

  services.openssh = {
    enable = true;
    ports = [ 22 ];
    settings = {
      PasswordAuthentication = false;
      PermitRootLogin = "yes";
    };
  };

  users.users.${username}.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
  ];

  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4jL6gYOunUlUtPvGdML0cpbKSsPNqQ1jit4E7U1RyH" # laptop
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5ZYN6idL/w/mUIfPOH1i+Q/SQXuzAMQUEuWpipx1Pc ci-deploy@muffin"
  ];

  programs.steam = {
    remotePlay.openFirewall = true;
    localNetworkGameTransfers.openFirewall = true;
  };

  # LACT (Linux AMDGPU Configuration Tool): https://github.com/ilya-zlobintsev/LACT
  environment.systemPackages = with pkgs; [
    lact
  ];
  systemd.packages = with pkgs; [ lact ];
  systemd.services.lactd.wantedBy = [ "multi-user.target" ];

  systemd.services.lactd.serviceConfig.ExecStartPre = "${lib.getExe pkgs.bash} -c \"sleep 3s\"";

  nixpkgs.config.allowUnfreePredicate =
    pkg:
    builtins.elem (lib.getName pkg) [
      "steamdeck-hw-theme"
      "steam-jupiter-unwrapped"
      "steam"
      "steam-original"
      "steam-unwrapped"
      "steam-run"
    ];

  # Override jovian-stubs to disable steamos-update kernel check
  # This prevents Steam from requesting reboots for "system updates"
  # Steam client updates will still work normally
  nixpkgs.overlays = [
    (
      final: prev:
      let
        deploy-url = "https://nix-cache.sigkill.computer/deploy/yarn";

        steamos-update-script = final.writeShellScript "steamos-update" ''
          export PATH=${
            final.lib.makeBinPath [
              final.curl
              final.coreutils
              final.nix
            ]
          }

          STORE_PATH=$(curl -sf --max-time 30 "${deploy-url}" || true)

          if [ -z "$STORE_PATH" ]; then
            >&2 echo "[steamos-update] server unreachable"
            exit 7
          fi

          CURRENT=$(readlink -f /nix/var/nix/profiles/system)
          if [ "$CURRENT" = "$STORE_PATH" ]; then
            >&2 echo "[steamos-update] no update available"
            exit 0
          fi

          # check-only mode: just report that an update exists
          if [ "''${1:-}" = "check" ] || [ "''${1:-}" = "--check-only" ]; then
            >&2 echo "[steamos-update] update available"
            exit 0
          fi

          >&2 echo "[steamos-update] downloading update..."
          nix-store -r "$STORE_PATH" || { >&2 echo "[steamos-update] fetch failed"; exit 1; }

          >&2 echo "[steamos-update] installing update..."
          nix-env -p /nix/var/nix/profiles/system --set "$STORE_PATH" || { >&2 echo "[steamos-update] profile set failed"; exit 1; }
          "$STORE_PATH/bin/switch-to-configuration" boot || { >&2 echo "[steamos-update] boot entry failed"; exit 1; }

          >&2 echo "[steamos-update] update installed, reboot to apply"
        '';
      in
      {
        jovian-stubs = prev.stdenv.mkDerivation {
          name = "jovian-stubs";
          dontUnpack = true;
          installPhase = ''
            mkdir -p $out/bin
            ln -s ${steamos-update-script} $out/bin/steamos-update
            ln -s ${steamos-update-script} $out/bin/steamos-mandatory-update

            # jupiter-initial-firmware-update: no-op (not a real steam deck)
            cat > $out/bin/jupiter-initial-firmware-update << 'STUB'
            #!/bin/sh
            exit 0
            STUB

            # steamos-reboot: reboot the system
            cat > $out/bin/steamos-reboot << 'STUB'
            #!/bin/sh
            >&2 echo "[JOVIAN] $0: stub called with: $*"
            systemctl reboot
            STUB

            # steamos-select-branch: no-op stub
            cat > $out/bin/steamos-select-branch << 'STUB'
            #!/bin/sh
            >&2 echo "[JOVIAN] $0: stub called with: $*"
            exit 0
            STUB

            # steamos-factory-reset-config: no-op stub
            cat > $out/bin/steamos-factory-reset-config << 'STUB'
            #!/bin/sh
            >&2 echo "[JOVIAN] $0: stub called with: $*"
            exit 0
            STUB

            # steamos-firmware-update: no-op stub
            cat > $out/bin/steamos-firmware-update << 'STUB'
            #!/bin/sh
            >&2 echo "[JOVIAN] $0: stub called with: $*"
            exit 0
            STUB

            # pkexec: pass through to real pkexec
            cat > $out/bin/pkexec << 'STUB'
            #!/bin/sh
            exec /run/wrappers/bin/pkexec "$@"
            STUB

            # sudo: pass through to doas
            cat > $out/bin/sudo << 'STUB'
            #!/bin/sh
            exec /run/wrappers/bin/doas "$@"
            STUB

            find $out/bin -type f -exec chmod 755 {} +
          '';
        };
      }
    )
  ];

  jovian = {
    devices.steamdeck.enable = false;
    steam = {
      enable = true;
      autoStart = true;
      desktopSession = "niri";
      user = username;
    };
  };

  # Jovian-NixOS requires sddm
  # https://github.com/Jovian-Experiments/Jovian-NixOS/commit/52f140c07493f8bb6cd0773c7e1afe3e1fd1d1fa
  services.displayManager.sddm.wayland.enable = true;

  # Disable gamescope from common.nix to avoid conflict with jovian-nixos
  programs.gamescope.enable = lib.mkForce false;
}