# Shared base for all hosts (dogma-nixos, dogma-nixos-rtx, dogma-wsl)
{
  config,
  lib,
  pkgs,
  inputs,
  ...
}: {
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  nixpkgs.config.allowUnfree = true;

  time.timeZone = "America/Phoenix";
  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    useXkbConfig = true;
  };

  sops.age.keyFile = "/var/lib/sops-nix/keys.txt";
  sops.defaultSopsFile = ../../secrets/secrets.yaml;

  sops.secrets = {
    "factorio/service_username" = {};
    "factorio/service_token" = {};
    "factorio/gamepassword" = {};
    "backblaze/apikey" = {};
    "google/gmail" = {};
    "caddy/acme_email" = {};
    "dedyn/dnstoken" = {};
    "dedyn/dnsuser" = {};
    "github/token" = {};
    "gitlab/token" = {};
    "mongodb/initial_password" = {};
    "namecheap/ddyn_password" = {
      restartUnits = ["ddclient.service"];
    };
  };

  programs.steam.enable = true;

  sops.templates."factorio.json".content = builtins.toJSON {
    service_username = config.sops.placeholder."factorio/service_username";
    service_token = config.sops.placeholder."factorio/service_token";
    gamepassword = config.sops.placeholder."factorio/gamepassword";
  };
  sops.templates."duplicity.env".content = builtins.toJSON {};

  sops.templates."caddy.env" = {
    owner = "root";
    mode = "0600";
    restartUnits = ["caddy.service"];
    content = ''
      ACME_EMAIL='${config.sops.placeholder."caddy/acme_email"}'
    '';
  };

  programs.zsh.enable = true;
  users.defaultUserShell = pkgs.zsh;
  services.getty.autologinUser = "mask";
  users.users.mask = {
    isNormalUser = true;
    shell = pkgs.zsh;
    extraGroups = [
      "wheel"
      "libvirtd"
      "media"
      "uinput"
    ];
  };

  networking.networkmanager.enable = true;

  # Keep firewall disabled as in original configuration.nix:424
  networking.firewall.enable = false;

  programs.nix-ld = {
    enable = true;
    libraries = with pkgs; [
      zlib
      zstd
      stdenv.cc.cc
      curl
      openssl
      libssh
      bzip2
      libxml2
      acl
      libsodium
      util-linux
      xz
      systemd
    ];
  };

  environment.systemPackages = with pkgs; [
    inotify-tools
    opencode
    steam
    nnn
    hyprlauncher
    qbittorrent
    pinentry-qt
    ddclient
    telegram-desktop
    btop
    doas
    lan-mouse
    stylua
    gh
    glab
    gnupg
    duplicity
    wget
    factorio-headless
    dig
    parted
    tor-browser
    jujutsu
    caddy
    clang
    ansible
    exiftool
    gcc
    home-manager
    flaresolverr
    docker-compose
    virtio-win
    spice
    spice-gtk
    OVMF
    pigz
    mpv
    wofi
    wayvnc
    pcmanfm
    htop
    rsync
    tmux
    git
    kitty
    python3
    deno
    qbittorrent-nox
    sonarr
    radarr
    jackett
    jellyfin
    curl
    p7zip
    dnsmasq
    brave
    keepassxc
    sops
    age
    unzip
  ];

  services.openssh.enable = true;

  system.stateVersion = "25.11";
}