radicle-infra/os/host/xyz/seed/default.nix

{
  self,
  config,
  pkgs,
  lib,
  modulesPath,
  ...
}: {
  imports = [
    ../../../mixin/kmscon.nix
    ../../../mixin/nix.nix
    ../../../mixin/motd.nix
    ../../../mixin/sops.nix
    ../../../mixin/users.nix

    ./ssh.nix
    ./tor.nix
    ./radicle.nix

    (modulesPath + "/profiles/qemu-guest.nix")
  ];

  # /var/lib/radicle /mnt/HC_Volume_30473554/heartwood/.radicle/

  systemd.network.enable = true;

  fileSystems =
    (builtins.listToAttrs (map
      ({
        subvol,
        mountpoint ? "/${subvol}",
      }: {
        name = mountpoint;
        value = {
          device = "/dev/disk/by-uuid/e55dc01e-ecab-4cd2-ad08-e773615f36fd";
          fsType = "btrfs";
          options = ["compress=zstd" "discard=async" "noatime" "subvol=${subvol}"];
        };
      }) [
        {
          mountpoint = "/";
          subvol = "root";
        }
        {subvol = "home";}
        {subvol = "nix";}
      ]))
    // {
      "/boot" = {
        device = "/dev/disk/by-uuid/5d17c66f-46fc-484d-be63-b21786e61af9";
        fsType = "ext2";
      };
    };

  boot = {
    kernel.sysctl."net.ipv4.ip_forward" = 1;
    loader.grub = {
      enable = true;
      efiSupport = false;
      device = "/dev/disk/by-uuid/5d17c66f-46fc-484d-be63-b21786e61af9";
    };

    initrd.availableKernelModules = [
      "ata_piix"
      "uhci_hcd"
      "virtio_pci"
      "sr_mod"
      "virtio_blk"

      "ahci"
      "xhci_pci"
      "virtio_scsi"
      "sd_mod"
    ];
  };

  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
  # Per-interface useDHCP will be mandatory in the future, so this generated config
  # replicates the default behaviour.
  networking = {
    hostName = "seed";
    domain = "radicle.xyz";
    useNetworkd = true;
    useDHCP = false;

    firewall = {
      allowedTCPPorts = [
        22 # ssh
        443 # https
      ];
    };
  };

  # Select internationalisation properties.
  # i18n.defaultLocale = "en_US.UTF-8";
  # console = {
  #   font = "Lat2-Terminus16";
  #   keyMap = "us";
  # };

  # Set your time zone.
  time.timeZone = "UTC";
  i18n.defaultLocale = "en_US.UTF-8";

  environment.systemPackages = with pkgs; [
    coreutils-full
    dmidecode
    exfat
    libvirt
    lshw
    lsof
    nfs-utils
    utillinux
    which
    config.boot.kernelPackages.perf
  ];

  services = {
    accounts-daemon.enable = true;
    resolved.enable = true;

    caddy = {
      enable = true;
      email = "team@radicle.xyz";
      virtualHosts = {
        # TODO: Remove once radicle-httpd is up.
        "https://${config.networking.fqdn}".extraConfig = "respond `${builtins.toJSON {
          rev = self.rev or self.dirtyRev;
          inherit (self) lastModified;
        }}`";
      };
    };
  };

  networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;

  nixpkgs.hostPlatform = "x86_64-linux";

  security = {
    sudo.wheelNeedsPassword = false;
  };
}