nix-dotfiles/systems/artemision/configuration.nix

{
  lib,
  pkgs,
  config,
  ...
}:
{
  imports = [
    ./audio.nix
    ./desktop.nix
    ./fingerprint.nix
    ./fonts.nix
    ./graphics.nix
    ./libvirt.nix
    ./polkit.nix
    ./programs.nix
    ./steam.nix
    ./stylix.nix
    ./wifi.nix
    ./zerotier.nix
    ../palatine-hill/ollama.nix
  ];

  time.timeZone = "America/New_York";

  # temp workaround for building while in nixos-enter
  #services.logrotate.checkConfig = false;

  networking = {
    hostId = "58f50a15";
    firewall.enable = true;
    useNetworkd = true;
  };

  boot = {
    #kernelPackages = lib.mkForce pkgs.linuxPackages_6_6;
    useSystemdBoot = true;
    default = true;
  };

  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

  services = {
    ollama = {
      package = lib.mkForce pkgs.ollama-rocm;
      models = lib.mkForce "${config.services.ollama.home}/models";
      loadModels = lib.mkForce [
        "deepseek-r1:1.5b"
        "lennyerik/zeta"
        "nomic-embed-text:latest"
        "glm-4.7-flash"
        "magistral"
        "devstral-small-2"
        "starcoder2:7b"
      ];
    };
    avahi = {
      enable = true;
      #publish.enable = true;
      nssmdns4 = true;
      openFirewall = true;
    };
    flatpak.enable = true;
    calibre-web = {
      # temp disable this
      enable = false;
      listen = {
        ip = "127.0.0.1";
      };
      options = {
        calibreLibrary = "/var/lib/calibre-server";
      };
    };
    calibre-server = {
      enable = false;
      user = "calibre-web";
      group = "calibre-web";

    };
    gvfs.enable = true;

    fwupd = {
      enable = true;
      # package =
      #   (import (builtins.fetchTarball {
      #     url = "https://github.com/NixOS/nixpkgs/archive/bb2009ca185d97813e75736c2b8d1d8bb81bde05.tar.gz";
      #     sha256 = "sha256:003qcrsq5g5lggfrpq31gcvj82lb065xvr7bpfa8ddsw8x4dnysk";
      #   }) { inherit (pkgs) system; }).fwupd;
    };
    mullvad-vpn.enable = true;

    fprintd.enable = lib.mkForce false;
    openssh.enable = lib.mkForce false;

    adev.yubikey = {
      enable = true;
      enable-desktop-app = true;
    };
  };

  users.users = {
    alice.extraGroups = [ "calibre-web" ];
  };

  system.stateVersion = "24.05";

  environment.variables = {
    "KWIN_DRM_NO_DIRECT_SCANOUT" = "1";
  };

  #nixpkgs.config = {
  #  rocmSupport = true;
  #};

  sops = {
    defaultSopsFile = ./secrets.yaml;
    #secrets = {
    #  "apps/spotify" = {
    #    group = "audio";
    #    restartUnits = [ "spotifyd.service" ];
    #    mode = "0440";
    #  };
    #};
  };
}