nixfiles/hosts/raspberry/raspberry.nix

{
  tree,
  modulesPath,
  config,
  pkgs,
  lib,
  ...
}: let
  secrets = config.services.secrets.secrets;
in {
  networking.firewall.enable = true;
  networking.firewall.allowPing = true;

  imports = with tree;
    [
      users.root
      users.chaos

      profiles.base
      profiles.sshd
      profiles.nginx
      profiles.nginx-firewall

      profiles.connectivity.network_manager
      profiles.connectivity.bluetooth
      profiles.connectivity.ios

      ./secrets.nix

      ./boot.nix
      (modulesPath + "/installer/sd-card/sd-image.nix")
    ]
    ++ (with hosts.raspberry.profiles; [
      external-drive
      wireguard
      cockroachdb
      piped
      auto-storage-backups
      rclone
    ]);

  environment.systemPackages = [
    (pkgs.writeShellScriptBin "vault-login" ''
      ${pkgs.vault-bin}/bin/vault login -method=userpass username=raspberry password=$(cat ${secrets.vault_login_password.path})
    '')
  ];

  home-manager.users.root = {
    imports = with tree; [home.base home.dev.small];
    home.stateVersion = "23.05";
  };

  home-manager.users.chaos = {
    imports = with tree; [home.base home.dev.small];
    home.stateVersion = "23.05";
  };

  boot.supportedFilesystems = lib.mkForce ["vfat"];
  boot.kernelPackages = pkgs.linuxPackages_latest;

  networking.hostName = "raspberry";
  time.timeZone = "Europe/London";

  sdImage.compressImage = lib.mkForce false;

  system.stateVersion = "21.11";
}