(use-modules (gnu)
             (gnu system nss)
             (guix utils)
             (guix packages)
             (guix gexp)
             (nongnu packages linux)
             (gnu packages)
             (gnu packages window-management)
             (gnu packages xorg)
             (gnu packages vim)
             (gnu system privilege)
             ((gnu packages admin) #:select (sudo opendoas))
             (throne deps))

(use-service-modules desktop
                     sddm
                     ssh
                     xorg)

(operating-system
  (kernel linux)
  (firmware (list linux-firmware))
  (host-name "guixygnu")
  (timezone "Asia/Tehran")
  (locale "en_US.utf8")

  (keyboard-layout
   (keyboard-layout "us" "altgr-intl"))

  (bootloader
   (bootloader-configuration
    (bootloader grub-efi-bootloader)
    (targets '("/boot/efi"))
    (keyboard-layout keyboard-layout)))

  (file-systems
   (append
    (list
     (file-system
      (device
       (uuid "53edb5f0-2a5c-4159-9666-52e486b95a49" 'ext4))
      (mount-point "/")
      (type "ext4"))
     (file-system
      (device
       (uuid "4141-8933" 'fat))
      (mount-point "/boot/efi")
      (type "vfat")))
    %base-file-systems))

  (swap-devices
   (list
    (swap-space
     (target
      (uuid "7ab8ddc5-940e-4180-a825-88becd9b6788")))))

  (users
   (cons
    (user-account
     (name "coast")
     (password
      (crypt
       "coast"
       "$6$qPWpreldLzlkO54O$l9DciT6EPOv47H3FPDo2f5zoDag9tFHoNWRWi0SKRSeZmMc3PoyW5Ery7INGPiYDvbHQb97jev/H37JV2F.tU1"))
     (group "users")
     (supplementary-groups
      '("wheel" "netdev" "audio" "video")))
    %base-user-accounts))

  (packages
   (append
    (list
     throne
     niri
     xwayland-satellite
     vim
     opendoas)
    (filter
     (lambda (p)
       (not (eq? p sudo)))
     %base-packages)))

  (privileged-programs
   (cons
    (privileged-program
     (program
      (file-append opendoas "/bin/doas"))
     (setuid? #t))
    (cons
     (privileged-program
      (program
       (file-append throne "/libexec/Throne"))
      (setuid? #f)
      (setgid? #f)
      (capabilities
       "cap_net_bind_service+ep"))
     (cons
      (privileged-program
       (program
        (file-append throne "/libexec/ThroneCore"))
       (setuid? #f)
       (setgid? #f)
       (capabilities
        "cap_net_admin,cap_net_raw,cap_net_bind_service,cap_sys_ptrace,cap_dac_read_search+ep"))
      (filter
       (lambda (pp)
         (not
          (string-contains
           (with-output-to-string
            (lambda ()
              (write
               (privileged-program-program pp))))
           "sudo")))
       %default-privileged-programs)))))

  (services
   (cons*
    (service plasma-desktop-service-type)
    (service
     sddm-service-type
     (sddm-configuration
      (theme "breeze")))
    (service openssh-service-type)
    (modify-services %desktop-services
      (delete gdm-service-type))))

  (name-service-switch %mdns-host-lookup-nss))