nixos-config/configuration.nix

{ config, pkgs, ... }:

{
  imports = [
    ./hardware-configuration.nix
    ./modules
  ];

  # ── Nix 自身设置 ────────────────────────────────────────────
  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nix.settings.auto-optimise-store = true;
  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 7d";
  };
  nixpkgs.config.allowUnfree = true;

  # ── 引导 ────────────────────────────────────────────────────
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.grub = {
    enable = true;
    efiSupport = true;
    device = "nodev";
    configurationLimit = 10;
    useOSProber = true;  # 检测其他系统（Windows 等）
  };

  # ── 网络 ────────────────────────────────────────────────────
  networking.hostName = "nixos";
  networking.networkmanager.enable = true;
  services.tailscale.enable = true;
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];

  # ── 时区与本地化 ────────────────────────────────────────────
  time.timeZone = "Asia/Shanghai";

  i18n.defaultLocale = "zh_CN.UTF-8";
  i18n.extraLocaleSettings = {
    LC_ADDRESS = "zh_CN.UTF-8";
    LC_IDENTIFICATION = "zh_CN.UTF-8";
    LC_MEASUREMENT = "zh_CN.UTF-8";
    LC_MONETARY = "zh_CN.UTF-8";
    LC_NAME = "zh_CN.UTF-8";
    LC_NUMERIC = "zh_CN.UTF-8";
    LC_PAPER = "zh_CN.UTF-8";
    LC_TELEPHONE = "zh_CN.UTF-8";
    LC_TIME = "zh_CN.UTF-8";
  };

  i18n.inputMethod = {
    enable = true;
    type = "fcitx5";
    fcitx5.waylandFrontend = true;
    fcitx5.addons = with pkgs; [
      fcitx5-rime
      fcitx5-gtk
      kdePackages.fcitx5-qt
      kdePackages.fcitx5-configtool
    ];
  };
  environment.sessionVariables = {
    GTK_IM_MODULE = "fcitx";
    QT_IM_MODULE = "fcitx";
    XMODIFIERS = "@im=fcitx";
    NIXOS_OZONE_WL = "1";
  };

  # ── 桌面环境 (KDE Plasma 6 / Wayland) ───────────────────────
  services.xserver.enable = true;
  services.displayManager.sddm.enable = true;
  services.desktopManager.plasma6.enable = true;
  programs.hyprland.enable = true;
  security.pam.services.login.kwallet = {
    enable = true;
    forceRun = true;
  };
  security.pam.services.sddm.kwallet = {
    enable = true;
    forceRun = true;
  };
  services.xserver.xkb.layout = "us";

  # 字体
  fonts.enableDefaultPackages = true;
  fonts.packages = with pkgs; [
    noto-fonts
    noto-fonts-cjk-sans
    noto-fonts-cjk-serif
    sarasa-gothic  # 更纱黑体
    lxgw-wenkai    # 霞鹜文楷，非常漂亮的楷体
    wqy_microhei
    wqy_zenhei
    nerd-fonts.symbols-only # 补全终端图标
  ];
  fonts.fontconfig = {
    enable = true;
    defaultFonts = {
      serif = [ "Noto Serif CJK SC" "LXGW WenKai" "Noto Serif" ];
      sansSerif = [ "Noto Sans CJK SC" "Noto Sans" ];
      monospace = [ "Sarasa Term SC" "Noto Sans Mono CJK SC" ];
      emoji = [ "Noto Color Emoji" ];
    };
    # 针对楷体的 fallback 专门配置
    localConf = ''
      <alias>
        <family>kaiti</family>
        <prefer>
          <family>LXGW WenKai</family>
        </prefer>
      </alias>
    '';
    antialias = true;
    hinting.enable = true;
    hinting.style = "slight";
    subpixel.rgba = "rgb";
    subpixel.lcdfilter = "default";
  };

  # 音频 (PipeWire)
  services.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
  };

  services.printing.enable = true;
  services.flatpak.enable = true;
  services.upower.enable = true;
  services.power-profiles-daemon.enable = true;
  services.gnome.evolution-data-server.enable = true;
  hardware.bluetooth.enable = true;

  # 压缩内存 swap，大小等于物理内存。
  zramSwap = {
    enable = true;
    memoryPercent = 100;
    algorithm = "zstd";
    priority = 100;
  };

  # ── 用户 ────────────────────────────────────────────────────
  users.users.luodh = {
    isNormalUser = true;
    description = "luodh";
    shell = pkgs.fish;
    extraGroups = [ "networkmanager" "wheel" ];
    packages = with pkgs; [
      bubblewrap
    ];
  };

  # ── 程序与服务 ──────────────────────────────────────────────
  programs.fish.enable = true;
  programs.firefox.enable = true;
  programs.steam.enable = true;
  programs.nix-ld.enable = true;
  virtualisation.docker.enable = true;
  services.gnome.gnome-keyring.enable = true;
  security.polkit.enable = true;
  
  # 确保 PAM 能够自动解锁 gnome-keyring
  security.pam.services.login.enableGnomeKeyring = true;
  security.pam.services.sddm.enableGnomeKeyring = true;

  # ── 系统级软件包 ────────────────────────────────────────────
  environment.systemPackages = with pkgs; [
    rsync
    wget
    (python3.withPackages (ps: with ps; [ pip ]))
    zip
    unzip
    ffmpeg
    librime
  ];

  # ── 系统状态版本（请勿修改） ────────────────────────────────
  system.stateVersion = "25.11";
}