nixos/cleo.darwin.nix

{ pkgs
, lib
, ...
}:
let
  ansibleRequired = {
    taps = [
      "fwdcloudsec/granted" # aws sso utility
      "felipeelias/tap" # claude-statusline
      "oven-sh/bun" # bun

      ## Excluded intentionally
      # "sst/tap" # opencode
    ];
    brews = [
      "allure"
      "aws-sso-util"
      "awscli"
      "ccusage"
      "fd"
      "felipeelias/tap/claude-statusline"
      "oven-sh/bun/bun"
      "fwdcloudsec/granted/granted"
      "gh"
      "jq"
      "maven"
      "rg"
      "snyk-cli"
      "ldcli"

      ## Excluded intentionally
      # "gdal"
      # "sst/tap/opencode"
      # "libpq@17"
      # "node@22"
    ];
    casks = [
      "1password-cli"
      "aws-vpn-client"
      "chromedriver"
      "copilot-cli"
      "docker-desktop"
      "expo-orbit"
      "zulu@17"
      "ngrok"

      ## Excluded intentionally
      # "visual-studio-code" # app installed by brew; home-manager owns settings + extensions
      # "jetbrains-toolbox"
    ];
  };
in
{
  ids.gids.nixbld = 350;
  security.pam.services.sudo_local.touchIdAuth = true;

  # Set vim as default editor
  environment.variables.EDITOR = "vim";
  environment.variables.VISUAL = "vim";
  environment.variables.GIT_EDITOR = "vim";
  environment.variables.HOMEBREW_NO_ANALYTICS = "1";

  environment.systemPackages = with pkgs; [
    vim
    git
    wget
    curl
    python3
    postgresql_17
    home-manager
    ttyd
    xcodes
    xz
    # node 24.x from unstable (cached); the pinnedNode 24.19.0 rev had no cache.nixos.org binaries
    unstable.nodejs_24
    unstable.yarn
    # iOS simulator UI driving (tap/scroll/type) for screenshots and e2e flows
    unstable.maestro
    unstable.idb-companion
    act
  ];

  # Add Homebrew to PATH
  environment.systemPath = [
    "/opt/homebrew/bin"
    "/opt/homebrew/sbin"
    "/Users/matthew.bessette/.local/bin"
  ];

  system.primaryUser = "matthew.bessette";
  users.users."matthew.bessette" = {
    name = "matthew.bessette";
    home = "/Users/matthew.bessette";
  };

  services.openssh = {
    enable = true;
    extraConfig = ''
      StrictModes no
      # Deny everyone by default unless they match the subnet rule
      Match Address !192.168.0.0/16
        DenyUsers *
    '';
  };

  # Homebrew for Casks and specific binaries
  # In a nix-darwin setup, Homebrew packages are not actually stored inside the Nix store.
  # Instead, nix-darwin acts as a manager that triggers the standard Homebrew installation
  # process on your macOS system.
  homebrew = {
    enable = true;
    onActivation.cleanup = "uninstall";
    onActivation.autoUpdate = true;
    onActivation.upgrade = true;
    # global.autoUpdate = true;
    # Each list is (ansible-managed set) ++ (nix-only extras), deduped. With
    # cleanup = "uninstall" above, anything NOT listed here gets removed on
    # activation — so ansibleRequired must be merged in or nix would clobber it.
    taps = lib.unique (
      ansibleRequired.taps
      ++ [
        # nix-only taps go here
      ]
    );
    brews = lib.unique (
      ansibleRequired.brews
      ++ [
        "biome"
        "jira-cli"
      ]
    );
    # visual-studio-code is installed by Homebrew (in ansibleRequired.casks) so
    # Homebrew owns the .app; home-manager (cleo.home.nix) owns settings +
    # extensions only (programs.vscode with package = null) — no second copy.
    casks = lib.unique (
      ansibleRequired.casks
      ++ [
        "android-commandlinetools"
        "android-platform-tools"
        "bruno"
        "figma"
        "kopiaui"
        "libreoffice"
        "obsidian"
        "postico"
        "sublime-text"
        "spotify"
        "yubico-yubikey-manager"
        "zoom"
      ]
    );
  };

  nix = {
    settings = {
      experimental-features = "nix-command flakes";
      auto-optimise-store = true;
    };
    gc = {
      automatic = true;
      interval = { Weekday = 0; Hour = 2; Minute = 0; }; # Sunday at 2:00 AM
      options = "--delete-older-than 7d";
    };
  };
  system.stateVersion = 4;
}