nixos/hosts/nixbox/home.nix

{
  lib,
  inputs,
  config,
  pkgs,
  pkgs-unstable,
  ssh-agent-switcher,
  user,
  ...
} :
let
  pathToKeys = ../common/keys/yubi;
  yubiKeys =
    lib.lists.forEach (builtins.attrNames (builtins.readDir pathToKeys))
    (key: lib.substring 0 (lib.stringLength key - lib.stringLength ".pub") key); # Remove .pub suffix.
  yubikeyPublicKeyEntries = lib.attrsets.mergeAttrsList (
    lib.lists.map
      (key: { ".ssh/${key}.pub".source = "${pathToKeys}/${key}.pub"; })
      yubiKeys
  );
  username = user.name;
  homeDirectory = user.homeDirectory;
in {

  imports = [
    ../../home-modules/hyprland

    ../../home-modules
    ../../home-modules/direnv.nix
    ../../home-modules/ghostty-config.nix
    ../../home-modules/git.nix
    ../../home-modules/lazygit.nix
    ../../home-modules/nvim.nix
    ../../home-modules/sops.nix
    # ../../home-modules/ssh-client.nix
    ../../home-modules/starship.nix
    ../../home-modules/tmux.nix
    ../../home-modules/zsh.nix

    inputs.zen-browser.homeModules.beta
  ];

  # Custom options for my packages.
  nvim = {
    package = pkgs-unstable.neovim;
    enable = true;
  };
  ghostty = {
    font-size = "14";
    window-decoration = false;
  };
  programs.zen-browser.enable = true;

  home = {
    username = username;
    homeDirectory = homeDirectory;

    packages = with pkgs; [
      # Media
      loupe
      vlc
      bluetui
      # Audio
      wireplumber
      spotify-player
      # Secret management.
      age
      sops
      # Browsers
      firefox
      # Coms
      discord
      slack
      obs-studio

      # AWS tools
      # awscli2
      # (callPackage ../../nixos-modules/shell-apps/aws-cli-mfa.nix {})

      # Minecraft
      prismlauncher

      # Misc
      pkgs-unstable.opencode
      pkgs-unstable.claude-code
      pkgs-unstable.openssl
      pkgs-unstable.dig
      # zig
      fastfetch
      fzf
      ripgrep
      git
      wget
      exercism
    ];

    file = {} // yubikeyPublicKeyEntries;

    pointerCursor = {
      gtk.enable = true;
      x11.enable = true;
      hyprcursor.enable = true;
      name = "Posy_Cursor_Black";
      package = pkgs."posy-cursors";
    };

    stateVersion = "25.11";
  };

  # home.activation.aws-cli-mfa-config = lib.hm.dag.entryAfter ["writeBoundary"] ''
  #   mkdir -p ~/.config/aws-cli-mfa
  #   cat > ~/.config/aws-cli-mfa/config.yaml << EOF
  # mfa_serial: $(cat ${config.sops.secrets."aws/jmug_matcha_mfa_serial".path})
  # role_arn: $(cat ${config.sops.secrets."aws/role_arn".path})
  # session_duration: 43200
  # EOF
  # '';

  programs.zsh = {
    shellAliases = {
      flakeconf = "nvim ${homeDirectory}/nixos/flake.nix";
      nosconf = "nvim ${homeDirectory}/nixos/hosts/nixbox/configuration.nix";
      homeconf = "nvim ${homeDirectory}/nixos/hosts/nixbox/home.nix";
      nvconf = "sudo nvim ${homeDirectory}/nixos/home-modules/explicit-configs/nvim/init.lua";
      rshellconf = "source ~/.zshrc";
      # TODO: Interpolate the name of the host here.
      nrsw = "sudo nixos-rebuild switch --flake ${homeDirectory}/nixos#nixbox";
      fly = "flyctl";
      # awsmfa = "eval $(aws-cli-mfa)";
      # uawsmfa = "eval $(aws-cli-mfa --unset)";
    };
    loginExtra = ''
    if [ ! -e "/tmp/ssh-agent.''${USER}" ]; then
      if [ -n "''${ZSH_VERSION}" ]; then
          eval ${ssh-agent-switcher.packages.x86_64-linux.default}/bin/ssh-agent-switcher 2>/dev/null "&!"
      else
          ${ssh-agent-switcher.packages.x86_64-linux.default}/bin/ssh-agent-switcher 2>/dev/null &
          disown 2>/dev/null || true
      fi
    fi
    export SSH_AUTH_SOCK="/tmp/ssh-agent.''${USER}"
    '';
  };
  
  services.ssh-agent.enable = true;
  programs.ssh = {
    enable = true;
    enableDefaultConfig = false;
    matchBlocks = {
      "*" = {
        forwardAgent = false;
        addKeysToAgent = "no";
        compression = false;
        serverAliveInterval = 0;
        serverAliveCountMax = 3;
        hashKnownHosts = false;
        userKnownHostsFile = "~/.ssh/known_hosts";
        controlMaster = "no";
        controlPath = "~/.ssh/master-%r@%n:%p";
        controlPersist = "no";
        identityFile = [
          "/home/jmug/.ssh/id_yubikey" # Auto updated symlik that matches all yubikeys.
          "/home/jmug/.ssh/id_jmug" # Fallback key with passphrase.
        ];
      };
      git = {
        host = "github.com";
        user = "git";
        addKeysToAgent = "yes";
      };
      forgejo = {
        host = "code.jmug.me";
        user = "forgejo";
        addKeysToAgent = "yes";
      };
      homeserver = {
        user = "jmug";
        hostname = "100.122.244.59";
        forwardAgent = true;
      };
      racknerd = {
        user = "jmug";
        hostname = "155.94.155.137";
      };
      handmade = {
        user = "jmug";
        hostname = "82.180.160.149";
      };
    };
  };

  # Let Home Manager install and manage itself.
  programs.home-manager.enable = true;
}