nix-configuration/home-manager/lcech-mac-veracode.nix

{
  lib,
  pkgs,
  ...
}:
let
  username = "lcech";
  homedir = "/Users/${username}";

  zshSourceDirs = [ ];

  gitUsername = "Lukas Cech";
  gitEmail = "lcech@veracode.com";

in
{
  imports = [
    (import ./veracode/aws-cli.nix {
      inherit homedir lib pkgs;
    })
  ];

  home.username = username;

  home.homeDirectory = homedir;

  home.stateVersion = "24.11";

  home.packages = with pkgs; [
    hammerspoon
    pstree
    watch
    colima
    docker
    wireshark-qt
  ];

  # ghostty marked as broken as of 2025-01-05 in nix, using homebrew and custom config
  home.file = {
    "${homedir}/Library/Application Support/com.mitchellh.ghostty/config" = {
      text = ''
        ${builtins.readFile ./shared/ghostty.config}

        font-size = 14
      '';
    };

    "${homedir}/.gnupg/gpg-agent.conf" = {
      text = ''
        default-cache-ttl 34560000
        max-cache-ttl 34560000
        pinentry-program ${pkgs.pinentry_mac}/bin/pinentry-mac
      '';
    };

    "${homedir}/.ssh/config" = {
      text = ''
        Include /Users/lcech/.colima/ssh_config

        host git.c3c.cz
                Port 5522

        host dingleberry
                User becky
                Hostname 10.196.196.5
                IdentityFile ~/.ssh/id_ed25519_access
      '';
    };

    "${homedir}/.hammerspoon/hmSpoons/C3CWorkspace.spoon" = {
      source = ./hammerspoon/C3CWorkspace.spoon;
      recursive = true;
    };

    "${homedir}/.hammerspoon/init.lua" = {
      text = ''
        ${builtins.readFile ./hammerspoon/window-tiling.lua}

        ${builtins.readFile ./hammerspoon/window-move.lua}

        package.path = package.path .. ";" ..  hs.configdir .. "/hmSpoons/?.spoon/init.lua"

        hs.loadSpoon("C3CWorkspace")

        spoon.C3CWorkspace:bindHotKeys({
          restoreAppsToScreens = {{"ctrl", "alt", "cmd"}, "F12"}
        })
      '';
    };
  };

  programs.git = {
    enable = true;
    userName = gitUsername;
    userEmail = gitEmail;

    ignores = [
      ".vscode"
      ".direnv"
      ".devenv"
      ".envrc"
    ];

    signing = {
      signByDefault = true;
      key = "5ABD6C5E";
    };

    extraConfig = {
      core = {
        autocrlf = "input";
        editor = "vim";
      };

      pull.rebase = false;

      init.defaultBranch = "main";

      url."ssh://git@gitlab.laputa.veracode.io/".insteadOf = "https://gitlab.laputa.veracode.io/";
    };
  };

  # Generate key wth gpg --full-gen-key
  # Kind of key: 10 ECC sign only, curve 25519
  # Real name: <username>
  # Email address: <email>

  # Add to git: gpg --list-secret-keys --keyid-format SHORT
  # get the bit after the key kind and put it in the signing.key in git config above
  # gpg --armor --export <KEY> and add to git account

  programs.gpg = {
    enable = true;
    settings = {
      use-agent = true;
    };
    mutableKeys = false;
    publicKeys = [ ];
  };

  programs.lsd = {
    enable = true;
    settings = {
      blocks = [
        "permission"
        "user"
        "group"
        "size"
        "date"
        "git"
        "name"
      ];
      sorting = {
        dir-grouping = "first";
      };
    };
  };

  programs.pay-respects = {
    enable = true;
    enableZshIntegration = true;
  };

  programs.zsh = {
    enable = true;

    dirHashes = {
      mac = "${homedir}/storage/.macshare";
      nix = "${homedir}/.config/nix";
      vc = "${homedir}/projects/veracode";
    };

    shellAliases = {
      hammerspoon-config = "open -a ${pkgs.hammerspoon}/Applications/Hammerspoon.app/Contents/MacOS/Hammerspoon";
      get-key = "${pkgs.writeShellScript "get-key" ''
        scp dingleberry:/self/hintihint/keys/sum.key ${homedir}/hw.key
        read -p "waiting for confirmation to delete the key"
        rm ${homedir}/hw.key
      ''}";
      wg-home = "${pkgs.writeShellScript "wg-home" ''
        WG=$(sudo wg show)
        if [[ "$WG" != "" ]]; then
          if [[ $(echo "$WG" | grep endpoint | cut -c13-26) == "10.125.248.248" ]]; then
            sudo wg-quick down /etc/wireguard/home.conf
          else
            sudo wg-quick down /etc/wireguard/home-remote.conf
          fi
        fi

        if [[ $(dig +short myip.opendns.com @resolver1.opendns.com) == "185.142.210.84" ]]; then
          sudo wg-quick up /etc/wireguard/home.conf
        else
          sudo wg-quick up /etc/wireguard/home-remote.conf
        fi
      ''}";
    };

    initContent = ''
      ${builtins.concatStringsSep "\n" (
        builtins.map (dir: ''
          for file in ${dir}/*.zsh; do
              source "$file"
          done
        '') zshSourceDirs
      )}

      autoload -U +X bashcompinit && bashcompinit

      source <(${pkgs.kubectl}/bin/kubectl completion zsh)
      complete -C '${pkgs.awscli2}/bin/aws_completer' aws

      bindkey '^[[3~' delete-char
    '';
  };

  home.sessionVariables = {
    EDITOR = "vim";
    GO111MODULE = "on";
    TERMINAL = "ghostty";
  };

  launchd.agents.keepass-sync-timer = {
    enable = true;
    config = {
      Program = "${pkgs.writeShellScript "keepass-sync-timer" ''
        ${pkgs.coreutils}/bin/cp "${homedir}/storage/.macshare/.secret/arnie.kdbx" "${homedir}/.secret/arnie.kdbx"
      ''}";
      ProgramArguments = [ ];
      StartInterval = 60 * 10;
      StandardErrorPath = "/var/log/keepass-sync.error.log";
      StandardOutPath = "/var/log/keepass-sync.out.log";
    };
  };
}