{ config, pkgs, lib, ... }:

{
  imports = [
    # hardware-configuration.nix auto-generated by nixos-anywhere
    ./disko.nix
  ];

  # System identity
  networking.hostName = "node02";
  networking.domain = "plasma.local";

  # Cluster node resolution
  networking.hosts = {
    "192.168.100.11" = [ "node01" "node01.plasma.local" ];
    "192.168.100.12" = [ "node02" "node02.plasma.local" ];
    "192.168.100.13" = [ "node03" "node03.plasma.local" ];
  };

  # Network configuration
  networking.useDHCP = false;
  networking.interfaces.eth0 = {
    useDHCP = false;
    ipv4.addresses = [{
      address = "192.168.100.12";
      prefixLength = 24;
    }];
  };
  # eth1 for SLIRP/NAT SSH access in VM environment
  networking.interfaces.eth1.useDHCP = true;
  networking.defaultGateway = "192.168.100.1";
  networking.nameservers = [ "8.8.8.8" "8.8.4.4" ];

  # Firewall configuration
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      22      # SSH
      2379    # Chainfire API
      2380    # Chainfire Raft
      2381    # Chainfire Gossip
      2479    # FlareDB API
      2480    # FlareDB Raft
      3080    # IAM API
      8081    # PlasmaVMC API
      8082    # PrismNET API
      8053    # FlashDNS API
      8084    # FiberLB API
      8085    # LightningStor API
      8086    # K8sHost API
      9090    # Prometheus
      3000    # Grafana
      3010    # CreditService API
    ];
  };

  # Boot configuration
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # LVM support in initrd (systemd-based stage 1)
  boot.initrd.systemd.enable = true;
  boot.initrd.kernelModules = [ "dm-snapshot" "dm-mod" "dm-crypt" ];
  boot.initrd.services.lvm.enable = true;

  # Ensure LVM is available
  services.lvm.enable = true;
  services.lvm.boot.thin.enable = true;

  # Additional LVM device waiting
  boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_blk" "virtio_scsi" "sd_mod" ];

  # Use traditional interface names (eth0, eth1) for QEMU compatibility
  boot.kernelParams = [ "net.ifnames=0" "biosdevname=0" "console=ttyS0,115200n8" "loglevel=4" ];

  # Haveged for entropy in VMs
  services.haveged.enable = true;

  # Enable PlasmaCloud services (control-plane profile)
  services.chainfire.enable = true;
  services.flaredb.enable = true;
  services.iam = {
    enable = true;
    port = 3080;  # Avoid conflict with Grafana on 3000
  };
  services.plasmavmc.enable = true;
  services.prismnet.enable = true;
  services.flashdns.enable = true;
  services.fiberlb.enable = true;
  services.lightningstor.enable = true;
  services.k8shost.enable = true;
  services.nightlight.enable = true;
  services.creditservice.enable = true;
  services.cloud-observability.enable = true;

  # First-boot automation
  services.first-boot-automation = {
    enable = true;
    configFile = "/etc/nixos/secrets/cluster-config.json";
    enableChainfire = true;
    enableFlareDB = true;
    enableIAM = true;
    enableHealthCheck = true;
  };

  # System packages
  environment.systemPackages = with pkgs; [
    vim
    htop
    curl
    jq
    tcpdump
    lsof
    netcat
  ];

  # SSH configuration
  services.openssh = {
    enable = true;
    settings = {
      PermitRootLogin = "prohibit-password";
      PasswordAuthentication = false;
    };
  };

  # Time zone and locale
  time.timeZone = "UTC";
  i18n.defaultLocale = "en_US.UTF-8";

  # System user
  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICaSw8CP4Si0Cn0WpYMhgdYNvsR3qFO0ZFiRjpGZXd6S centra@cn-nixos-think"
  ];

  # Allow unfree packages (if needed for drivers)
  nixpkgs.config.allowUnfree = true;

  # System state version
  system.stateVersion = "24.05";
}