{ config, pkgs, lib, ... }:

{
  imports = [
    # hardware-configuration.nix auto-generated by nixos-anywhere
    ./disko.nix
    ../../../nix/modules/default.nix
  ];

  # System identity
  networking.hostName = "node02";
  networking.domain = "plasma.local";

  # Cluster node resolution
  networking.hosts = {
    "192.168.100.11" = [ "node01" "node01.plasma.local" ];
    "192.168.100.12" = [ "node02" "node02.plasma.local" ];
    "192.168.100.13" = [ "node03" "node03.plasma.local" ];
  };

  # Network configuration
  networking.useDHCP = false;
  networking.interfaces.eth0 = {
    useDHCP = false;
    ipv4.addresses = [{
      address = "192.168.100.12";
      prefixLength = 24;
    }];
  };
  networking.defaultGateway = "192.168.100.1";
  networking.nameservers = [ "8.8.8.8" "8.8.4.4" ];

  # Firewall configuration
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      22      # SSH
      2379    # Chainfire API
      2380    # Chainfire Raft
      2381    # Chainfire Gossip
      2479    # FlareDB API
      2480    # FlareDB Raft
      8080    # IAM API
      8081    # PlasmaVMC API
      8082    # NovaNET API
      8053    # FlashDNS API
      8084    # FiberLB API
      8085    # LightningStor API
      8086    # K8sHost API
      9090    # Prometheus
      3000    # Grafana
    ];
  };

  # Boot configuration
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # Enable PlasmaCloud services (control-plane profile)
  services.chainfire.enable = true;
  services.flaredb.enable = true;
  services.iam.enable = true;
  services.plasmavmc.enable = true;
  services.novanet.enable = true;
  services.flashdns.enable = true;
  services.fiberlb.enable = true;
  services.lightningstor.enable = true;
  services.k8shost.enable = true;

  # First-boot automation
  services.first-boot-automation = {
    enable = true;
    configFile = "/etc/nixos/secrets/cluster-config.json";
    enableChainfire = true;
    enableFlareDB = true;
    enableIAM = true;
    enableHealthCheck = true;
  };

  # System packages
  environment.systemPackages = with pkgs; [
    vim
    htop
    curl
    jq
    tcpdump
    lsof
    netcat
  ];

  # SSH configuration
  services.openssh = {
    enable = true;
    settings = {
      PermitRootLogin = "prohibit-password";
      PasswordAuthentication = false;
    };
  };

  # Time zone and locale
  time.timeZone = "UTC";
  i18n.defaultLocale = "en_US.UTF-8";

  # System user
  users.users.root.openssh.authorizedKeys.keys = [
    # SSH key will be injected during provisioning
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPlaceholder-key-to-be-replaced plasmacloud-provisioning"
  ];

  # Allow unfree packages (if needed for drivers)
  nixpkgs.config.allowUnfree = true;

  # System state version
  system.stateVersion = "24.05";
}