{ config, pkgs, lib, ... }:

{
  # System identity
  networking.hostName = "node02";
  networking.domain = "plasma.local";

  # Cluster node resolution
  networking.hosts = {
    "192.168.100.11" = [ "node01" "node01.plasma.local" ];
    "192.168.100.12" = [ "node02" "node02.plasma.local" ];
    "192.168.100.13" = [ "node03" "node03.plasma.local" ];
  };

  # Network configuration (using actual interface names from VM)
  networking.useDHCP = false;
  networking.interfaces.enp0s2 = {
    useDHCP = false;
    ipv4.addresses = [{
      address = "192.168.100.12";
      prefixLength = 24;
    }];
  };
  # Keep enp0s3 (SLIRP) on DHCP for SSH access
  networking.interfaces.enp0s3.useDHCP = true;

  networking.defaultGateway = "192.168.100.1";
  networking.nameservers = [ "8.8.8.8" "8.8.4.4" ];

  # Firewall configuration
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      22      # SSH
      2379    # Chainfire API
      2380    # Chainfire Raft
      2381    # Chainfire Gossip
      2479    # FlareDB API
      2480    # FlareDB Raft
      8080    # IAM API
      8081    # PlasmaVMC API
      8082    # PrismNET API
      8053    # FlashDNS API
      8084    # FiberLB API
      8085    # LightningStor API
      8086    # K8sHost API
      9090    # Prometheus
      3000    # Grafana
    ];
  };

  # System packages
  environment.systemPackages = with pkgs; [
    vim
    htop
    curl
    jq
    tcpdump
    lsof
    netcat
  ];

  # SSH configuration
  services.openssh = {
    enable = true;
    settings = {
      PermitRootLogin = "prohibit-password";
      PasswordAuthentication = false;
    };
  };

  # Time zone and locale
  time.timeZone = "UTC";
  i18n.defaultLocale = "en_US.UTF-8";

  # System user
  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICaSw8CP4Si0Cn0WpYMhgdYNvsR3qFO0ZFiRjpGZXd6S centra@cn-nixos-think"
  ];

  # Allow unfree packages
  nixpkgs.config.allowUnfree = true;

  # For netboot/live system
  system.stateVersion = "24.05";
}