nix/config/Purpose.nix

{ config, lib, ... }:
let
  cfg = config.module.purpose;
in
{
  config = lib.mkMerge [
    (lib.mkIf cfg.creative {
      module = {
        tablet.enable = true;
        package.creative = true;
      };
    })

    (lib.mkIf cfg.desktop {
      module = {
        keyd.enable = true;
        sway.enable = true;
        kernel = {
          enable = true;
          latest = true;
        };
        package = {
          common = true;
          core = true;
          desktop = true;
        };
      };
    })

    (lib.mkIf cfg.disown {
      module = {
        autoupdate.enable = true;
        kernel = {
          enable = true;
          hardening = true;
        };
      };
    })

    (lib.mkIf cfg.gaming { module.package.gaming = true; })

    (lib.mkIf cfg.laptop {
      services.tlp.enable = true; # Automatic powersaving based on Pluged/AC states.
      services.upower.enable = true;
      module = {
        keyd.enable = true;
        sway.enable = true;
        kernel = {
          enable = true;
          hardening = true;
          latest = true;
        };
        package = {
          common = true;
          core = true;
          desktop = true;
        };
      };
    })

    (lib.mkIf cfg.live {
      module = {
        keyd.enable = true;
        sway.enable = true;
        kernel.enable = true;
        package = {
          common = true;
          core = true;
          creative = true;
          desktop = true;
          dev = true;
          extra = true;
          gaming = true;
        };
      };
    })

    (lib.mkIf cfg.phone { })

    (lib.mkIf cfg.router {
      module = {
        kernel = {
          enable = true;
          hardening = true;
        };
        package = {
          common = true;
          core = true;
        };
      };
      # De-harden some stuff.
      boot.kernel.sysctl = {
        # Allow spoofing.
        "net.ipv4.conf.all.rp_filter" = lib.mkForce 0;
        "net.ipv4.conf.default.rp_filter" = lib.mkForce 0;

        # Forward packets.
        "net.ipv4.ip_forward" = lib.mkForce 1;
        "net.ipv6.conf.all.forwarding" = lib.mkForce 1;
        "net.ipv4.conf.all.src_valid_mark" = lib.mkForce 1;

        # Allow redirects.
        "net.ipv4.conf.all.accept_redirects" = lib.mkForce 1;
        "net.ipv6.conf.all.accept_redirects" = lib.mkForce 1;

        # Send ICMP.
        "net.ipv4.conf.all.send_redirects" = lib.mkForce 1;

        # Accept IP source route packets.
        "net.ipv4.conf.all.accept_source_route" = lib.mkForce 1;
        "net.ipv6.conf.all.accept_source_route" = lib.mkForce 1;
      };
    })

    (lib.mkIf cfg.server {
      module = {
        kernel = {
          enable = true;
          hardening = true;
        };
        package = {
          common = true;
          core = true;
        };
      };
    })

    (lib.mkIf cfg.work {
      module = {
        distrobox.enable = true;
        ollama.enable = true;
        package.dev = true;
        virtmanager.enable = true;
        docker = {
          enable = true;
          autostart = false;
          rootless = false;
        };
        kernel = {
          enable = true;
          hardening = true;
        };
      };
    })
  ];
}