System Configuration Progress:
- [ ] Step 1: Identify requirements and constraints
- [ ] Step 2: Check existing configuration for conflicts
- [ ] Step 3: Plan changes in staging/VM first
- [ ] Step 4: Implement changes incrementally
- [ ] Step 5: Test each change before next
- [ ] Step 6: Document non-obvious decisions
- [ ] Step 7: Verify rollback works if needed

# Enable and configure services
services.openssh = {
  enable = true;
  settings = {
    PermitRootLogin = "no";
    PasswordAuthentication = false;
  };
};

services.nginx = {
  enable = true;
  recommendedGzipSettings = true;
  recommendedOptimisation = true;
  recommendedTlsSettings = true;
};

# hardware-configuration.nix (auto-generated, but can extend)
hardware.cpu.intel.updateMicrocode = true;
hardware.enableAllFirmware = true;

# GPU configuration
hardware.opengl = {
  enable = true;
  driSupport = true;
  driSupport32Bit = true;  # For Steam/gaming
};

networking = {
  hostName = "myhost";
  networkmanager.enable = true;

  # Firewall
  firewall = {
    enable = true;
    allowedTCPPorts = [ 22 80 443 ];
    allowedUDPPorts = [ ];
  };
};

boot = {
  loader = {
    systemd-boot.enable = true;
    efi.canTouchEfiVariables = true;
  };

  # Kernel parameters
  kernelParams = [ "quiet" "splash" ];

  # Kernel modules
  kernelModules = [ "kvm-intel" ];
};

users.users.myuser = {
  isNormalUser = true;
  description = "My User";
  extraGroups = [ "wheel" "networkmanager" "docker" ];
  openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAA..."
  ];
};

# Disable mutable users for reproducibility
users.mutableUsers = false;

security = {
  # Sudo configuration
  sudo = {
    enable = true;
    wheelNeedsPassword = true;
  };

  # Audit logging
  auditd.enable = true;

  # AppArmor (alternative to SELinux)
  apparmor.enable = true;
};

# Disable unnecessary services
services.avahi.enable = false;

# Restrict kernel features
boot.kernel.sysctl = {
  "kernel.unprivileged_bpf_disabled" = 1;
  "net.core.bpf_jit_harden" = 2;
};

# Increase file descriptor limits
security.pam.loginLimits = [{
  domain = "*";
  type = "soft";
  item = "nofile";
  value = "65536";
}];

# Zram swap for better memory utilization
zramSwap = {
  enable = true;
  algorithm = "zstd";
  memoryPercent = 50;
};

# SSD optimization
services.fstrim.enable = true;