nixcfg/systems/x86_64-linux/sgx/default.nix

{ pkgs, lib, config, ... }:
with lib;
with lib.plusultra;
{
  imports = [ ./hardware-configuration.nix ];

  sops.secrets.pccs.sopsFile = ../../../.secrets/sgx/pccs.yaml;

  plusultra = {
    base.enable = true;
    gui.enable = false;
    nix-ld.enable = true;
    nix.enable = true;
    nix.extra-substituters."https://nixsgx.cachix.org".key = "nixsgx.cachix.org-1:tGi36DlY2joNsIXOlGnSgWW0+E094V6hW0umQRo/KoE=";
    pccs.enable = true;
    pccs.secret = config.sops.secrets.pccs.path;
    podman.enable = true;
    secureboot.enable = true;
  };

  system.autoUpgrade = {
    enable = true;
    operation = "boot";
    allowReboot = true;
  };

  security.tpm2.enable = false;
  security.tpm2.abrmd.enable = false;

  networking.wireless.enable = false; # Enables wireless support via wpa_supplicant.

  services.aesmd.enable = true;

  powerManagement.cpuFreqGovernor = "ondemand";

  system.stateVersion = "23.11";
}