virtualisation = {
  	docker = {
    		enable = true; # Enable the Docker daemon on NixOS ...
        # so you can pull images, run containers, and manage Docker from your NixOS system.
  	};
  	oci-containers.backend = "docker"; # Set Docker as the default container backend
  };

  users.users.nmaximo7 = {
    isNormalUser = true;
    description = "nmaximo7";
    extraGroups = [ "networkmanager" "wheel" "docker"];
	···
  };

environment.systemPackages = with pkgs; [
    docker
    mesa # When running graphical apps in Distrobox, you should first install mesa, an open source 3D graphis library.
    distrobox # Add Distrobox to Your Configuration
];

distrobox-create --name archlinux --image archlinux:latest
# Create an Arch Linux Container via Distrobox
# --name archlinux: assigns a name to the container for easy reference and management.
# --image archlinux:latest: it pulls the latest Arch Linux image from Docker Hub.

distrobox-enter archlinux # After creation, enter the container.
# You can now run Arch Linux commands and applications as if you are on an Arch system.
sudo pacman -Syu # Inside the container, update the package database.
sudo pacman -S --needed base-devel git # Let's make sure we have the base development packages and Git installed.
pacman -Sy archlinux-keyring --noconfirm # Ensure that the system's keyring is up-to-date, which helps in verifying the authenticity of packages during installation or upgrade.
git clone https://aur.archlinux.org/google-chrome.git # Clone the Google Chrome repository.
cd google-chrome
makepkg -si # Install the Package
distrobox-export --app google-chrome-stable # It takes care of exporting an app, a binary, or a service from the container to the host.

cd dotfiles
mkdir distrobox
distrobox rm ‐‐all -f # Delete all previous distroboxes
sudo mkdir -p /home/arch-distro # Create a home directory for your container with the right permissions and ownership.
sudo chown nmaximo7:users /home/arch-distro

#      _            _
#     | |          | |
#   __| | ___   ___| | _____ _ __
#  / _` |/ _ \ / __| |/ / _ \ '__|
# | (_| | (_) | (__|   <  __/ |
#  \__,_|\___/ \___|_|\_\___|_|

# Change directory to where the Dockerfile is located
# cd dotfiles/distrobox

# Build the Docker image with the tag 'custom-arch'
# Using the latest Arch Linux image as a base ensures you start with the most recent packages and security updates.
# docker build -t custom-arch .

# Remove any existing Distrobox container named 'arch'
# distrobox rm arch -f

# Create a new Distrobox container named 'arch' using the custom image
# --home sets the home directory for the container
# --volume mounts a directory from the host into the container
# --verbose enables detailed output
# distrobox create --image custom-arch --name arch --home /home/arch-distro --volume /etc/static/profiles/per-user:/etc/profiles/per-user:ro --verbose

# Enter the created Distrobox container
# distrobox enter arch

# Use the official Arch Linux image as the base image
FROM archlinux:latest

# Initialize the pacman keyring and update the package repository
RUN pacman-key --init && \
    pacman-key --populate archlinux && \
    pacman -Syu --noconfirm

# Force a full refresh of all package databases:
RUN pacman -Syy

RUN pacman -S --noconfirm reflector # Install Reflector

# Update the mirror list using reflector:
RUN reflector --country Spain,France,Germany \
             --latest 20 \
             --protocol http,https \
             --save "/etc/pacman.d/mirrorlist" \
             --sort rate

# Install base development packages and essential tools
RUN pacman -Syu --noconfirm base-devel git

# Install additional tools for productivity
# eza (enhanced ls replacement), bc and qalc (calculators)
# bat (cat with syntax highlighting), ripgrep (a very popular alternative to grep)
RUN pacman -S --noconfirm eza zoxide fd bat ripgrep bc qalc

# Install system utilities and help (tldr), fuzzy finder (fzf)
RUN pacman -S --noconfirm fzf wl-clipboard lazygit jq rsync man-db tldr unzip plocate glibc sudo wget curl

# Install system utilities for various tasks
# bpytop (Linux resource monitor), figlet (convert text into ASCII art), cmatrix (an animated matrix in your terminal)
RUN pacman -S --noconfirm fastfetch vim bpytop cmatrix starship figlet fortune-mod

# Install glibc and glibc-locales to support locale generation
RUN pacman -S --noconfirm glibc glibc-locales

# Set up the locale, i.e., the language, numbering, date, and currency formats for your system.
RUN sed --in-place=.bak 's/^#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
RUN locale-gen

# The /etc/locale.conf file defines system-wide locale settings.
RUN echo "LANG=en_US.UTF-8" >> /etc/locale.conf

# Set up the keyboard layout: loadkeys es. A Spanish keyboard layout is configured by:
RUN echo "KEYMAP=es" >> /etc/vconsole.conf

# Create a non-root user named 'nmaximo7' and allow passwordless sudo, ...
# making package building and maintenance safer than using root.
RUN useradd -m -G wheel nmaximo7 && \
    echo "nmaximo7 ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

# Install additional libraries for GUI applications
RUN pacman -S --noconfirm alsa-lib gtk3 libcups libxss libxtst nss ttf-liberation xdg-utils geany

# Switch to the 'nmaximo7' non-root user
USER nmaximo7
WORKDIR /home/nmaximo7

# Clone and install the AUR helper 'yay'
RUN git clone https://aur.archlinux.org/yay-git.git && \
    cd yay-git && \
    makepkg -si --noconfirm

# Install Google Chrome and Ferdium using yay
RUN yay -S google-chrome --noconfirm
RUN yay -S ferdium-bin --noconfirm

# Switch back to the root user
USER root

# Set Environment Variables for language support and locale settings
ENV LANG=es_ES.UTF-8
ENV LANGUAGE=es_ES:es
ENV LC_ALL=es_ES.UTF-8

distrobox create --image custom-arch --name arch --home /home/arch-distro --volume /etc/static/profiles/per-user:/etc/profiles/per-user:ro --verbose
# --home /home/arch-distro: select a custom HOME directory for the container
# --volume: mounts a host from the host into the container

  environment.systemPackages = with pkgs; [
  ···
  gnupg # The main GPG package for encryption and key management
  pinentry # A set of programs that handle passphrase input securely
];

gpg --list-keys # List your GPG keys.
# You will see an output listing your keys, something like:
pub   ed25519 2024-04-09 [SC]
      YOUR-GPG-KEY
uid           [ultimate] Your Name 
sub   cv25519 2024-04-09 [E]

gpg --export YOUR-GPG-KEY > public-key.asc #  Export your GPG Public Key into a file name public-key.asc.
gpg --export-secret-key -a nmaximo7 > prv.key # Export your GPG Private key into a file name prv.key
# Enter the GPG passphrase if prompted, the password that you set when creating the key.

gpg --pinentry-mode loopback --import prv.key # Import your GPG private key.
# The --pinentry-mode loopback option allows you to enter the passphrase directly on the terminal.
gpg --import public-key.asc # Import your GPG public key.

gpg --list-keys # After importing, verify your GPG public keys have been succesfully imported.

gpg --import someone_else_public.key
# Imports a public key from someone you wish to communicate with securely into your GPG keyring.

gpg --encrypt --recipient someone_else@email.com file.txt
# This command results in an encrypted file (e.g., file.txt.gpg).
# It is encrypted using the recipient's public key and can only be decrypted by the recipient who possesses the corresponding private key.
# This ensures that only the intended recipient can read its contents.

gpg --decrypt file.txt.gpg
# It decrypts an encrypted file.
# GPG will prompt for the passphrase associated with your private key if necessary.

gpg --sign document.txt
# It creates a digital signature for a file (typically in a .gpg or .sig file) ...
# that can be used to verify the authenticity and integrity of the document.
# Anyone with your public key can verify that the document has not been tampered with and that it was indeed signed by you.

services = {
  [...]
  syncthing = {
    enable = true; # Enable the Syncthing service
    openDefaultPorts = true; # Automatically open Syncthing's default ports in the firewall
    user = "YOUR NAME"; # Run Syncthing under user 'YOUR NAME'
    group = "users"; # Specify the group that the user belongs to
    # Directory for Synching's database and sync-related data
    dataDir = "~/.config/syncthing";
    # Define the directory where Syncthing will search for its configuration files
    configDir = "~/.config/syncthing";
    overrideDevices = true; # Allow overriding device settings (if needed), useful for custom device configurations
    overrideFolders = true; # Allow overriding folder settings (if needed), useful for custom folder configurations
    settings = {
        gui = {
            user = "nmaximo7"; # Specify the user for accessing the Syncthing web GUI
        };
    };
  };
};
# Ensure the firewall allows Syncthing traffic (21027/UDP, 22000/TCP), and the web GUI (8384/TCP)
networking.firewall = {
  allowedTCPPorts = [ 17500 22 22000 8384 ];
  allowedUDPPorts = [ 17500 22000 21027 ];
};