#!/usr/bin/env bash
set -euo pipefail

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/nix-bootstrap.sh
source "${script_dir}/lib/nix-bootstrap.sh"
# shellcheck source=lib/nix-eval.sh
source "${script_dir}/lib/nix-eval.sh"

install_nix_if_missing() {
  if command -v nix >/dev/null 2>&1; then
    return
  fi

  echo "Nix not found. Installing Nix..."

  if [ "$(id -u)" -eq 0 ]; then
    echo "Running as root; preparing nixbld users for container/Codex environment..."

    if ! getent group nixbld >/dev/null; then
      groupadd -r nixbld
    fi

    for i in $(seq 1 10); do
      if ! id "nixbld$i" >/dev/null 2>&1; then
        useradd \
          -r \
          -g nixbld \
          -G nixbld \
          -d /var/empty \
          -s /usr/sbin/nologin \
          "nixbld$i" || true
      fi
    done

    mkdir -p /etc/nix
    cat > /etc/nix/nix.conf <<'EOF'
experimental-features = nix-command flakes
accept-flake-config = false
warn-dirty = false
build-users-group = nixbld
EOF

    # The official installer's single-user root path still shells out to
    # `sudo` to create /nix even though it already knows it's running as
    # root -- confirmed live against a sudo-less minimal Debian/Proxmox
    # node, where it fails with "sudo: not found" and prints this exact
    # mkdir/chown as the manual fix. Pre-create it so that branch of the
    # installer is skipped entirely.
    if [ ! -d /nix ]; then
      mkdir -m 0755 /nix
      chown root /nix
    fi

    sh <(curl -L https://nixos.org/nix/install) --no-daemon
  else
    sh <(curl -L https://nixos.org/nix/install) --no-daemon
  fi

  ensure_nix_profile
}

install_nix_if_missing
ensure_nix_profile

mkdir -p "$HOME/.config/nix"
cat > "$HOME/.config/nix/nix.conf" <<'EOF'
experimental-features = nix-command flakes
accept-flake-config = false
warn-dirty = false
build-users-group =
EOF

echo "Nix version:"
nix --version

echo "Enabling tracked git hooks (pre-commit secret scan)..."
git config core.hooksPath .githooks

echo "Installing jq if unavailable..."
if ! command -v jq >/dev/null 2>&1; then
  nix profile install nixpkgs#jq
fi

echo "Available NixOS hosts:"
list_flake_targets .

echo "Codex setup complete. Run bash scripts/codex-maintenance.sh to validate changes."