{ config, lib, pkgs, vars, ... }:

let
  switchCmd = ''
    sudo nixos-rebuild switch \
      --no-write-lock-file \
      --refresh \
      --flake git+https://${vars.giteaDomain}/${vars.giteaRepoPath}.git?dir=${vars.giteaRepoFlakePath}#$(cat /etc/flake-target)
  '';
  testCmd = ''
    sudo nixos-rebuild test \
      --no-write-lock-file \
      --refresh \
      --flake git+https://${vars.giteaDomain}/${vars.giteaRepoPath}.git?dir=${vars.giteaRepoFlakePath}#$(cat /etc/flake-target)
  '';
  buildImageFn = ''
    buildImage() {
      if [ -z "$1" ]; then
        echo "usage: buildImage <flake-target>  (e.g. lxc-docker)" >&2
        return 1
      fi
      NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
        ".#nixosConfigurations.$1.config.system.build.tarball"
    }
  '';
in
{
  imports = [
    ./set-locale.nix
    ../ipa/client.nix
  ];

  # System-wide shell config so all users (including IPA accounts) get the
  # same management aliases as the local nixos user's Home Manager provides.
  programs.bash = {
    shellAliases = {
      "Switch-nix" = switchCmd;
      "Test-nix" = testCmd;
    };
    interactiveShellInit = buildImageFn;
  };

  networking.networkmanager.enable = true;

  # Recommended over the true default (bypasses ZFS's own import safeguards)
  # per the option's own docs; matches hosts/docker/host.nix and
  # modules/services/zfs/enable-service.nix. Harmless no-op on hosts without ZFS.
  boot.zfs.forceImportRoot = false;

  time.timeZone = vars.timeZone;

  services.qemuGuest.enable = true;

  environment.systemPackages = with pkgs; [
    vim
    btop
    git
    gcr
    jq
  ];

  # Secrets shared by every host, decrypted at activation via each host's
  # SSH host key (sops-nix derives the age key from
  # /etc/ssh/ssh_host_ed25519_key automatically). hashedPassword secrets need
  # neededForUsers so they're available before the normal secret-activation
  # step — user creation happens very early in boot.
  sops = {
    defaultSopsFile = ../../secrets/common.yaml;

    secrets = {
      "root-hashedPassword".neededForUsers = true;
      "nixos-hashedPassword".neededForUsers = true;
      "nix-github-token" = { };
    };

    # nix.conf has no *File-style option for access-tokens, so the token is
    # rendered into a runtime-only file (never touches the Nix store) and
    # pulled in via nix.conf's native !include directive.
    templates."nix-github-token.conf".content = ''
      access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
    '';
  };

  nix.extraOptions = ''
    !include ${config.sops.templates."nix-github-token.conf".path}
  '';

  users = {
    # mutableUsers = false makes update-users-groups.pl enforce hashedPasswordFile
    # on every activation, not just on newly-created accounts. Without this, a
    # freshly-built proxmox disk image (activation runs without a usable sops key,
    # so both accounts land in shadow with '!') will never have its passwords fixed
    # by subsequent boots.
    mutableUsers = false;

    users.root = {
      hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
    };

    users.${vars.primaryUser} = {
      isNormalUser = true;
      extraGroups = [ "wheel" ];
      packages = with pkgs; [ tree ];
      hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
      openssh.authorizedKeys.keys = [ vars.adminSshKey ] ++ vars.extraAdminSshKeys;
    };
  };

  services.openssh.enable = true;

  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    auto-optimise-store = true;
  };

  programs.git = {
    enable = true;
    package = pkgs.git;
    config.credential.helper = "store";
  };
}