{ config, lib, pkgs, inputs, ... }:

let
  pxeRoot = "/srv/pxe";
  httpRoot = "${pxeRoot}/http";
  tftpRoot = "${pxeRoot}/tftp";
  pxeBaseUrl = "http://192.168.2.247";

  bootIpxe = pkgs.writeText "boot.ipxe" ''
    #!ipxe

    dhcp
    echo Booting from PXE server...
    chain ${pxeBaseUrl}/menu.ipxe
  '';

  autoexecIpxe = pkgs.writeText "autoexec.ipxe" ''
    #!ipxe

    dhcp
    chain ${pxeBaseUrl}/boot.ipxe
  '';

  systemRescueIpxe = pkgs.writeText "systemrescue.ipxe" ''
    #!ipxe

    set base ${pxeBaseUrl}

    kernel ''${base}/systemrescue/sysresccd/boot/x86_64/vmlinuz initrd=sysresccd.img archisobasedir=sysresccd archiso_http_srv=''${base}/systemrescue/ ip=dhcp checksum
    initrd ''${base}/systemrescue/sysresccd/boot/x86_64/sysresccd.img sysresccd.img
    boot
  '';

  stageSystemRescue = pkgs.writeShellScript "stage-systemrescue" ''
    set -eu

    iso="${httpRoot}/images/systemrescue.iso"
    staged="${httpRoot}/systemrescue"
    tmp="${httpRoot}/.systemrescue.tmp"
    previous="${httpRoot}/.systemrescue.previous"

    if [ ! -e "$iso" ]; then
      echo "SystemRescue ISO not found at $iso; skipping staging."
      exit 0
    fi

    rm -rf "$tmp"
    mkdir -p "$tmp"

    ${pkgs.libarchive}/bin/bsdtar -C "$tmp" -xf "$iso"

    test -f "$tmp/sysresccd/boot/x86_64/vmlinuz"
    test -f "$tmp/sysresccd/boot/x86_64/sysresccd.img"
    chmod -R a+rX "$tmp"

    rm -rf "$previous"
    if [ -e "$staged" ]; then
      mv "$staged" "$previous"
    fi

    mv "$tmp" "$staged"
    rm -rf "$previous"
  '';

  menuIpxe = pkgs.writeText "menu.ipxe" ''
    #!ipxe

    set base ${pxeBaseUrl}

    menu PXE Boot Menu
    item nixos NixOS Installer
    item rescue Rescue Environment
    item shell iPXE Shell
    item reboot Reboot

    choose target && goto ''${target}

    :nixos
    kernel ''${base}/nixos/bzImage ip=dhcp
    initrd ''${base}/nixos/initrd
    boot

    :rescue
    chain ''${base}/systemrescue.ipxe

    :shell
    shell

    :reboot
    reboot
  '';
in
{
  imports =
    [
      ../../common/configuration.nix
      ../../modules/nix/cache-client.nix
      ../../modules/nix/remote-builder-client.nix
    ];

  networking.hostName = "pxe-boot";

  environment.systemPackages = with pkgs; [
    ipxe
  ];

  services.nginx = {
    enable = true;

    virtualHosts."pxe-boot" = {
      default = true;
      root = httpRoot;
      locations."/" = {
        extraConfig = ''
          autoindex on;
        '';
      };
    };
  };

  # TFTP is only used to deliver the initial iPXE bootloader. After iPXE
  # starts, all further assets are fetched via nginx over HTTP.
  services.atftpd = {
    enable = true;
    root = tftpRoot;
    extraOptions = [
      "--verbose=5"
    ];
  };

  systemd.tmpfiles.rules = [
    "d ${pxeRoot} 0755 root root -"
    "d ${httpRoot} 0755 root root -"
    "d ${httpRoot}/images 0755 root root -"
    "d ${httpRoot}/nixos 0755 root root -"
    "d ${httpRoot}/systemrescue 0755 root root -"
    "d ${httpRoot}/ubuntu 0755 root root -"
    "d ${httpRoot}/rescue 0755 root root -"
    "d ${tftpRoot} 0755 root root -"
    "C+ ${httpRoot}/boot.ipxe 0644 root root - ${bootIpxe}"
    "C+ ${httpRoot}/menu.ipxe 0644 root root - ${menuIpxe}"
    "C+ ${httpRoot}/systemrescue.ipxe 0644 root root - ${systemRescueIpxe}"
    "C+ ${tftpRoot}/autoexec.ipxe 0644 root root - ${autoexecIpxe}"
    "C+ ${tftpRoot}/ipxe.efi 0644 root root - ${pkgs.ipxe}/ipxe.efi"
    "C+ ${tftpRoot}/undionly.kpxe 0644 root root - ${pkgs.ipxe}/undionly.kpxe"
  ];

  systemd.services.stage-systemrescue = {
    description = "Stage SystemRescue ISO contents for HTTP PXE boot";
    after = [
      "local-fs.target"
      "systemd-tmpfiles-setup.service"
    ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      ExecStart = stageSystemRescue;
    };
  };

  services.openssh.settings.PermitRootLogin = "yes";

  networking.firewall.allowedTCPPorts = [ 80 ];
  networking.firewall.allowedUDPPorts = [ 69 ];

  system.stateVersion = "25.05";
}