{ lib, vars, ... }:

{
  # Prestages a NetworkManager connection profile for vars.wifiSsid/
  # wifiPassword so the host associates on first boot with no manual
  # nmtui/nmcli step. Guarded on a non-empty SSID so leaving the
  # placeholders blank in variables.nix is a no-op rather than an empty,
  # broken profile — fill both in once the bare-metal hardware profile is
  # wired up.
  networking.networkmanager.ensureProfiles.profiles = lib.mkIf (vars.wifiSsid != "") {
    ${vars.wifiSsid} = {
      connection = {
        id = vars.wifiSsid;
        type = "wifi";
      };
      wifi = {
        mode = "infrastructure";
        ssid = vars.wifiSsid;
      };
      wifi-security = {
        key-mgmt = "wpa-psk";
        psk = vars.wifiPassword;
      };
    };
  };
}