# NixOS USB system with auto-update from public Git repo
# Repo: https://git.skarockoi.de/ska/nixos-production.git

{ config, pkgs, ... }:

let
  gitRepoUrl = "https://git.skarockoi.de/ska/nixos-production.git";
  gitLocalPath = "/var/lib/nixos-config";
in

{
  imports =
    [ ./hardware-configuration.nix ];

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "nixos-usb";
  networking.networkmanager.enable = true;

  time.timeZone = "Europe/Berlin";

  i18n.defaultLocale = "de_DE.UTF-8";
  i18n.extraLocaleSettings = {
    LC_ADDRESS = "de_DE.UTF-8";
    LC_IDENTIFICATION = "de_DE.UTF-8";
    LC_MEASUREMENT = "de_DE.UTF-8";
    LC_MONETARY = "de_DE.UTF-8";
    LC_NAME = "de_DE.UTF-8";
    LC_NUMERIC = "de_DE.UTF-8";
    LC_PAPER = "de_DE.UTF-8";
    LC_TELEPHONE = "de_DE.UTF-8";
    LC_TIME = "de_DE.UTF-8";
  };

  services.xserver.enable = true;
  services.xserver.displayManager.gdm.enable = true;
  services.xserver.desktopManager.gnome.enable = true;
  services.xserver.xkb.layout = "de";
  services.xserver.libinput.enable = true;
  console.keyMap = "de";

  services.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
  };

  services.printing.enable = true;

  users.users.user = {
    isNormalUser = true;
    description = "user";
    extraGroups = [ "networkmanager" "wheel" ];
    shell = pkgs.bash;
  };

  nixpkgs.config.allowUnfree = true;

  environment.systemPackages = with pkgs; [
    git
    curl
    wget
    vim
    openssh
    obsidian
    libreoffice
    keepassxc
    thunderbird
    tor-browser
    inkscape
    gimp
    pdfarranger
    epiphany
    shortwave
    gnomeExtensions.gsconnect
    gnomeExtensions.dash-to-dock
  ];

  programs.firefox.enable = true;

  # === Auto-update script with proper NIX_PATH for systemd ===
  environment.etc."update-nixos-config.sh".text = ''
    #!/run/current-system/sw/bin/bash
    set -e

    # Critical: set NIX_PATH so nixos-rebuild can find <nixpkgs/nixos>
    export NIX_PATH="nixpkgs=/run/current-system/nixos"
    export PATH="/run/current-system/sw/bin:/nix/var/nix/profiles/default/bin"

    LOCAL_PATH="${gitLocalPath}"
    REPO_URL="${gitRepoUrl}"

    if [ ! -d "$LOCAL_PATH/.git" ]; then
      mkdir -p "$LOCAL_PATH"
      chmod 700 "$LOCAL_PATH"
      echo "Cloning config from $REPO_URL..."
      git clone "$REPO_URL" "$LOCAL_PATH"
    else
      cd "$LOCAL_PATH"
      echo "Fetching updates..."
      git fetch origin
      LOCAL_HEAD=$(git rev-parse HEAD)
      REMOTE_HEAD=$(git rev-parse origin/main)
      if [ "$LOCAL_HEAD" != "$REMOTE_HEAD" ]; then
        echo "New config available. Updating..."
        git reset --hard origin/main
        nixos-rebuild switch -I nixos-config="$LOCAL_PATH/configuration.nix"
        echo "System updated successfully."
      else
        echo "Config is already up to date."
      fi
    fi
  '';
  environment.etc."update-nixos-config.sh".mode = "0700";

  # === Systemd timer: boot + hourly ===
  systemd.services.nixos-git-update = {
    description = "Update NixOS from public Git config";
    script = "/etc/update-nixos-config.sh";
    serviceConfig = {
      Type = "oneshot";
      User = "root";
      Group = "root";
    };
  };

  systemd.timers.nixos-git-update = {
    description = "Check for config updates hourly";
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnBootSec = "60s";
      OnUnitActiveSec = "1h";
    };
  };

  system.stateVersion = "25.11";
}