# Parameterized zero-touch installer for kiosk USB images.
#
# Usage in flake.nix:
#   (import ./zero-touch-installer.nix { targetConfig = "radiantwavekiosk"; })
#
# `targetConfig` must name an entry in self.nixosConfigurations. The target
# closure and its disko partitioning script are derived from that config, so
# an image can never install a mismatched system or format the wrong disk
# layout as long as flake.nix pairs each ISO with its disk-config.nix.
{ targetConfig }:
{
  pkgs,
  inputs,
  self,
  ...
}:
let
  cfg = self.nixosConfigurations.${targetConfig};
  targetSystem = cfg.config.system.build.toplevel;
  diskoScript = cfg.config.system.build.diskoScript;

  # Keep in sync with myKey in configuration.nix.
  adminKey =
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook";
in
{
  nix.settings = {
    experimental-features = [
      "nix-command"
      "flakes"
    ];

    substituters = [
      "https://cache.nixos.org"
    ];

    flake-registry = "";

    connect-timeout = 0;
  };

  nix.registry.nixpkgs = pkgs.lib.mkForce {
    to = {
      type = "path";
      path = "${inputs.nixpkgs}";
    };
  };

  environment.variables.KIOSK_FLAKE = "${self}";

  networking.networkmanager.enable = true;

  users.users.root.openssh.authorizedKeys.keys = [ adminKey ];

  services.openssh.enable = true;

  systemd.services.NetworkManager-wait-online.enable = false;

  systemd.services.zero-touch-install = {
    description = "Zero-Touch Kiosk Installation";

    wantedBy = [ "multi-user.target" ];

    # Make sure we own tty1 exclusively - getty@tty1 will otherwise
    # try to spawn a login prompt on the same console.
    conflicts = [ "getty@tty1.service" ];
    after = [ "systemd-udev-settle.service" "getty@tty1.service" ];

    path = with pkgs; [
      nix
      git
      util-linux
      nixos-install-tools
      curl
      networkmanager
      mount
      umount
      disko
    ];

    environment = {
      NIX_PATH = "nixpkgs=${inputs.nixpkgs}";
      KIOSK_FLAKE = "${self}";
      DISKO_SCRIPT = "${diskoScript}";
    };

    serviceConfig = {
      StandardInput = "tty";
      StandardOutput = "tty";
      StandardError = "tty";
      TTYPath = "/dev/tty1";
      TTYReset = true;
      TTYVHangup = true;
      TTYVTDisallocate = true;
    };

    script = ''
      set -euo pipefail

      echo "Running disko script..."
      echo "Script: $DISKO_SCRIPT"

      ${diskoScript}

      echo "Installing RadiantWave (${targetConfig})"
      echo "Closure Path: ${targetSystem}"

      nixos-install \
        --system "${targetSystem}" \
        --no-root-passwd \
        --no-channel-copy

      echo "============================================"
      echo " Installation complete!"
      echo " Please shut down and remove the flash drive before restarting"
      echo "============================================"
      sleep infinity
    '';
  };
}