{ pkgs, radiantwave, upgradeFlakeRef, ... }:

let
  radiantApp = radiantwave.packages.${pkgs.system}.default;
  myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4qWNZnYU5JaqR9c2qh6oFZktzVNBOx42PfDaGofCL6 cnclack@pm.me macbook" ];
in
{
  ############################################################
  # System configuration
  ############################################################

  # Included packages
  environment.systemPackages = [
    pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite
    radiantApp
  ];

  # This populates the EFI partition and tells the NUC how to start NixOS.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # Hardware-specific: NUC 14 needs these for the NVMe and Graphics
  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ];
  boot.kernelParams = [ "quiet" "splash" ];

  hardware.graphics.enable = true;

  time.timeZone = "America/Chicago";

  networking.networkmanager.enable = true;

  system.autoUpgrade = {
    enable = true;
    flake = upgradeFlakeRef;
    dates = "*:00/10";
    flags = [ "--refresh" "-L" ];
    operation = "switch";
  };

  system.activationScripts.cleanRadiantFiles = ''
    rm -rf /home/kiosk/.local/share/radiantwave/audio
  '';

  # Virtual machine declaration
  virtualisation.vmVariant = {
    boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
    boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
    virtualisation.forwardPorts = [
      { from = "host"; host.port = 2222; guest.port = 22; }
    ];
    virtualisation.qemu.options = [
      "-device intel-hda"
      "-device hda-duplex"
      "-vga virtio"
    ];
    virtualisation = {
      cores = 8;
      memorySize = 8192;
    };
    services.logrotate.enable = false;
  };
  virtualisation.diskSize = 10485760;

  # NixOS settings.
  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nix.settings.accept-flake-config = true;
  system.stateVersion = "24.05";

  ############################################################
  # User configuration
  ############################################################

  users.users.root.openssh.authorizedKeys.keys = myKey;
  users.users.kiosk = {
    isNormalUser = true;
    uid = 1000;
    extraGroups = ["audio" "video" "input" "networkmanager" "wheel"];
    openssh.authorizedKeys.keys = myKey;
    password = "Fuckp@ssw0rds";
  };

  services.getty.autologinUser = "kiosk";

  # --- The Kiosk Startup Script ---
  environment.loginShellInit = ''
   if [ "$(tty)" = "/dev/tty1" ]; then
      export GODEBUG=netdns=cgo
      export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

      # Smart Network Wait
      for i in {1..10}; do
        if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
          break
        fi
        sleep 1
      done

      # Graphics fixes
      export SDL_VIDEODRIVER=wayland
      export QT_QPA_PLATFORM=wayland
      export XDG_SESSION_TYPE=wayland
      export WLR_RENDERER=pixman
      export WLR_NO_HARDWARE_CURSORS=1

      # Asset sync + start app
      mkdir -p /home/kiosk/.local/share/radiantwave
      ${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/

      exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
    fi
  '';

  ############################################################
  # Service configuration
  ############################################################

  services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
  services.seatd.enable = true;
  services.openssh.enable = true;
  services.openssh.settings.PermitRootLogin = "prohibit-password";

  # Networking Network-Manager
  services.resolved.enable = false;
  systemd.services.NetworkManager-wait-online.enable = false;
  systemd.network.wait-online.enable = false;

  # --- Set ownership of Radiantwave files ---
  systemd.tmpfiles.rules = [
    "d /home/kiosk/.local/share/radiantwave 0770 kiosk kiosk -"
  ];

  # --- Backup service: runs before nixos-upgrade ---
  systemd.services.radiantwave-backup = {
    description = "Backup RadiantWave user data before upgrade";
    before = [ "nixos-upgrade.service" ];
    wantedBy = [ "nixos-upgrade.service" ];
    serviceConfig = {
      Type = "oneshot";
      User = "kiosk";
    };
    script = ''
      BACKUP_DIR="/home/kiosk/.local/share/radiantwave-backup"
      SOURCE_DIR="/home/kiosk/.local/share/radiantwave"

      mkdir -p "$BACKUP_DIR"

      ${pkgs.rsync}/bin/rsync -a \
        --exclude='audio/' \
        "$SOURCE_DIR/" "$BACKUP_DIR/"

      echo "Backup completed at $(date)" > "$BACKUP_DIR/.backup-timestamp"
    '';
  };

  # --- Health check service: runs after nixos-upgrade ---
  systemd.services.radiantwave-healthcheck = {
    description = "Verify RadiantWave is running after upgrade, rollback if not";
    after = [ "nixos-upgrade.service" ];
    wantedBy = [ "nixos-upgrade.service" ];
    serviceConfig = {
      Type = "oneshot";
      # Give cage time to start radiantwave after the switch
      ExecStartPre = "${pkgs.coreutils}/bin/sleep 90";
    };
    script = ''
      if ${pkgs.procps}/bin/pgrep -x radiantwave > /dev/null; then
        echo "RadiantWave is running, upgrade successful"
        exit 0
      fi

      echo "RadiantWave not found after upgrade, rolling back..."

      # Roll back to previous NixOS generation
      /run/current-system/sw/bin/nixos-rebuild switch --rollback

      echo "Rollback completed at $(date)"
    '';
  };
}