{ pkgs, radiantwave, upgradeFlakeRef, ... }:   

let
  radiantApp = radiantwave.packages.${pkgs.system}.default;
  myKey = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad" ];
in
{
  # Included packages
  environment.systemPackages = [ 
    pkgs.cage pkgs.rsync pkgs.dbus pkgs.mesa pkgs.git pkgs.tailscale pkgs.sqlite
    radiantApp 
  ];

  # This populates the EFI partition and tells the NUC how to start NixOS.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # Hardware-specific: NUC 14 needs these for the NVMe and Graphics
  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "i915" "drm" "drm_kms_helper" ]; 
  boot.kernelParams = [ "quiet" "splash" ];

  # --- Essential Services ---
  services.pipewire = { enable = true; alsa.enable = true; pulse.enable = true; };
  services.seatd.enable = true;
  services.openssh.enable = true;
  services.openssh.settings.PermitRootLogin = "prohibit-password";
  hardware.graphics.enable = true;
  system.autoUpgrade = {
    enable = true;
    flake = upgradeFlakeRef;
    dates = "*:00/10";
    flags = [ "--refresh" "-L" ];
    operation = "switch";
  };
  time.timeZone = "America/Chicago";

  # Networking Network-Manager
  services.resolved.enable = false;
  networking.networkmanager.enable = true;
  systemd.services.NetworkManager-wait-online.enable = false;
  systemd.network.wait-online.enable = false;

  # --- Users & SSH Keys ---
  users.users.root.openssh.authorizedKeys.keys = myKey;
  users.users.kiosk = {
    isNormalUser = true;
    uid = 1000;
    extraGroups = ["audio" "video" "input" "networkmanager" "wheel"];
    openssh.authorizedKeys.keys = myKey;
    password = "Fuckp@ssw0rds";
  };
  services.getty.autologinUser = "kiosk";

  # --- Set ownership of Radiantwave files --- 
  systemd.tmpfiles.rules = [
    "d /home/kiosk/.local/share/radiantwave 0770 kiosk kiosk -"
  ];

  system.activationScripts.cleanRadiantFiles = ''
    rm -rf /home/kiosk/.local/share/radiantwave/audio
  '';

  # --- Backup service: runs before nixos-upgrade ---
  systemd.services.radiantwave-backup = {
    description = "Backup RadiantWave user data before upgrade";
    before = [ "nixos-upgrade.service" ];
    wantedBy = [ "nixos-upgrade.service" ];
    serviceConfig = {
      Type = "oneshot";
      User = "kiosk";
    };
    script = ''
      BACKUP_DIR="/home/kiosk/.local/share/radiantwave-backup"
      SOURCE_DIR="/home/kiosk/.local/share/radiantwave"

      mkdir -p "$BACKUP_DIR"

      ${pkgs.rsync}/bin/rsync -a \
        --exclude='audio/' \
        "$SOURCE_DIR/" "$BACKUP_DIR/"

      echo "Backup completed at $(date)" > "$BACKUP_DIR/.backup-timestamp"
    '';
  };

  # --- Health check service: runs after nixos-upgrade ---
  systemd.services.radiantwave-healthcheck = {
    description = "Verify RadiantWave is running after upgrade, rollback if not";
    after = [ "nixos-upgrade.service" ];
    wantedBy = [ "nixos-upgrade.service" ];
    serviceConfig = {
      Type = "oneshot";
      # Give cage time to start radiantwave after the switch
      ExecStartPre = "${pkgs.coreutils}/bin/sleep 90";
    };
    script = ''
      if ${pkgs.procps}/bin/pgrep -x radiantwave > /dev/null; then
        echo "RadiantWave is running, upgrade successful"
        exit 0
      fi

      echo "RadiantWave not found after upgrade, rolling back..."

      # Roll back to previous NixOS generation
      /run/current-system/sw/bin/nixos-rebuild switch --rollback

      echo "Rollback completed at $(date)"
    '';
  };

  # --- 3. The Kiosk Startup Script ---
  environment.loginShellInit = ''
   if [ "$(tty)" = "/dev/tty1" ]; then
      export GODEBUG=netdns=cgo
      export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

      # Smart Network Wait
      for i in {1..10}; do
        if ${pkgs.iputils}/bin/ping -c 1 8.8.8.8 &> /dev/null; then
          break
        fi
        sleep 1
      done

      # Graphics fixes
      export SDL_VIDEODRIVER=wayland
      export QT_QPA_PLATFORM=wayland
      export XDG_SESSION_TYPE=wayland
      export WLR_RENDERER=pixman
      export WLR_NO_HARDWARE_CURSORS=1

      # Asset sync + start app
      mkdir -p /home/kiosk/.local/share/radiantwave
      ${pkgs.rsync}/bin/rsync -ru ${radiantApp}/share/radiantwave/ /home/kiosk/.local/share/radiantwave/

      exec dbus-run-session cage -- ${radiantApp}/bin/radiantwave -d -s > /tmp/kiosk.log 2>&1
    fi
  '';

  # # Tailscale Configuration 
  # systemd.tmpfiles.rules = [
  #   "d /etc/tailscale 0700 root root -"
  #   "f /etc/tailscale/preauth-key 0600 root root - ${preAuthKey}"
  # ];

  # services.tailscale = {
  #   enable = true;
  #   authKeyFile = "/etc/tailscale/preauth-key";
  #   openFirewall = true;
  #   authKeyParameters.preauthorized = true;
  #   extraUpFlags = [
  #     "--login-server" headscaleUrl
  #   ];
  # };

  # systemd.services.tailscale-set-hostname = {
  #   description = "Set Tailscale hostname based on the RadiantWave license key";
  #   after = [ "tailscale-autoconnect.service" ];
  #   wants = [ "tailscaled.service" ];
  #   wantedBy = [ "multi-user.target" ];
  #   serviceConfig = {
  #     Type = "oneshot";
  #     RemainAfterExit = true;
  #   };
  #   script = ''
  #      if [ -f "${licenseKeyFile}" ]; then
  #       KEY=$(cat "${licenseKeyFile}" | tr -d '[:space:]')
  #       if [ -n "$KEY" ]; then
  #         echo "Setting Tailscale hostname to: $KEY"
  #         ${pkgs.lib.getExe pkgs.tailscale} set --hostname="$KEY"
  #         exit 0
  #       fi
  #     fi
  #     echo "No license key found, skipping hostname override"
  #   '';
  # };

  # Virtual machine declaration
  virtualisation.vmVariant = {
    boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;
    boot.loader.efi.canTouchEfiVariables = pkgs.lib.mkForce false;
    virtualisation.forwardPorts = [
      { from = "host"; host.port = 2222; guest.port = 22; }
    ];
    virtualisation.qemu.options = [
      "-device intel-hda" 
      "-device hda-duplex"
      "-vga virtio"
    ];
    virtualisation = {
      cores = 8;
      memorySize = 8192;
    };
    services.logrotate.enable = false;
  };
  virtualisation.diskSize = 10485760;

  # NixOS settings.
  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nix.settings.accept-flake-config = true;
  system.stateVersion = "24.05";
}