{ config, lib, pkgs, ... }:

{
  system.stateVersion = "26.05";

  # Bootloader. The disko layout (hardware-configurations/disk-config.nix) lays
  # down both a BIOS-boot (EF02) partition and an ESP mounted at /boot, so grub
  # works whether the VM firmware is legacy BIOS or UEFI. disko fills in
  # boot.loader.grub.devices from the EF02 partition; we just enable grub here.
  boot.loader.grub = {
    enable = true;
    efiSupport = true;
    efiInstallAsRemovable = true;
  };

  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    trusted-users = [ "@wheel" "deploy" ];
  };

  # deploy-rs SSHes in as `deploy` and uses sudo to activate.
  users.users.deploy = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJuB+MbW/YuXYGZ/lm6dp+aHJ1YqfaEkiqgj/Z6+cdd0 me@larsnolden.com" # developer machines key
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB9LFaFbro5jU9jG0ZNn66FO61gniKfi865jS6TnZ+SU deploy" # deployment nodes key
    ];
  };
  security.sudo.wheelNeedsPassword = false;

  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = false;
  };
  # TODO: restrict inbound SSH (port 22) to the Gitea deployment runner's IP
  # only, instead of leaving it open to the world. Likely via
  # services.openssh.openFirewall = false + a firewall.extraInputRules rule
  # accepting tcp dport 22 from the runner's source address.

  networking.firewall.enable = true;

  time.timeZone = "UTC";

  environment.systemPackages = with pkgs; [ vim curl jq ];
}