flake.nix

{
  description = "NixFleet - Agentless fleet management with Nix";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    flake-utils.url = "github:numtide/flake-utils";
    nix-darwin = {
      url = "github:LnL7/nix-darwin";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix2container = {
      url = "github:nlewo/nix2container";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs =
    {
      self,
      nixpkgs,
      flake-utils,
      nix-darwin,
      nix2container,
    }:
    let
      # Supported systems for the CLI/tooling
      supportedSystems = [
        "x86_64-linux"
        "aarch64-linux"
        "x86_64-darwin"
        "aarch64-darwin"
      ];

      # Helper to generate outputs for each system
      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;

      # Nixpkgs instantiated for each system
      nixpkgsFor = forAllSystems (
        system:
        import nixpkgs {
          inherit system;
          overlays = [ self.overlays.default ];
        }
      );

      # Create a NixFleet host configuration (for Ubuntu hosts)
      mkNixFleetConfiguration =
        {
          system ? "x86_64-linux",
          modules ? [ ],
          specialArgs ? { },
        }:
        let
          pkgs = nixpkgsFor.${system};
          lib = nixpkgs.lib;

          # Evaluate the modules
          evaluated = lib.evalModules {
            modules = [
              # Core NixFleet module
              ./modules/nixfleet

              # Manage /etc/nix/nix.custom.conf (trusted-users) on all Ubuntu
              # hosts — deploy must be a trusted-user for apply to copy closures.
              ./modules/nix-config.nix

              # Provide pkgs
              { _module.args = { inherit pkgs; }; }
            ]
            ++ modules;
            specialArgs = {
              inherit lib;
            }
            // specialArgs;
          };
        in
        {
          inherit (evaluated) config options;

          # The main system derivation for deployment
          system = evaluated.config.nixfleet.ubuntu.system;

          # Convenience accessors
          manifestHash = evaluated.config.nixfleet.ubuntu.manifestHash;
          hostName = evaluated.config.nixfleet.host.name;
          base = evaluated.config.nixfleet.host.base;

          # Declarative Synology DSM state (Model B) — reconciled by the CLI over
          # the DSM API. Lazy: only forced by `nix eval … .synology`, so ubuntu
          # hosts never build it.
          synology = evaluated.config.nixfleet.synology;
        };

      # Create a NixOS configuration with NixFleet modules
      mkNixOSFleetConfiguration =
        {
          system ? "x86_64-linux",
          modules ? [ ],
          specialArgs ? { },
        }:
        nixpkgs.lib.nixosSystem {
          inherit system specialArgs;
          modules = [
            # NixFleet options module (for nixfleet.* interface)
            ./modules/nixfleet/options.nix

            # NixOS backend compiler (translates nixfleet.* to NixOS options)
            ./backends/nixos/compile.nix
          ]
          ++ modules;
        };

      # Create a nix-darwin configuration with NixFleet modules
      mkDarwinFleetConfiguration =
        {
          system ? "aarch64-darwin",
          modules ? [ ],
          specialArgs ? { },
        }:
        nix-darwin.lib.darwinSystem {
          inherit system specialArgs;
          modules = [
            # NixFleet options module (for nixfleet.* interface)
            ./modules/nixfleet/options.nix

            # nix-darwin backend compiler (translates nixfleet.* to darwin options)
            ./backends/darwin/compile.nix
          ]
          ++ modules;
        };

    in
    {
      # Overlay for NixFleet packages
      overlays.default = final: prev: {
        nixfleet = final.callPackage ./pkgs/nixfleet {
          gitCommit = self.rev or self.dirtyRev or "";
          gitTag = if self ? rev then "v0.1.0" else "dev";
        };
        spire-agent = final.callPackage ./pkgs/spire-agent { };
      };

      # CLI package for each system + netboot images for x86_64-linux
      packages = forAllSystems (
        system:
        let
          pkgs = nixpkgsFor.${system};

          # Helper to build a netboot image package from NixOS modules
          mkNetboot =
            name: modules:
            let
              sys = nixpkgs.lib.nixosSystem {
                system = "x86_64-linux";
                inherit modules;
              };
            in
            pkgs.runCommand "netboot-${name}" { } ''
              mkdir -p $out
              ln -s ${sys.config.system.build.kernel}/bzImage $out/bzImage
              ln -s ${sys.config.system.build.netbootRamdisk}/initrd $out/initrd
              ln -s ${sys.config.system.build.squashfsStore} $out/nix-store.squashfs
              echo "init=${sys.config.system.build.toplevel}/init loglevel=4" > $out/cmdline
            '';
        in
        {
          default = pkgs.nixfleet;
          nixfleet = pkgs.nixfleet;
          spire-agent = pkgs.spire-agent;
        }
        // (
          if system == "x86_64-linux" then
            let
              n2c = nix2container.packages.${system}.nix2container;
            in
            {
              netboot-gtr = mkNetboot "gtr" [ ./netboot/gtr.nix ];
              netboot-gtr-diskless = mkNetboot "gtr-diskless" [ ./netboot/gtr-diskless.nix ];

              # Agent OCI images (Linux only — container targets)
              agent-pm = import ./agents/pm { inherit n2c pkgs; };
              agent-personal = import ./agents/personal { inherit n2c pkgs; };
              agent-coder = import ./agents/coder { inherit n2c pkgs; };
              agent-sre = import ./agents/sre { inherit n2c pkgs; };
              agent-sage = import ./agents/sage { inherit n2c pkgs; };
              agent-orchestrator = import ./agents/orchestrator { inherit n2c pkgs; };

              # Ubuntu installer artifacts (autoinstall configs + scripts)
              installer = pkgs.runCommand "nixfleet-installer" { } ''
                mkdir -p $out/common
                ${nixpkgs.lib.concatStringsSep "\n" (
                  nixpkgs.lib.mapAttrsToList (name: cfg: ''
                    mkdir -p $out/${name}
                    cp ${cfg}/user-data $out/${name}/
                    cp ${cfg}/meta-data $out/${name}/
                  '') self.installerConfigs
                )}
                cp ${./installer/zfs-partition.sh} $out/common/zfs-partition.sh
                cp ${./installer/nixfleet-late-commands.sh} $out/common/nixfleet-late-commands.sh
              '';
            }
          else
            { }
        )
      );

      # Development shell
      devShells = forAllSystems (
        system:
        let
          pkgs = nixpkgsFor.${system};
        in
        {
          default = pkgs.mkShell {
            name = "nixfleet-dev";
            packages = with pkgs; [
              # Go toolchain (for CLI)
              go
              gopls
              golangci-lint
              delve

              # Nix tooling
              nix-prefetch-git
              nix-tree
              nixpkgs-fmt

              # SPIRE agent (for local identity)
              pkgs.spire-agent

              # SSH/deployment testing
              openssh

              # General utilities
              jq
              yq-go
              age
              ssh-to-age
              sops
            ];

            shellHook = ''
              echo "NixFleet development shell"
              echo "Go version: $(go version)"
              echo ""
              echo "Netboot images (x86_64-linux only):"
              echo "  nix build .#netboot-gtr           # GTR install/recovery image"
              echo "  nix build .#netboot-gtr-diskless  # GTR diskless (NFS persistent)"
            '';
          };
        }
      );

      # NixFleet library functions for host definitions
      lib = (import ./lib { inherit (nixpkgs) lib; }) // {
        inherit mkNixFleetConfiguration mkNixOSFleetConfiguration mkDarwinFleetConfiguration;
      };

      # NixFleet host configurations (Ubuntu hosts managed by NixFleet CLI)
      nixfleetConfigurations = {
        gti = mkNixFleetConfiguration {
          modules = [ ./hosts/gti.nix ];
        };
        gtr = mkNixFleetConfiguration {
          modules = [ ./hosts/gtr.nix ];
        };
        gtr-150 = mkNixFleetConfiguration {
          modules = [ ./hosts/gtr-150.nix ];
        };
        gtr-151 = mkNixFleetConfiguration {
          modules = [ ./hosts/gtr-151.nix ];
        };
        gtr-152 = mkNixFleetConfiguration {
          modules = [ ./hosts/gtr-152.nix ];
        };
        gtr-153 = mkNixFleetConfiguration {
          modules = [ ./hosts/gtr-153.nix ];
        };
        # Synology NAS — managed via the DSM API (Model B), not SSH.
        znas = mkNixFleetConfiguration {
          modules = [ ./hosts/znas.nix ];
        };
      };

      # Per-host autoinstall configs for Ubuntu installer
      installerConfigs =
        let
          pkgs = nixpkgsFor.x86_64-linux;
        in
        {
          gtr = import ./installer/autoinstall.nix {
            inherit (nixpkgs) lib;
            inherit pkgs;
            hostConfig = self.nixfleetConfigurations.gtr.config;
            sshPubKey = ./secrets/deploy.pub;
          };
        };
    };
}