(define-module (oms systems)
  #:use-module (gnu)
  #:use-module (gnu packages cups)
  #:use-module (gnu packages package-management)
  #:use-module (gnu services admin)
  #:use-module (gnu services base)
  #:use-module (gnu services cups)
  #:use-module (gnu services desktop)
  #:use-module (gnu services dns)
  #:use-module (gnu services guix)
  #:use-module (gnu services networking)
  #:use-module (gnu services shepherd)
  #:use-module (gnu services ssh)
  #:use-module (gnu services sysctl)
  #:use-module (gnu services vpn)
  #:use-module (gnu services xorg)
  #:use-module (gnu system pam)
  #:use-module (guix gexp)
  #:use-module (guix modules)
  #:use-module (nongnu packages linux)
  #:use-module (nongnu system linux-initrd)
  #:use-module (oms channel-file)
  #:use-module (oms home)
  #:use-module (sops secrets)
  #:use-module (sops services sops)
  #:export (base-operating-system))

(define default-gsettings
  #~(string-append "\
[org/gnome/desktop/background]
picture-options='zoom'
picture-uri='file://"
#$(file-append guix-backgrounds
               "/share/backgrounds/guix/guix-encircled-checkered-16-9.svg") "'
picture-uri-dark='file://"
#$(file-append guix-backgrounds
               "/share/backgrounds/guix/guix-encircled-checkered-16-9.svg") "'
[org/gnome/desktop/interface]
accent-color='yellow'

[org/gnome/desktop/input-sources]
sources=[('xkb', 'fi')]"))

(define* (base-operating-system host-name)
  (operating-system
    (kernel linux)
    (kernel-arguments
     (append '("resume=oms-guix-swap") %default-kernel-arguments))
    (initrd microcode-initrd)
    (firmware (list linux-firmware))
    (locale "fi_FI.utf8")
    (timezone "Europe/Helsinki")
    (keyboard-layout (keyboard-layout "fi"))
    (host-name host-name)
    (users (cons* (user-account
                    (name "oms")
                    (comment "Olarinmäen samoojat")
                    (group "users")
                    (home-directory "/home/oms")
                    (supplementary-groups '("wheel" "netdev" "audio" "video" "passwordlesslogin")))
                  %base-user-accounts))
    (groups (cons (user-group (name "passwordlesslogin")) %base-groups))
    (services
     (append
      (list (service bluetooth-service-type)
            (simple-service
             'default-desktop-settings dconf-service-type
             (list (dconf-profile
                     (name "user")
                     (keyfile
                      (dconf-keyfile
                        (name "defaults")
                        (content (list default-gsettings)))))))
            (service gnome-desktop-service-type)
            (service openssh-service-type
                     (openssh-configuration
                       (permit-root-login 'prohibit-password)
                       (authorized-keys
                         `(("root" ,(channel-file "keys/ssh/saku-laesvuori-x-kone.pub"))))))
            (service guix-home-service-type `(("oms" ,oms-home-environment)))
            (service guix-publish-service-type
                     (guix-publish-configuration
                       (port 8001)
                       (host "0.0.0.0")
                       (advertise? #t)))
            (service cups-service-type
                     (cups-configuration
                       (web-interface? #t)
                       (extensions (list cups-filters epson-inkjet-printer-escpr))))
            (simple-service 'passwordless-gdm-login pam-root-service-type
                            (list
                             (pam-extension
                               (transformer
                                (lambda (service)
                                  (if (equal? (pam-service-name service)
                                               "gdm-password")
                                    (pam-service
                                      (inherit service)
                                      (auth
                                       (cons (pam-entry
                                               (control "sufficient")
                                               (module "pam_succeed_if.so")
                                               (arguments
                                                '("user" "ingroup"
                                                  "passwordlesslogin")))
                                             (pam-service-auth service))))
                                    service))))))
            (set-xorg-configuration (xorg-configuration (keyboard-layout keyboard-layout))))
      (modify-services %desktop-services
        (guix-service-type config =>
          (guix-configuration
            (inherit config)
            (discover? #t)
            (extra-options '("--max-jobs=1" "--cores=1"))
            (substitute-urls
              (append %default-substitute-urls ; more often used servers first
                      (list "https://substitutes.nonguix.org")))
            (authorized-keys
              (append (list (channel-file "keys/guix/nonguix.pub")
                            (channel-file "keys/guix/saku-laesvuori-x-kone.pub"))
                      %default-authorized-guix-keys)))))))
    (bootloader (bootloader-configuration
                  (bootloader grub-efi-bootloader)
                  (targets (list "/boot/efi"))
                  (keyboard-layout keyboard-layout)))
    (swap-devices
     (list (swap-space
             (target (file-system-label "oms-guix-swap"))
             (discard? #t))))
    (file-systems
     (append (list (file-system
                     (mount-point "/")
                     (device (file-system-label "oms-btrfs-root"))
                     (flags '(no-atime))
                     (options "compress-force=zstd")
                     (type "btrfs"))
                   (file-system
                     (mount-point "/boot/efi")
                     (device (file-system-label "OMS-F32-EFI"))
                     (type "vfat"))
                   (file-system
                     (mount-point "/tmp")
                     (device "tmpfs")
                     (type "tmpfs")
                     (check? #f)
                     (flags '(no-dev no-suid))
                     (options "size=70%")
                     (create-mount-point? #t)))
             %base-file-systems))))

(define upgrade-if-needed-script
  (program-file
   "upgrade-if-needed"
   (with-imported-modules (source-module-closure
                           '((gnu services herd)
                             (guix config)
                             (guix profiles)))
     #~(begin
         (use-modules (gnu services herd)
                      (guix config)
                      (guix profiles)
                      (ice-9 exceptions)
                      (srfi srfi-1)
                      (srfi srfi-19)
                      (srfi srfi-26))

         ;; From guix/scripts/system.scm
         (define %system-profile
           (string-append %state-directory "/profiles/system"))

         (define (latest-of lst)
           (reduce (lambda (next largest)
                     (if (time>? next largest) next largest))
                   #f lst))

         (define latest-generation
           (latest-of (map (cut generation-time %system-profile <>)
                           (profile-generations %system-profile))))

         (define one-week (make-time time-duration 0 (* 7 24 60 60)))

         (define no-generations-exception
           (make-exception
            (make-exception-with-message
             (format #f "No system generations found at '~a'! Not upgrading.~%"
                     %system-profile))
            (make-external-error)))

         (if (time>? (current-time time-utc)
                       (add-duration
                        (or latest-generation
                            (raise-exception no-generations-exception))
                        one-week))
           (with-shepherd-action 'unattended-upgrade ('trigger)
                                 result result)
           (format #t "Latest generation is from ~a. No need to upgrade.~%"
                   (date->string (time-utc->date latest-generation))))))))

(define-syntax-rule (define-system id os)
  "Extend the operating system OS with unattended upgrades and define a varible
ID with the extended system as it's value."
  (define-public id
    (let ((base os))
      (operating-system
        (inherit base)
        (services
         (append
          (list (service unattended-upgrade-service-type
                         (unattended-upgrade-configuration
                           (channels
                            #~(cons (channel
                                      (name 'oms-tietokoneet)
                                      (url "https://git.olarinmaensamoojat.fi/OMS/tietokoneet.git")
                                      (branch "main")
                                      (introduction
                                       (make-channel-introduction
                                        "a3665902d411cd473636a836c2efd707b3a25cfd"
                                        (openpgp-fingerprint
                                         "A0C9 1947 734F 076F 5F08 E9FF 257D 284A 2A1D 3A32"))))
                                    %default-channels))
                           (operating-system-expression
                            #~(@ (oms systems) id))))
                (simple-service
                 'check-upgrade-on-boot
                 shepherd-root-service-type
                 (list (shepherd-service
                         (provision '(upgrade-if-needed))
                         (requirement '(unattended-upgrade))
                         (one-shot? #t)
                         (start #~(make-forkexec-constructor
                                   (list #$upgrade-if-needed-script)))))))
          (operating-system-user-services base)))))))

(define-system oms-morn (base-operating-system "OMS-morn"))

(define-system oms-celeb
  (let ((base (base-operating-system "OMS-celeb")))
    (operating-system
      (inherit base)
      (firmware (cons sof-firmware (operating-system-firmware base)))
      (initrd-modules
       (append '("vmd") (operating-system-initrd-modules base)))
      (services
       (modify-services (operating-system-user-services base)
         (elogind-service-type config =>
           (elogind-configuration
             (inherit config)
             ;; This machine gets stuck with proper deep sleep (suspend to RAM)
             (suspend-mode '(s2idle)))))))))

(define-system oms-kone
  (let ((base (base-operating-system "OMS-kone"))
        (wpa-psk (sops-secret
                   (key '("wpa-psk"))
                   (file (channel-file "sops/OMS-kone.yaml"))))
        (wg-key (sops-secret
                  (key '("wg-private-key"))
                  (file (channel-file "sops/OMS-kone.yaml")))))
    (operating-system
      (inherit base)
      (kernel-arguments %default-kernel-arguments)
      (firmware (list ibt-hw-firmware iwlwifi-firmware))
      (swap-devices '())
      (services
       (append
        (list (service dhcpcd-service-type
                       (dhcpcd-configuration
                         (interfaces '("enp1s0"))))
              (service dhcpd-service-type
                       (dhcpd-configuration
                         (interfaces '("wlp2s0"))
                         (config-file (channel-file "OMS-kone/dhcpd.conf"))))
              (service dnsmasq-service-type
                       (dnsmasq-configuration
                         (listen-addresses '("192.168.1.1"))))
              (service hostapd-service-type
                       (hostapd-configuration
                         (interface "wlp2s0")
                         (ssid "Samoojaverkko") ; muokatessa päivitä wpa_psk
                         (channel 1)
                         (extra-settings
                          (string-append "wpa=2\n" "wpa_psk_file="
                                         (sops-secret->secret-file wpa-psk)))))
              (service nftables-service-type
                       (nftables-configuration
                         (ruleset (channel-file "OMS-kone/nftables.rules"))))
              (service sops-secrets-service-type
                       (sops-service-configuration
                         (secrets (list wpa-psk wg-key))))
              (service static-networking-service-type
                       (list (static-networking
                               (provision '(wifi-ip))
                               (addresses (list (network-address
                                                  (device "wlp2s0")
                                                  (value "192.168.1.1/24")))))))
              (service wireguard-service-type
                       (wireguard-configuration
                         (peers
                           (list
                             (wireguard-peer
                               (name "olarinmaensamoojat.fi")
                               (endpoint "olarinmaensamoojat.fi:51820")
                               (public-key "UT4RGKMzp61DYiiodsrvHc6m/tkSqLNo2wqxwACrdl4=")
                               (allowed-ips '("192.168.3.3/32"))
                               (keep-alive 25))))
                         (addresses '("192.168.3.2/24"))
                         (private-key (sops-secret->secret-file wg-key))
                         (shepherd-requirement '(networking)))))
        (modify-services (operating-system-user-services base)
          (elogind-service-type config =>
            (elogind-configuration
              (inherit config)
              (handle-power-key 'ignore)))
          (sysctl-service-type config =>
            (sysctl-configuration
              (inherit config)
              (settings (cons '("net.ipv4.ip_forward" . "1")
                              %default-sysctl-settings))))
          (gdm-service-type config =>
            (gdm-configuration
              (inherit config)
              (auto-suspend? #f)))
          (delete network-manager-service-type)
          (delete wpa-supplicant-service-type)))))))