{ config, lib, pkgs, ... }:

let
  cfg = config.workstation;
  sources = import ../../npins;
  nixGit = import (pkgs.fetchFromGitHub {
    owner = "NixOS";
    repo = "nix";
    rev = "7a8a28629c61c75af010ff0a5a88c16c4ce536c7";
    sha256 = "sha256-oqG9AFPXBneKVmiWa9b9ai0hGZqHVKVFaFLdBZitSUA=";
  });
in
{
  options.workstation = {
    username = lib.mkOption {
      type = lib.types.str;
    };
  };

  imports = [
    ../common
    <top/shared/basics-physical.nix>
    ./graphical.nix
    ./dev.nix
    ./create.nix
    ./android.nix
  ];

  config = {
    users.users.${cfg.username} = {
      isNormalUser = true;
      extraGroups = [
        "wheel"
        "networkmanager"
        "dialout"
      ];
    };

    services.getty = {
      autologinUser = cfg.username;
      autologinOnce = true; # only in the first tty once per boot
    };

    environment.systemPackages = with pkgs; [
      npins
      (callPackage "${sources.agenix}/pkgs/agenix.nix" {})

      unzip

      # Android
      android-tools
      go-mtpfs
    ];

    environment.sessionVariables = {
      # Tell .zshrc to source zshrc-workstation.sh.
      MYNIX_PROFILE = "workstation";
    };

    # Age defaults to this anyway when openssh is enabled.
    # We're setting this here for workstations where openssh is disabled.
    age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];

    # Using nix from git for --raw support in nix-instantiate --eval.
    # FUTURE: remove once upgrading to NixOS 25.05
    nix.package = nixGit.packages.${builtins.currentSystem}.default;
  };
}