{ config, lib, pkgs, ... }:

let
  cfg = config.homelab.gitops;

  updateScript = pkgs.writeShellApplication {
    name = "homelab-gitops-update";
    runtimeInputs = [ pkgs.git pkgs.nixos-rebuild pkgs.jq pkgs.coreutils ];
    text = builtins.readFile ../../../scripts/nixos-sync.sh;
  };

in {
  options.homelab.gitops = {
    enable = lib.mkEnableOption "Custom GitOps native deployment system";
    
    repoUrl = lib.mkOption {
      type = lib.types.str;
      default = "https://git.depeuter.dev/Bos55/nix-config.git";
      description = "The repository URL to pull configurations from.";
    };
    
    branch = lib.mkOption {
      type = lib.types.str;
      default = "v2";
      description = "The branch to deploy.";
    };

    useBuilder = lib.mkOption {
      type = lib.types.bool;
      default = true;
      description = "Whether to use the central Builder host to compile packages.";
    };
  };

  config = lib.mkIf cfg.enable {
    systemd.services.homelab-gitops = {
      description = "Homelab GitOps Update Service";
      wants = [ "network-online.target" ];
      after = [ "network-online.target" ];
      serviceConfig = {
        Type = "oneshot";
        ExecStart = "${updateScript}/bin/homelab-gitops-update ${cfg.repoUrl} ${cfg.branch}";
        # Must run as root to rebuild the system
        User = "root";
      };
    };

    systemd.timers.homelab-gitops = {
      description = "Timer for Homelab GitOps Update Service";
      wantedBy = [ "timers.target" ];
      timerConfig = {
        OnBootSec = "5m";
        OnUnitActiveSec = "5m";
        RandomizedDelaySec = "30s";
      };
    };

    sops.secrets."webhook-secret" = {};

    services.webhook = {
      enable = true;
      port = 9000;
      hooks = {
        gitops = {
          execute-command = "${pkgs.systemd}/bin/systemctl";
          pass-arguments-to-command = [
            { source = "string"; name = "start"; }
            { source = "string"; name = "homelab-gitops.service"; }
          ];
          trigger-rule = {
            match = {
              type = "payload-hash-sha256";
              secret = "{{ getenv \"WEBHOOK_SECRET\" }}";
              parameter = {
                source = "header";
                name = "X-Forgejo-Signature";
              };
            };
          };
        };
      };
    };

    # Inject the secret as an environment variable into the webhook service
    systemd.services.webhook.serviceConfig.EnvironmentFile = config.sops.secrets."webhook-secret".path;

    sops.secrets."builder-ssh-key" = lib.mkIf cfg.useBuilder {};

    nix.buildMachines = lib.mkIf cfg.useBuilder [
      {
        hostName = "builder.depeuter.dev"; # Must be routable from nodes
        system = "x86_64-linux";
        sshUser = "builder";
        sshKey = config.sops.secrets."builder-ssh-key".path;
        maxJobs = 4;
        speedFactor = 2;
        supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
      }
    ];

    nix.distributedBuilds = lib.mkIf cfg.useBuilder true;
  };
}