{ config, pkgs, ... }:

{
  networking.hostName = "izanagi";

  homelab = {
    # Enable the standard guest VM configuration
    virtualisation.guest.enable = true;

    # Enable standard GitOps for the Control Center itself
    common.gitops.enable = true;
    # We might pull from our Forgejo instance eventually, but for bootstrap
    # it might need to pull from Github or the local Gitea if it's up.
    # common.gitops.repoUrl = "https://git.depeuter.dev/Bos55/nix-config.git";

    services = {
      openssh.enable = true;

      # Enable the Hypervisor GitOps service to provision OTHER VMs
      hypervisor-gitops = {
        enable = true;
        repoUrl = "https://git.depeuter.dev/Bos55/nix-config.git";
        pollInterval = "hourly";
      };
    };
  };

  sops = {
    defaultSopsFile = ./secrets.yaml;
    defaultSopsFormat = "yaml";
    age.keyFile = "/var/lib/sops-age/keys.txt"; # Injected via Cloud-Init during Phase 4

    secrets = {
      proxmox_api_token.owner = "root";
      forgejo_token.owner = "root";
    };

    templates."hypervisor-gitops.env".content = ''
      PROXMOX_VE_API_TOKEN=${config.sops.placeholder.proxmox_api_token}
      FORGEJO_TOKEN=${config.sops.placeholder.forgejo_token}
      PROXMOX_VE_ENDPOINT=https://mikoshi:8006/
      PROXMOX_VE_INSECURE=true
    '';
  };

  # Make the secrets available to the hypervisor-gitops service via EnvironmentFile
  systemd.services.hypervisor-gitops.serviceConfig.EnvironmentFile = [
    config.sops.templates."hypervisor-gitops.env".path
  ];

  system.stateVersion = "24.05";
}