# ── Shared rescue / installer ISO module ────────────────────────
# Import this from a host's iso.nix to get a standard rescue
# environment with:
#   - SSH access for remote rescue
#   - The host's disko config available at /etc/disko-config.nix
#   - Common installer tools
#
# The host's iso.nix should set `iso.diskoConfig` to the path of
# its disko configuration file.
#
# The flake must also include `inputs.disko.nixosModules.disko` in
# each ISO's module list to make the `disko` command available.
{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.iso;
in {
  options.iso = {
    diskoConfig = lib.mkOption {
      type = lib.types.path;
      description = "Path to the host's disko configuration file";
    };

    description = lib.mkOption {
      type = lib.types.str;
      default = "NixOS Rescue ISO";
      description = "Description shown in the ISO boot menu";
    };

    extraPackages = lib.mkOption {
      type = lib.types.listOf lib.types.package;
      default = [];
      description = "Additional packages to include on the ISO";
    };
  };

  config = {
    # Disable disko config application on ISOs — we only want the disko CLI tool.
    # Without this, disko would try to apply filesystems/boot config at build time,
    # which conflicts with ISO-specific overrides and can cause boot failures.
    disko.enableConfig = false;
    # Standard installer tools
    environment.systemPackages = with pkgs;
      [
        git
        neovim
        wget
        curl
        parted
        gptfdisk
        efibootmgr
      ]
      ++ cfg.extraPackages;

    # Enable SSH for remote rescue access
    systemd.services.sshd.wantedBy = lib.mkOverride 40 ["multi-user.target"];
    services.openssh = {
      enable = true;
      settings.PasswordAuthentication = false;
    };

    users.users.root = {
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINXqriPZVIuduc/J7GS1mD171LL0gIbgEjlImsxedWVX"
      ];
    };

    # Copy the host's disko config to /etc/disko-config.nix
    # Usage during rescue:
    #   disko --mode disko /etc/disko-config.nix
    #   nixos-install --flake /etc/nixos#hostname
    environment.etc."disko-config.nix".source = cfg.diskoConfig;

    system.activationScripts.diskoConfig = ''
      chmod 644 /etc/disko-config.nix
    '';

    system.stateVersion = "26.05";
  };
}