#cloud-config
autoinstall:
  version: 1
  interactive-sections:
    - "*"

  # Run the bootstrap on the installed system's first boot. The attended
  # installer creates gabriel with an interactive password.
  user-data:
    hostname: electra
    manage_etc_hosts: true
    users: []

    package_update: true
    package_upgrade: false
    packages:
      - bluez
      - brightnessctl
      - ca-certificates
      - curl
      - dbus-user-session
      - git
      - libpam-systemd
      - libspa-0.2-bluetooth
      - openssh-client
      - pcscd
      - pipewire
      - pipewire-pulse
      - policykit-1
      - policykit-1-gnome
      - power-profiles-daemon
      - rtkit
      - uidmap # For podman
      - upower
      - wireguard-tools
      - wireplumber
      - wpasupplicant

    runcmd:
      # The installer's netplan wifi config is load-bearing for exactly one
      # boot: the bootstrap below needs the network before system-manager
      # exists to configure it. Once activated, system-manager owns
      # /etc/systemd/network and wpa_supplicant (see hosts/ubuntu/
      # common/optional/network.nix), and netplan's generator is masked.
      # Stop cloud-init from re-rendering network config on later boots.
      - |
        printf 'network: {config: disabled}\n' \
          > /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg

      # This laptop must not expose an SSH server. Keep the client for Git and
      # ssh-keygen, but remove and mask the server even if the image included it.
      - |
        systemctl disable --now ssh.service ssh.socket 2>/dev/null || true
        DEBIAN_FRONTEND=noninteractive apt-get purge --yes openssh-server
        systemctl mask ssh.service ssh.socket

      # sops-nix derives this machine's age identity from its SSH host key.
      - ssh-keygen -A

      # Cloud-init runs as root without HOME. Set it explicitly so the
      # multi-user installer can create its build users without prompting.
      - |
        if [ ! -x /nix/var/nix/profiles/default/bin/nix ]; then
          curl --proto '=https' --tlsv1.2 --fail --show-error --silent --location \
            https://nixos.org/nix/install | HOME=/root sh -s -- --daemon
        fi

      # Bootstrap directly from Foundry without leaving a checkout behind.
      # Secret installation may fail until the host's age recipient is added.
      - |
        config=$(
          env HOME=/root NIX_CONFIG='experimental-features = nix-command flakes' \
            /nix/var/nix/profiles/default/bin/nix build \
              --accept-flake-config --no-link --print-out-paths \
              github:misterio77/foundry#systemConfigs.electra
        )
        activation_path="/nix/var/nix/profiles/default/bin:$PATH"
        env PATH="$activation_path" "$config/bin/register-profile"
        env PATH="$activation_path" "$config/bin/activate"

    final_message: electra bootstrap complete.
