# Opt-in services & integrations — off by default, one toggle each, enabled
# in system.nix (see the commented examples in the downstream template).
# These are system-side: their own `nomarchy.services.*` namespace, distinct
# from the distro's core `nomarchy.system.*` toggles. `username` (from
# specialArgs) is read lazily, only where a service needs it.
{ config, lib, pkgs, ... }@args:

let
  cfg = config.nomarchy.services;
in
{
  options.nomarchy.services = {
    tailscale.enable = lib.mkEnableOption ''
      Tailscale, the mesh VPN — ships the daemon; authenticate once with
      `sudo tailscale up`'';

    syncthing.enable = lib.mkEnableOption ''
      Syncthing continuous file sync, running as the login user — add
      folders and devices in the web UI at http://127.0.0.1:8384'';

    podman.enable = lib.mkEnableOption ''
      Podman for rootless containers, with `docker` aliased to it and DNS on
      the default network; the login user gets a subuid/subgid range'';

    flatpak.enable = lib.mkEnableOption ''
      Flatpak, with the Flathub remote added system-wide — install apps with
      `flatpak install flathub <app>`'';

    pika.enable = lib.mkEnableOption ''
      Pika Backup, a friendly GUI for scheduled Borg backups (the app;
      configure repositories and schedules inside it)'';
  };

  config = lib.mkMerge [
    (lib.mkIf cfg.tailscale.enable {
      services.tailscale.enable = true;
    })

    (lib.mkIf cfg.syncthing.enable {
      services.syncthing = {
        enable = true;
        user = args.username;
        # Manage folders/devices in the GUI; don't let the (empty) declarative
        # config wipe them on a rebuild.
        overrideDevices = false;
        overrideFolders = false;
        guiAddress = "127.0.0.1:8384";
      };
    })

    (lib.mkIf cfg.podman.enable {
      virtualisation.podman = {
        enable = true;
        dockerCompat = lib.mkDefault true; # `docker` → podman (off if you run real docker)
        defaultNetwork.settings.dns_enabled = true; # DNS for rootless containers
      };
      # Rootless podman needs a subuid/subgid range for the user.
      users.users.${args.username}.autoSubUidGidRange = lib.mkDefault true;
    })

    (lib.mkIf cfg.flatpak.enable {
      services.flatpak.enable = true;
      # Flatpak ships no remotes; add Flathub system-wide. Idempotent
      # (--if-not-exists), and it reads the .flatpakrepo over the network, so
      # it waits for connectivity and simply retries next boot if offline.
      systemd.services.nomarchy-flathub = {
        description = "Add the Flathub Flatpak remote";
        wantedBy = [ "multi-user.target" ];
        wants = [ "network-online.target" ];
        after = [ "network-online.target" ];
        path = [ pkgs.flatpak ];
        serviceConfig.Type = "oneshot";
        script = ''
          flatpak remote-add --system --if-not-exists flathub \
            https://dl.flathub.org/repo/flathub.flatpakrepo
        '';
      };
    })

    (lib.mkIf cfg.pika.enable {
      environment.systemPackages = [ pkgs.pika-backup ];
    })
  ];
}