#!/usr/bin/env bash
set -euo pipefail

### CONFIG ###
OS_DISK=/dev/sda
DATA_DISK=/dev/sdb
HOSTNAME=fileserver
STATE_VERSION="25.05"
TIMEZONE="Europe/Berlin"
USERNAME="danlin"
PASSWORD="changeme"
ROOT_PASS="root"

echo ">>> WARNUNG: ALLE DATEN auf ${OS_DISK} und ${DATA_DISK} werden GELÖSCHT!"
echo ">>> Warte 5 Sekunden... (STRG+C zum Abbrechen)"
sleep 5

echo ">>> Partitioniere OS-Disk (${OS_DISK}) für EFI + ROOT..."
parted "${OS_DISK}" --script mklabel gpt
parted "${OS_DISK}" --script mkpart ESP fat32 1MiB 513MiB
parted "${OS_DISK}" --script set 1 esp on
parted "${OS_DISK}" --script mkpart primary ext4 513MiB 100%

echo ">>> Formatiere OS-Partitionen..."
mkfs.fat -F32 "${OS_DISK}1"
mkfs.ext4 -F "${OS_DISK}2"

echo ">>> Partitioniere DATA-Disk (${DATA_DISK})..."
parted "${DATA_DISK}" --script mklabel gpt
parted "${DATA_DISK}" --script mkpart primary ext4 0% 100%

echo ">>> Formatiere DATA-Partition..."
mkfs.ext4 -F "${DATA_DISK}1"

echo ">>> Mounten..."
mount "${OS_DISK}2" /mnt
mkdir -p /mnt/boot
mount "${OS_DISK}1" /mnt/boot

mkdir -p /mnt/data
mount "${DATA_DISK}1" /mnt/data

echo ">>> Generiere NixOS-Config..."
nixos-generate-config --root /mnt

CONFIG=/mnt/etc/nixos/configuration.nix
HWCFG=/mnt/etc/nixos/hardware-configuration.nix

echo ">>> Schreibe minimale configuration.nix..."

cat > "${CONFIG}" <<EOF
{ config, pkgs, ... }:

{
  imports = [ ./hardware-configuration.nix ];
  
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  security.sudo.wheelNeedsPassword = false;

  networking.hostName = "${HOSTNAME}";
  time.timeZone = "${TIMEZONE}";

  services.openssh.enable = true;

  networking.firewall = {
    enable = true;
    allowedTCPPorts = [ 22 ];
  };

  users.users.${USERNAME} = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    initialPassword = "${PASSWORD}";
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
    ];
  };

  users.users.root.initialPassword = "${ROOT_PASS}";

  environment.systemPackages = with pkgs; [
    vim
    htop
    rclone
  ];

  networking.useDHCP = false;
  networking.interfaces.ens18.ipv4.addresses = [
    {
      address = "10.202.82.6";
      prefixLength = 24;
    }
  ];
  networking.defaultGateway = "10.0.10.1";
  networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];

  system.stateVersion = "${STATE_VERSION}";
}
EOF

echo ">>> /data in hardware-configuration ergänzen (falls fehlt)..."
DATA_UUID=$(blkid -s UUID -o value "${DATA_DISK}1")

if ! grep -q '"/data"' "${HWCFG}"; then
  cat >> "${HWCFG}" <<EOF

  fileSystems."/data" = {
    device = "/dev/disk/by-uuid/${DATA_UUID}";
    fsType = "ext4";
  };
EOF
fi

echo ">>> Starte nixos-install..."
nixos-install

echo ">>> Erzeuge README mit rclone/SMB-Hinweisen unter /mnt/root/README-rclone-smb.txt ..."
cat > /mnt/root/README-rclone-smb.txt <<'TXT'
Fileserver: rclone + SMB Quickstart\n\n1) rclone Remote erstellen (Name: gdrive)\n   sudo -i\n   rclone config\n   # storage: drive (Google Drive), headless: No und Token von Desktop übernehmen\n\n   Testen:\n   rclone lsd gdrive:\n   rclone mkdir gdrive:backup-daten\n\n   Manuell starten:\n   systemctl start rclone-backup.service\n   journalctl -u rclone-backup -e\n   tail -n 100 /var/log/rclone-backup.log\n\n   Timer aktivieren/prüfen:\n   systemctl list-timers '*rclone*'\n   systemctl enable --now rclone-backup.timer\n\n2) SMB-Passwort für Benutzer danlin setzen\n   smbpasswd -a danlin\n\n   Shares:\n   - daten        (nur mit Benutzer danlin)\n   - daten-share  (Gastzugriff erlaubt)\n\n   Zugriff:\n   - Windows: \\fileserver\daten   oder   \\fileserver\daten-share\n   - macOS:   smb://fileserver/daten  oder  smb://fileserver/daten-share\nTXT

echo ""
echo "===== NACHINSTALLATION HINWEISE ====="
echo "- rclone Remote 'gdrive' einrichten: sudo -i && rclone config"
echo "- Backup testen: systemctl start rclone-backup.service && journalctl -u rclone-backup -e"
echo "- SMB-Passwort setzen: sudo smbpasswd -a danlin"
echo "- Details siehe: /root/README.md"

echo ">>> Fertig. Jetzt reboot ausführen."