nixos/hosts/bootstrap/default.nix

{ inputs, config, lib, pkgs, outputs,... }:
let
  pubKeys = lib.filesystem.listFilesRecursive (../common/users/keys);
in 
{
  imports =
    [ 
      # Disk configuration
      inputs.disko.nixosModules.disko
      (import ../common/disks/std-disk-config.nix { device = "/dev/vda"; })
      ../common/optional/btrfs-impermanence.nix
      inputs.impermanence.nixosModules.impermanence

      # Import core options
      ./hardware-configuration.nix
      ../common/core

      # Import optional options
      ../common/optional/openssh.nix

    ];

  nixpkgs = {
      overlays = [
        outputs.overlays.additions
        outputs.overlays.modifications
        outputs.overlays.unstable-packages
      ];
      config = {
        allowUnfree = true;
      };
    };

  fileSystems."/persist".neededForBoot = true;
  environment.persistence."/persist" = {
    hideMounts = true;
    directories = [
      "/etc/nixos"
    ];
    files = [
      "/etc/ssh/ssh_host_ed25519_key"
      "/etc/ssh/ssh_host_ed25519_key.pub"
      "/etc/ssh/deploy_key-ssh-ed25519"
    ];
  };

  boot = {
    loader = {
      systemd-boot.enable = true;
      efi.canTouchEfiVariables = true;
      timeout = 3;
    };
  };

  users = {
    mutableUsers = true;
    openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
    extraUsers = {
      root = {
        initialPassword = "1234";
      };
     };
  };

  networking = {
    hostName = "bootstrap";
    networkmanager.enable = true;
    enableIPv6 = false;
  };

  services.openssh = {
    enable = true;
    ports = 22;
    authorizedKeysFiles = lib.mkForce ["/etc/ssh/authorized_keys.d/%u"];
    hostKeys = [{
      path = "/persist/etc/ssh/ssh_host_ed25519_key";
      type = "ed25519";
    }];
    settings = {
      PasswordAuthentication = false;
      PermitRootLogin = "yes";
      PubKeyAuthentication = "yes";
      StreamLocalBindUnlink = "yes";
      UsePAM = true;
    };
  };

  programs.ssh.extraConfig = '' 
    Host git.bitlab21.com
        IdentitiesOnly yes
        StrictHostKeyChecking no
        IdentityFile /etc/ssh/deploy_key-ssh-ed25519
  '';

  security.pam = {
    sshAgentAuth.enable = true;
  };
  
  networking.firewall.allowedTCPPorts = [ sshPort ];

  services = {
    qemuGuest.enable = true;
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  system.stateVersion = "23.11";
}