infra/flake.nix

{
  description = "Gortium infra flake";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
    agenix = {
      url = "github:ryantm/agenix";
      inputs.darwin.follows = "";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    lix = {
      url = "git+https://git.lix.systems/lix-project/lix?ref=main";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nixpkgs-uconsole.url = "github:NixOS/nixpkgs/nixos-25.11";
    nixos-uconsole = {
      url = "github:gortium/nixos-uconsole/pr/dcs-panel-detection";
      inputs.nixpkgs.follows = "nixpkgs-uconsole";
      inputs.nixos-raspberrypi.follows = "nixos-raspberrypi";
    };
    nixos-raspberrypi = {
      url = "github:gortium/nixos-raspberrypi/cm5-cross-v1";
      inputs.nixpkgs.follows = "nixpkgs-uconsole";
    };
  };

  outputs = { self, nixpkgs, agenix, lix
            , nixpkgs-uconsole, nixos-uconsole, nixos-raspberrypi
            , ... }@inputs:
    let
      system = "x86_64-linux";
      keys = import ./lib/keys.nix;
      paths = {
        flake = "/home/gortium/infra";
        identities = [
          "/home/gortium/.ssh/gortium_ssh_key"
          "/etc/ssh/ssh_host_ed25519_key"
          "/root/.age/bootstrap.key" ];
      };
      overlays = [ agenix.overlays.default ];
      pkgs = import nixpkgs {
        inherit system overlays;
        config.allowUnfree = true;
        config.permittedInsecurePackages = [ "openclaw-2026.3.12" ];
      };
      devShell = import ./shells/nix_dev.nix {
        inherit pkgs system agenix;
      };

      # Cross-compile overlay fixes for Hyprland and deps on aarch64
      uconsoleCrossOverlay = final: prev: {
        libcamera = prev.libcamera.overrideAttrs (_: { meta.platforms = []; });
        libcamera-rpi = prev.libcamera-rpi.overrideAttrs (_: { meta.platforms = []; });
        libpisp = prev.libpisp.overrideAttrs (_: { meta.platforms = []; });
        pipewire = prev.pipewire.overrideAttrs (old: {
          buildInputs = builtins.filter
            (x: !(x?pname && x.pname == "libcamera"))
            (old.buildInputs or []);
          mesonFlags = builtins.filter
            (flag: !(builtins.isString flag && builtins.match ".*libcamera.*" flag != null))
            (old.mesonFlags or []) ++ [ "-Dlibcamera=disabled" ];
        });
        gjs = prev.gjs.overrideAttrs (old: {
          mesonFlags = (old.mesonFlags or []) ++ [ "-Dskip_gtk_tests=true" ];
        });
        hyprland = prev.hyprland.override { wrapRuntimeDeps = false; };
        xdg-desktop-portal-hyprland = prev.xdg-desktop-portal-hyprland.overrideAttrs (old: {
          preConfigure = (old.preConfigure or "") + ''
            cmakeFlags="$cmakeFlags -Dhyprwayland-scanner_DIR=${prev.buildPackages.hyprwayland-scanner}/lib/cmake/hyprwayland-scanner" 2>/dev/null || true
            export PKG_CONFIG_PATH="${prev.buildPackages.hyprwayland-scanner}/lib/pkgconfig:$PKG_CONFIG_PATH"
          '';
        });
      };

      # RPI-specific pipewire libcamera fix (separate nixpkgs instance)
      uconsoleRpiPipewireOverlay = final: prev: {
        pipewire = prev.pipewire.overrideAttrs (old: {
          buildInputs = builtins.filter
            (x: !(x?pname && x.pname == "libcamera"))
            (old.buildInputs or []);
          mesonFlags = builtins.filter
            (flag: !(builtins.isString flag && builtins.match ".*libcamera.*" flag != null))
            (old.mesonFlags or []) ++ [ "-Dlibcamera=disabled" ];
        });
      };

      # Shared uConsole CM5 module set — used by both toplevel and SD image
      uconsoleBaseModules = [
        {
          nixpkgs.buildPlatform = "x86_64-linux";
          nixpkgs.hostPlatform = "aarch64-linux";
          nixpkgs.config.allowUnfree = true;
          boot.loader.raspberry-pi.bootloader = "kernel";
          nixpkgs.overlays = [ uconsoleCrossOverlay ];
        }
        nixos-raspberrypi.nixosModules.nixpkgs-rpi
        ({ config, lib, pkgs, ... }: {
          nixpkgs.overlays = [ uconsoleRpiPipewireOverlay ];
        })
        # Fix old panel init_sequence: DCS read + DSI_INIT0 lane config
        ({ lib, ... }: {
          boot.kernelPatches = [{
            name = "panel-cwu50-fix-lanes";
            patch = ./patches/0008-panel-cwu50-fix-init-seq1.patch;
          }];
        })
        nixos-raspberrypi.nixosModules.raspberry-pi-5.base
        nixos-raspberrypi.lib.inject-overlays
        nixos-raspberrypi.lib.inject-overlays-global
        nixos-uconsole.nixosModules.uconsole-cm5
        # Cross-compiled Lix for uConsole
        ({ config, lib, pkgs, inputs, ... }: let
          lixCross = import inputs.nixpkgs-uconsole {
            localSystem = { system = "x86_64-linux"; };
            crossSystem = { system = "aarch64-linux"; };
            overlays = [ inputs.lix.overlays.default ];
          };
        in { nix.package = lixCross.lix; })
        agenix.nixosModules.default
        ./hosts/uconsole-cm5/configuration.nix
        ./hosts/uconsole-cm5/hardware-configuration.nix
        ./modules/nixos/services/wireguard-client.nix
        ./modules/nixos/hardware/uconsole-cm5-aio-v2.nix
        ./users/gortium/gortium.nix
        ./users/ai-worker/ai-worker.nix
      ];
    in {
      nixosConfigurations = {
        lazyworkhorse = nixpkgs.lib.nixosSystem {
          specialArgs = { inherit system self keys paths inputs; };
          modules = [
            {
              nixpkgs.overlays = overlays;
              nixpkgs.config.allowUnfree = true;
              nixpkgs.config.rocmSupport = true;
              nixpkgs.config.permittedInsecurePackages = [ "openclaw-2026.3.12" ];
              nix.package = lix.packages.${system}.default;
            }
            agenix.nixosModules.default
            ./hosts/lazyworkhorse/configuration.nix
            ./hosts/lazyworkhorse/hardware-configuration.nix
            ./modules/nixos/filesystem/hoardingcow-mount.nix
            ./modules/nixos/services/docker_manager.nix
            ./modules/nixos/services/wireguard-client.nix
            ./modules/nixos/services/ollama_init_custom_models.nix
            ./modules/nixos/security/ai-worker-restricted.nix
            ./users/gortium/gortium.nix
            ./users/ai-worker/ai-worker.nix
          ];
        };

        cyt-pi = nixpkgs.lib.nixosSystem {
          specialArgs = { inherit self keys paths inputs; };
          modules = [
            {
              nixpkgs.overlays = overlays;
              nixpkgs.config.allowUnfree = true;
              nixpkgs.hostPlatform = "aarch64-linux";
              nix.package = lix.packages."aarch64-linux".default;
            }
            ./hosts/cyt-pi/configuration.nix
            ./hosts/cyt-pi/hardware-configuration.nix
            ./modules/nixos/services/wireguard-client.nix
            ./users/gortium/gortium.nix
          ];
        };

        uconsole-cm5 = nixpkgs-uconsole.lib.nixosSystem {
          system = "aarch64-linux";
          specialArgs = {
            inherit self keys paths inputs;
            nixos-raspberrypi = nixos-raspberrypi;
            isCM4 = false;
          };
          modules = uconsoleBaseModules;
        };
      };

      devShells.${system}.default = devShell;

      packages.${system} = {
        uconsole-cm5-image = (nixos-raspberrypi.lib.nixosSystem {
          system = "aarch64-linux";
          specialArgs = {
            inherit self keys inputs;
            nixos-raspberrypi = nixos-raspberrypi;
            isCM4 = false;
          };
          modules = uconsoleBaseModules ++ [
            nixos-raspberrypi.nixosModules.sd-image
          ];
        }).config.system.build.sdImage;
      };
    };
}