nanuqsaurus/modules/users/admin.nix

{
  config,
  lib,
  pkgs,
  ...
}:

let
  cfg = config.nanuqsaurus.admin;
in
{
  options.nanuqsaurus.admin = {
    username = lib.mkOption {
      type = lib.types.str;
      default = "admin";
      description = "Primary admin user account name.";
    };
  };

  config = {
    users.groups = {
      docker = { };
      podman = { };
    };

    users.users.${cfg.username} = {
      isNormalUser = true;
      extraGroups = [
        "wheel"
        "networkmanager"
        "podman"
        "docker"
        "libvirtd"
        "lpadmin"
      ];
      hashedPassword = "$6$HrwFoHtYRwiTZsYo$gKNOvkQhjalczOLgoTXvVu1MaihYP4BdBnVpWkdoAf.5MAiV2mMPRibYyGv9ti1Q63AhGK7n4wOPjAU0O74mK0";
      subGidRanges = [
        {
          count = 65536;
          startGid = 100000;
        }
      ];
      subUidRanges = [
        {
          count = 65536;
          startUid = 100000;
        }
      ];
    };

    security.sudo.wheelNeedsPassword = lib.mkDefault true;

    # Bootstrap Home Manager for the primary admin user on first login (per-user, standalone)
    systemd.user.services.hm-bootstrap = {
      description = "One-time Home Manager bootstrap";
      unitConfig = {
        ConditionPathExists = "!%h/.config/home-manager/.hm_bootstrap_done";
        After = [ "graphical-session.target" ];
        Wants = [ "graphical-session.target" ];
        PartOf = [ "graphical-session.target" ];
      };
      serviceConfig = {
        Type = "simple";
        TimeoutStartSec = "30min";
        Environment = [
          "PATH=/run/current-system/sw/bin:/etc/profiles/per-user/%u/bin"
          "NANUQSAURUS_ADMIN_USER=${cfg.username}"
          "NANUQSAURUS_HM_TARGET=${cfg.username}"
        ];
        StandardOutput = "journal";
        StandardError = "journal";
        ExecStart = pkgs.writeShellScript "hm-bootstrap.sh" (
          builtins.readFile ../../scripts/hm-bootstrap.sh
        );
      };
      wantedBy = [ "graphical-session.target" ];
    };
  };
}