{ lib, pkgs, ... }:

{
  users.users.admin = {
    isNormalUser = true;
    extraGroups = [ "wheel" "networkmanager" ];
    hashedPassword = "$6$HrwFoHtYRwiTZsYo$gKNOvkQhjalczOLgoTXvVu1MaihYP4BdBnVpWkdoAf.5MAiV2mMPRibYyGv9ti1Q63AhGK7n4wOPjAU0O74mK0";
  };

  security.sudo.wheelNeedsPassword = lib.mkDefault true;

  # Bootstrap Home Manager for admin on first login (per-user, standalone)
  systemd.user.services.hm-bootstrap = {
    description = "One-time Home Manager bootstrap for admin";
    unitConfig = {
      ConditionPathExists = "!%h/.config/home-manager/.hm_bootstrap_done";
      After = [ "graphical-session.target" ];
      Wants = [ "graphical-session.target" ];
      PartOf = [ "graphical-session.target" ];
    };
    serviceConfig = {
      Type = "simple";
      TimeoutStartSec = "30min";
      Environment = [ "PATH=/run/current-system/sw/bin:/etc/profiles/per-user/%u/bin" ];
      StandardOutput = "journal";
      StandardError = "journal";
      ExecStart = pkgs.writeShellScript "hm-bootstrap.sh" (builtins.readFile ../../scripts/hm-bootstrap.sh);
    };
    wantedBy = [ "graphical-session.target" ];
  };
}