#!/usr/bin/env bash
set -euo pipefail

# Wraps the pinix remote-build/deploy sequence documented in CLAUDE.md:
# build on eu.nixbuild.net, copy the closure through blunix to pinix,
# then activate. Run from the nixos-config repo root (any subdir is fine,
# cds to the repo root itself).

usage() {
  echo "Usage: $0 [--dry-run] [--skip-check]" >&2
  echo "  --dry-run     build + copy, then nixos-rebuild dry-activate instead of switch" >&2
  echo "  --skip-check  skip the leading 'nix flake check'" >&2
  exit 1
}

dry_run=false
skip_check=false
for arg in "$@"; do
  case "$arg" in
    --dry-run) dry_run=true ;;
    --skip-check) skip_check=true ;;
    -h|--help) usage ;;
    *) usage ;;
  esac
done

cd "$(git rev-parse --show-toplevel)"

if [[ "$skip_check" == false ]]; then
  echo "==> nix flake check"
  nix flake check
fi

echo "==> building pinix toplevel on eu.nixbuild.net"
build_json=$(nix build --json --eval-store auto --store ssh-ng://eu.nixbuild.net \
  path:.#nixosConfigurations.pinix.config.system.build.toplevel)
system=$(echo "$build_json" | jq -r '.[0].outputs.out')
echo "    -> $system"

echo "==> copying closure from nixbuild.net to blunix"
nix copy --from ssh-ng://eu.nixbuild.net "$system"

echo "==> copying closure to pinix"
nix copy --no-check-sigs --to 'ssh-ng://pinix?remote-program=sudo%20nix-daemon' "$system"

current=$(ssh pinix 'readlink -f /run/current-system')
if [[ "$current" != "$system" ]]; then
  echo "==> diff-closures (running pinix system -> new)"
  nix store diff-closures "$current" "$system" || true
else
  echo "==> new closure is identical to what's already running on pinix"
fi

if [[ "$dry_run" == true ]]; then
  echo "==> dry-activate on pinix"
  nixos-rebuild dry-activate --no-reexec --store-path "$system" --target-host pinix --sudo
  echo "==> dry run only, not switching -- re-run without --dry-run to activate"
  exit 0
fi

echo "==> switching pinix to new generation"
nixos-rebuild switch --no-reexec --store-path "$system" --target-host pinix --sudo

echo "==> verifying"
ssh -T pinix 'readlink -f /run/current-system; readlink -f /nix/var/nix/profiles/system; systemctl is-system-running'