# strictly *decrease* the scope of the default nixos installation/config

{ lib, pkgs, ... }:
let
  suidlessPam = pkgs.pam.overrideAttrs (upstream: {
    # nixpkgs' pam hardcodes unix_chkpwd path to the /run/wrappers one,
    # but i don't want the wrapper, so undo that.
    # ideally i would patch this via an overlay, but pam is in the bootstrap so that forces a full rebuild.
    # TODO: add a `package` option to the nixos' pam module and substitute it that way.
    postPatch = (if upstream.postPatch != null then upstream.postPatch else "") + ''
      substituteInPlace modules/pam_unix/Makefile.am --replace-fail \
        "/run/wrappers/bin/unix_chkpwd" "$out/bin/unix_chkpwd"
    '';
  });
in
{
  # remove a few items from /run/wrappers we don't need.
  options.security.wrappers = lib.mkOption {
    apply = lib.filterAttrs (name: _: !(builtins.elem name [
      # from <repo:nixos/nixpkgs:nixos/modules/security/polkit.nix>
      "pkexec"
      "polkit-agent-helper-1"  #< used by systemd; without this you'll have to `sudo systemctl daemon-reload` instead of unauth'd `systemctl daemon-reload`
      # from <repo:nixos/nixpkgs:nixos/modules/services/system/dbus.nix>
      "dbus-daemon-launch-helper"
      # from <repo:nixos/nixpkgs:nixos/modules/security/wrappers/default.nix>
      "fusermount"  #< only needed if you want to mount entries declared in /etc/fstab or mtab as unprivileged user
      "fusermount3"
      "mount"  #< only needed if you want to mount entries declared in /etc/fstab or mtab as unprivileged user
      "umount"
      # from <repo:nixos/nixpkgs:nixos/modules/programs/shadow.nix>
      "newgidmap"
      "newgrp"
      "newuidmap"
      "sg"
      "su"
      # from: <repo:nixos/nixpkgs:nixos/modules/security/pam.nix>
      # requires associated `pam` patch to not hardcode unix_chkpwd path
      "unix_chkpwd"
    ]));
  };
  options.security.pam.services = lib.mkOption {
    apply = services: let
      filtered = lib.filterAttrs (name: _: !(builtins.elem name [
        # from <repo:nixos/nixpkgs:nixos/modules/security/pam.nix>
        "i3lock"
        "i3lock-color"
        "vlock"
        "xlock"
        "xscreensaver"
        "runuser"
        "runuser-l"
        # from ??
        "chfn"
        "chpasswd"
        "chsh"
        "groupadd"
        "groupdel"
        "groupmems"
        "groupmod"
        "useradd"
        "userdel"
        "usermod"
        # from <repo:nixos/nixpkgs:nixos/modules/system/boot/systemd/user.nix>
        "systemd-user"  #< N.B.: this causes the `systemd --user` service manager to not be started!
      ])) services;
    in lib.mapAttrs (_serviceName: service: service // {
      # replace references with the old pam_unix, which calls into /run/wrappers/bin/unix_chkpwd,
      # with a pam_unix that calls into unix_chkpwd via the nix store.
      # TODO: use `security.pam.package` instead once <https://github.com/NixOS/nixpkgs/pull/314791> lands.
      text = lib.replaceStrings [" pam_unix.so" ] [ " ${suidlessPam}/lib/security/pam_unix.so" ] service.text;
    }) filtered;
  };

  options.environment.systemPackages = lib.mkOption {
    # see: <repo:nixos/nixpkgs:nixos/modules/config/system-path.nix>
    # it's 31 "requiredPackages", with no explanation of why they're "required"...
    # most of these can be safely removed without breaking the *boot*,
    # but some core system services DO implicitly depend on them.
    # TODO: see which more of these i can remove (or shadow/sandbox)
    apply = let
      requiredPackages = builtins.map (pkg: lib.setPrio ((pkg.meta.priority or 5) + 3) pkg) [
        # pkgs.acl
        # pkgs.attr
        # pkgs.bashInteractive
        # pkgs.bzip2
        # pkgs.coreutils-full
        # pkgs.cpio
        # pkgs.curl
        # pkgs.diffutils
        # pkgs.findutils
        # pkgs.gawk
        # pkgs.stdenv.cc.libc
        # pkgs.getent
        # pkgs.getconf
        # pkgs.gnugrep
        # pkgs.gnupatch
        # pkgs.gnused
        # pkgs.gnutar
        # pkgs.gzip
        # pkgs.xz
        pkgs.less
        # pkgs.libcap  #< implicitly required by NetworkManager/wpa_supplicant!
        # pkgs.ncurses
        pkgs.netcat
        # config.programs.ssh.package
        # pkgs.mkpasswd
        pkgs.procps
        # pkgs.su
        # pkgs.time
        # pkgs.util-linux
        # pkgs.which
        # pkgs.zstd
      ];
    in lib.filter (p: ! builtins.elem p requiredPackages);
  };

  options.system.fsPackages = lib.mkOption {
    # <repo:nixos/nixpkgs:nixos/modules/tasks/filesystems/vfat.nix>  adds `mtools` and `dosfstools`
    # dosfstools actually makes its way into the initrd (`fsck.vfat`).
    # mtools is like "MS-DOS for Linux", ancient functionality i'll never use.
    apply = lib.filter (p: p != pkgs.mtools);
  };

  config = {
    # disable non-required packages like nano, perl, rsync, strace
    environment.defaultPackages = [];

    # remove all the non-existent default directories from XDG_DATA_DIRS, XDG_CONFIG_DIRS to simplify debugging.
    # this is defaulted in <repo:nixos/nixpkgs:nixos/modules/programs/environment.nix>,
    # without being gated by any higher config.
    environment.profiles = lib.mkForce [
      "/etc/profiles/per-user/$USER"
      "/run/current-system/sw"
    ];

    # NIXPKGS_CONFIG defaults to "/etc/nix/nixpkgs-config.nix" in <nixos/modules/programs/environment.nix>.
    # that's never existed on my system and everything does fine without it set empty (no nixpkgs API to forcibly *unset* it).
    environment.variables.NIXPKGS_CONFIG = lib.mkForce "";
    # XDG_CONFIG_DIRS defaults to "/etc/xdg", which doesn't exist.
    # in practice, pam appends the values i want to XDG_CONFIG_DIRS, though this approach causes an extra leading `:`
    environment.sessionVariables.XDG_CONFIG_DIRS = lib.mkForce [];
    # XCURSOR_PATH: defaults to `[ "$HOME/.icons" "$HOME/.local/share/icons" ]`, neither of which i use, just adding noise.
    # see: <repo:nixos/nixpkgs:nixos/modules/config/xdg/icons.nix>
    environment.sessionVariables.XCURSOR_PATH = lib.mkForce [];

    # disable nixos' portal module, otherwise /share/applications gets linked into the system and complicates things (sandboxing).
    # instead, i manage portals myself via the sane.programs API (e.g. sane.programs.xdg-desktop-portal).
    xdg.portal.enable = false;
    xdg.menus.enable = false;  #< links /share/applications, and a bunch of other empty (i.e. unused) dirs

    # xdg.autostart.enable defaults to true, and links /etc/xdg/autostart into the environment, populated with .desktop files.
    # see: <repo:nixos/nixpkgs:nixos/modules/config/xdg/autostart.nix>
    # .desktop files are a questionable way to autostart things: i generally prefer a service manager for that.
    xdg.autostart.enable = false;

    # nix.channel.enable: populates `/nix/var/nix/profiles/per-user/root/channels`, `/root/.nix-channels`, `$HOME/.nix-defexpr/channels`
    #   <repo:nixos/nixpkgs:nixos/modules/config/nix-channel.nix>
    # TODO: may want to recreate NIX_PATH, nix.settings.nix-path
    nix.channel.enable = false;

    # environment.stub-ld: populate /lib/ld-linux.so with an object that unconditionally errors on launch,
    # so as to inform when trying to run a non-nixos binary?
    # IMO that's confusing: i thought /lib/ld-linux.so was some file actually required by nix.
    environment.stub-ld.enable = false;

    # `less.enable` sets LESSKEYIN_SYSTEM, LESSOPEN, LESSCLOSE env vars, which does confusing "lesspipe" things, so disable that.
    # it's enabled by default from `<nixos/modules/programs/environment.nix>`, who also sets `PAGER="less"` and `EDITOR="nano"` (keep).
    programs.less.enable = lib.mkForce false;
    environment.variables.PAGER = lib.mkOverride 900 "";  # mkDefault sets 1000. non-override is 100. 900 will beat the nixpkgs `mkDefault` but not anyone else.
    environment.variables.EDITOR = lib.mkOverride 900 "";

    # several packages (dconf, modemmanager, networkmanager, gvfs, polkit, udisks, bluez/blueman, feedbackd, etc)
    # will add themselves to the dbus search path.
    # i prefer dbus to only search XDG paths (/share/dbus-1) for service files, as that's more introspectable.
    # see: <repo:nixos/nixpkgs:nixos/modules/services/system/dbus.nix>
    # TODO: sandbox dbus? i pretty explicitly don't want to use it as a launcher.
    services.dbus.packages = lib.mkForce [
      "/run/current-system/sw"
      # config.system.path
      # pkgs.dbus
      # pkgs.polkit.out
      # pkgs.modemmanager
      # pkgs.networkmanager
      # pkgs.udisks
      # pkgs.wpa_supplicant
    ];

    # systemd by default forces shitty defaults for e.g. /tmp/.X11-unix.
    # nixos propagates those in: <nixos/modules/system/boot/systemd/tmpfiles.nix>
    # by overwriting this with an empty file, we can effectively remove it.
    environment.etc."tmpfiles.d/x11.conf".text = "# (removed by Colin)";

    # see: <nixos/modules/tasks/swraid.nix>
    # it was enabled by default before 23.11
    boot.swraid.enable = lib.mkDefault false;

    # see: <nixos/modules/tasks/bcache.nix>
    # these allow you to use the Linux block cache (cool! doesn't need to be a default though)
    boot.bcache.enable = lib.mkDefault false;

    # see: <nixos/modules/system/boot/kernel.nix>
    # by default, it adds to boot.initrd.availableKernelModules:
    # - SATA: "ahci" "sata_nv" "sata_via" "sata_sis" "sata_uli" "ata_piix" "pata_marvell"
    # - "nvme"
    # - scsi: "sd_mod" "sr_mod"
    # - SD/eMMC: "mmc_block"
    # - USB keyboards: "uhci_hcd" "ehci_hcd" "ehci_pci" "ohci_hcd" "ohci_pci" "xhci_hcd" "xhci_pci" "usbhid" "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat" "hid_logitech_hidpp" "hid_logitech_dj" "hid_microsoft" "hid_cherry" "hid_corsair"
    # - LVM: "dm_mod"
    # - on x86 only: more keyboard stuff: "pcips2" "atkbd" "i8042"

    boot.initrd.includeDefaultModules = lib.mkDefault false;

    # see: <repo:nixos/nixpkgs:nixos/modules/virtualisation/nixos-containers.nix>
    boot.enableContainers = lib.mkDefault false;
  };
}