{ lib, pkgs, ... }:
let
  nomad-prod = pkgs.writeShellScriptBin "nomad-prod" ''
    set -e

    if [ $# -ne 1 ]; then
      echo "Usage: nomad-ui CELL_ID"
      exit 1
    fi

    CELL_ID=$1

    echo ">> Fetching cell definition for $CELL_ID from GitHub"
    REGION_ID=$(${pkgs.gh}/bin/gh api --hostname github.rbx.com repos/Roblox/cell-lifecycle/contents/definitions/''${CELL_ID}.yaml --jq '.content' | base64 -d | yq -r '.regionId')

    if [ -z "$REGION_ID" ] || [ "$REGION_ID" = "null" ]; then
      echo "Error: Could not retrieve regionId for cell $CELL_ID"
      exit 1
    fi

    echo ">> Found regionId: $REGION_ID"

    case "$REGION_ID" in
      r002)
      VAULT_REGION="chi1"
      ;;
      r003)
      VAULT_REGION="ash1"
      ;;
      *)
      echo "Error: Unknown regionId $REGION_ID. Expected r002 or r003."
      exit 1
      ;;
    esac

    echo ">> Using vault region: $VAULT_REGION"

    echo ">> Login to $VAULT_REGION vault using Okta"
    export VAULT_ADDR="https://$VAULT_REGION-vault.simulprod.com:8200"
    export VAULT_TOKEN=$(${pkgs.vault}/bin/vault login -field=token -method=oidc username=$USER)

    echo ">> Accessing cell $CELL_ID"
    export NOMAD_ADDR="https://$CELL_ID-nomad.simulprod.com"
    export NOMAD_TOKEN=$(${pkgs.vault}/bin/vault read -field secret_id ''${CELL_ID}_nomad/creds/management)

    ${pkgs.nomad}/bin/nomad ui --authenticate
  '';
in
{
  imports = [
    ./k8s.nix
  ];

  home.packages = with pkgs; [
    awscli2
    boundary # for secure remote access
    grpcurl
    hashi
    nomad-prod
    sapi
    tfswitch
    vault
  ];

  programs.gh = {
    enable = true;
    settings = {
      version = 1;
      git_protocol = "ssh";
      prompt = "enabled";
      aliases = {
        co = "pr checkout";
        vw = "pr view --web";
      };
    };
  };

  programs.onepassword.sshKeys = lib.mkAfter [
    {
      account = "roblox.1password.com";
      vault = "Private";
    }
  ];

  programs.fish = {
    shellAbbrs =
      let
        environments = [
          {
            name = "chi1";
            alias = "chi1";
            jumpHost = "chi1-jumpcontainer-es";
          }
          {
            name = "ash1";
            alias = "ash1";
            jumpHost = "chi1-jumpcontainer-es";
          }
          {
            name = "sitetest3";
            alias = "st3";
            jumpHost = "st3-jumpcontainer-es";
          }
          {
            name = "sitetest2-snc2";
            alias = "st2-snc2";
            jumpHost = "st2-snc2-jumpcontainer-es";
          }
        ];

        # Generate all environment-specific aliases
        envAliases = builtins.listToAttrs (
          builtins.concatMap (env: [
            {
              name = "ssh-sign-${env.alias}";
              value = "${pkgs.hashi}/bin/hashi -e ${env.name} sign --output-path=/Users/fcuny/.ssh/${env.alias}-cert.pub --key=(${pkgs._1password-cli}/bin/op read 'op://employee/default rbx ssh key/public key'|psub) key";
            }
            {
              name = "hashi-${env.alias}";
              value = "${pkgs.hashi}/bin/hashi -e ${env.name} show v";
            }
            {
              name = "ssh-${env.alias}";
              value = "ssh -o StrictHostKeyChecking=no -J ${env.jumpHost} -o 'CertificateFile=~/.ssh/${env.alias}-cert.pub'";
            }
          ]) environments
        );

        # Add any additional non-environment specific aliases
        additionalAliases = {
          "sjump-st1-snc2" = "${pkgs.sapi}/bin/sapi jump sitetest1-snc2";
          "sjump-st1-snc3" = "${pkgs.sapi}/bin/sapi jump sitetest3-snc2";
          "sjump-st2-snc2" = "${pkgs.sapi}/bin/sapi jump sitetest2-snc2";
          "sjump-st3" = "${pkgs.sapi}/bin/sapi jump sitetest3";
          "sjump" = "${pkgs.sapi}/bin/sapi jump";
          "ssh-edge" =
            "ssh -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -J chi1-jumpcontainer-es -i (${pkgs._1password-cli}/bin/op read 'op://Infra-Compute-Edge-rks/ice_ssh-private-key/ice_rsa'|psub)";
        };
      in
      envAliases // additionalAliases;
  };

  programs.ssh.matchBlocks = {
    "github.rbx.com" = {
      hostname = "github.rbx.com";
      user = "git";
      forwardAgent = false;
      extraOptions = {
        preferredAuthentications = "publickey";
        controlMaster = "no";
        controlPath = "none";
      };
    };
  };

  # the configuration for sapi is generated when we run `sapi jump`, there's no need to manage it with nix.
  programs.ssh.includes = [ "config_sapi" ];

  programs.git = {
    extraConfig = {
      url = {
        "ssh://git@github.rbx.com/" = {
          insteadOf = "https://github.rbx.com/";
        };
      };
    };
    # https://stackoverflow.com/questions/74012449/git-includeif-hasconfigremote-url-not-working
    # to test it's working as expected:
    # run `git config --get-all user.email' in a repository to check that we get all the possible emails
    # run `git config --get user.email' in a repository to check which email is selected
    includes = [
      {
        condition = "hasconfig:remote.*.url:git@github.rbx.com:*/**";
        path = pkgs.writeText "username.cfg" (lib.generators.toGitINI { user.email = "fcuny@roblox.com"; });
      }
      {
        condition = "hasconfig:remote.*.url:git@github.com:Roblox/**";
        path = pkgs.writeText "username.cfg" (lib.generators.toGitINI { user.email = "fcuny@roblox.com"; });
      }
      {
        condition = "hasconfig:remote.*.url:https://github.com/Roblox/**";
        path = pkgs.writeText "username.cfg" (lib.generators.toGitINI { user.email = "fcuny@roblox.com"; });
      }
      {
        condition = "hasconfig:remote.*.url:https://github.rbx.com/*/**";
        path = pkgs.writeText "username.cfg" (lib.generators.toGitINI { user.email = "fcuny@roblox.com"; });
      }
    ];
  };
}