{ depot, pkgs, lib, ... }:

let
  inherit (builtins) concatLists concatStringsSep toJSON unsafeDiscardStringContext;
  inherit (depot.users) wpcarro;
  inherit (pkgs) writeText;

  images = import "${pkgs.path}/nixos/modules/virtualisation/gce-images.nix";
  nixosImage = images."20.09";
in
{
  googleCloudVM =
    { project
    , name
    , region
    , zone
    , configuration
    , extraConfig ? { }
    ,
    }:
    let
      inherit (configuration.users.users) root;
      inherit (configuration.networking) firewall;

      # Convert NixOS-style port numbers to Terraform-style.
      asStrings = xs: map toString xs;
      asRanges = xs: map (x: "${toString x.from}-${toString x.to}") xs;

      sshKeys = concatStringsSep "\n"
        (map (key: "root:${key}") root.openssh.authorizedKeys.keys);

      os = depot.ops.nixos.nixosFor (_: {
        imports = [
          "${pkgs.path}/nixos/modules/virtualisation/google-compute-image.nix"
          configuration
        ];

        networking.hostName = name;

        fileSystems."/nix" = {
          device = "/dev/disk/by-label/google-${name}-disk";
          fsType = "ext4";
        };
      });

      osRoot = os.config.system.build.toplevel;
      osPath = unsafeDiscardStringContext (toString osRoot.outPath);
      drvPath = unsafeDiscardStringContext (toString osRoot.drvPath);
    in
    writeText "terraform.tf.json" (toJSON (lib.recursiveUpdate extraConfig {
      provider.google = {
        inherit project region zone;
      };

      resource.google_compute_instance."${name}" = {
        inherit name zone;
        machine_type = "e2-standard-2";

        tags = [
          "http-server"
          "https-server"
          "${name}-firewall"
        ];

        boot_disk = {
          device_name = "boot";
          initialize_params = {
            size = 10;
            image = "projects/nixos-cloud/global/images/${nixosImage.name}";
          };
        };

        attached_disk = {
          source = "\${google_compute_disk.${name}.id}";
          device_name = "${name}-disk";
        };

        network_interface = {
          network = "default";
          subnetwork = "default";
          access_config = { };
        };

        # Copy root's SSH keys from the NixOS configuration and expose them to the
        # metadata server.
        metadata = {
          inherit sshKeys;
          ssh-keys = sshKeys;

          # NixOS's fetch-instance-ssh-keys.bash relies on these fields being
          # available on the metadata server.
          ssh_host_ed25519_key = "\${tls_private_key.${name}.private_key_pem}";
          ssh_host_ed25519_key_pub = "\${tls_private_key.${name}.public_key_pem}";

          # Even though we have SSH access, having oslogin can still be useful for
          # troubleshooting in the browser if for some reason SSH isn't working as
          # expected.
          enable-oslogin = "TRUE";
        };

        service_account.scopes = [ "cloud-platform" ];
      };

      resource.tls_private_key."${name}" = {
        algorithm = "ECDSA";
        ecdsa_curve = "P384";
      };

      resource.google_compute_firewall."${name}" = {
        name = "${name}-firewall";
        network = "default";

        # Read the firewall configuration from the NixOS configuration.
        allow = [
          {
            protocol = "tcp";
            ports = concatLists [
              (asStrings (firewall.allowedTCPPorts or [ ]))
              (asRanges (firewall.allowedTCPPortRanges or [ ]))
            ];
          }
          {
            protocol = "udp";
            ports = concatLists [
              (asStrings (firewall.allowedUDPPorts or [ ]))
              (asRanges (firewall.allowedUDPPortRanges or [ ]))
            ];
          }
        ];
        source_ranges = [ "0.0.0.0/0" ];
      };

      resource.google_compute_disk."${name}" = {
        inherit zone;
        name = "${name}-disk";
        size = 100;
      };

      resource.null_resource.deploy_nixos = {
        triggers = {
          # Redeploy when the NixOS configuration changes.
          os = "${osPath}";
          # Redeploy when a new machine is provisioned.
          machine_id = "\${google_compute_instance.${name}.id}";
        };

        connection = {
          host = "\${google_compute_instance.${name}.network_interface[0].access_config[0].nat_ip}";
        };

        provisioner = [
          { remote-exec.inline = [ "true" ]; }
          {
            local-exec.command = ''
              export PATH="${pkgs.openssh}/bin:$PATH"

              scratch="$(mktemp -d)"
              function cleanup() {
                rm -rf $scratch
              }
              trap cleanup EXIT

              # write out ssh key
              echo -n "''${tls_private_key.${name}.private_key_pem}" > $scratch/id_rsa.pem
              chmod 0600 $scratch/id_rsa.pem

              export NIX_SSHOPTS="\
                -o StrictHostKeyChecking=no\
                -o UserKnownHostsFile=/dev/null\
                -o GlobalKnownHostsFile=/dev/null\
                -o IdentityFile=$scratch/id_rsa.pem
              "

              nix-build ${drvPath}
              nix-copy-closure --to \
                root@''${google_compute_instance.${name}.network_interface[0].access_config[0].nat_ip} \
                ${osPath} --gzip --use-substitutes
            '';
          }
          {
            remote-exec.inline = [
              "nix-env --profile /nix/var/nix/profiles/system --set ${osPath}"
              "${osPath}/bin/switch-to-configuration switch"
            ];
          }
        ];
      };
    }));
}