{ config, pkgs, lib, modulesPath, ... }:

# VirtualBox test image — mirrors jupiter's services (minus tailscale/sops/disk)
# and adds console/SSH login credentials. Disk + bootloader come from the
# virtualbox-image module, so hardware-configuration.nix is NOT imported.
{
  imports = [
    (modulesPath + "/virtualisation/virtualbox-image.nix")
    ../../common.nix              # shared base: user / ssh / nix / firewall
    ../../services/network/samba.nix
    ../../services/network/avahi.nix
    ../../services/media/audiobookshelf.nix
    ../../services/containers.nix
    ../../services/network/caddy.nix
  ];

  networking.hostName = "jupiter";
  networking.networkmanager.enable = true;
  users.users.darman.extraGroups = [ "docker" ];

  # Allow password login for testing (real host is key-only).
  services.openssh.settings.PasswordAuthentication = lib.mkForce true;

  # Login: darman / test  (change or remove for anything but local testing).
  users.users.darman.initialPassword = "test";
  users.users.root.initialPassword = "test";

  # Throwaway SMB password for testing (samba-smbd login = darman / test).
  # Single line — the provisioning oneshot feeds it twice for smbpasswd.
  # Real host must NOT do this — plaintext lands in the world-readable Nix
  # store. It uses sops-nix (secrets.nix) instead.
  environment.etc."samba/smb-password" = {
    text = "test\n";
    mode = "0600";
  };

  # Caddy vhosts (same as the LAN host, so the proxy path is testable).
  services.caddy.virtualHosts = {
    "http://localhost".extraConfig = "reverse_proxy localhost:8080";
    "http://audiobookshelf.jupiter.sol".extraConfig = "reverse_proxy localhost:8000";
  };

  # Guest additions for clipboard/resize (optional).
  virtualisation.virtualbox.guest.enable = true;

  # Smaller virtual disk = faster image assembly + VMDK compression.
  # Size in MiB (default is ~50G).
  virtualisation.diskSize = 6144;      # 6 GiB total disk
}