OPTION overwrite
OPTION type=thick
OPTION start
OPTION virtualnet=:<random> default
OPTION nat

CMD mkdir -p /home

CMD pw groupadd -n cashmere -g 1001 || true
CMD pw useradd -n cashmere -u 1001 -g cashmere -G wheel -s /bin/sh -m -d /home/cashmere || true

# PKG --update
PKG emacs git git-delta git-remote-gcrypt gnupg bash pinentry-curses password-store
PKG py312-xonsh atuin zoxide carapace direnv fastfetch
PKG coreutils eza fd-find bat ripgrep
PKG doas nix sops vim npm
PKG hs-pandoc isync msmtp mu
PKG poppler-utils ImageMagick7

COPY files/doas.conf /usr/local/etc/doas.conf
CMD chown root:wheel /usr/local/etc/doas.conf
CMD chmod 600 /usr/local/etc/doas.conf

CMD grep -qx /usr/local/bin/xonsh /etc/shells || echo /usr/local/bin/xonsh >> /etc/shells

CMD pw usermod -n cashmere -s /usr/local/bin/xonsh || true

CMD mv /usr/local/share/emacs/site-lisp/default.el /usr/local/share/emacs/site-lisp/default.el.disabled || true

CMD mkdir -p /home/cashmere/.config/atuin /home/cashmere/.ssh /home/cashmere/.gnupg
COPY files/dotfiles/.gitconfig /home/cashmere/.gitconfig
COPY files/dotfiles/.env /home/cashmere/.env
COPY files/dotfiles/.profile /home/cashmere/.profile
COPY files/dotfiles/.xonshrc /home/cashmere/.xonshrc
COPY files/dotfiles/atuin.toml /home/cashmere/.config/atuin/config.toml
COPY files/dotfiles/authorized_keys /home/cashmere/.ssh/authorized_keys
COPY files/dotfiles/gpg-agent.conf /home/cashmere/.gnupg/gpg-agent.conf
COPY files/dotfiles/sshcontrol /home/cashmere/.gnupg/sshcontrol
COPY files/dotfiles/identity.tar.gz.gpg /home/cashmere/identity.tar.gz.gpg
CMD chown -R cashmere:cashmere /home/cashmere
CMD chmod 700 /home/cashmere/.ssh /home/cashmere/.gnupg
CMD chmod 600 /home/cashmere/.ssh/authorized_keys /home/cashmere/.gnupg/sshcontrol /home/cashmere/.gnupg/gpg-agent.conf

COPY files/pinentry-emacs /usr/local/bin/pinentry-emacs
CMD chown root:wheel /usr/local/bin/pinentry-emacs
CMD chmod 555 /usr/local/bin/pinentry-emacs

# Hook in from the host (do NOT use `su - cashmere`: a login shell wipes
# KITTY_WINDOW_ID/KITTY_PUBLIC_KEY, so kitty-graphics.el falls back to Sixel):
#   doas jexec -U cashmere devenv env HOME=/home/cashmere USER=cashmere LOGNAME=cashmere xonsh -l
# (host-side helper: `jail` function in the host .xonshrc / dotfiles.org)

CMD echo makejail-env-done