# roles/thin-client/apps/remmina.nix
#
# Remmina RDP client with system-wide connection profiles.
# Q10 decisions: System-wide /etc/remmina/, Kerberos SSO, several TS,
# Fullscreen+Multi-Monitor, only Audio local redirection.
#
# Note on "Several TS": we ship a small placeholder list with one example.
# Add real TS endpoints in az.tc.rdp.servers below.
{config, lib, pkgs, ...}: let
  inherit (lib) mkIf mkOption types;
  cfg = config.az.tc;

  # Helper: builds a .remmina profile for one TS
  mkRemminaProfile = server: let
    name = server.name;
    fqdn = server.fqdn;
  in
    pkgs.writeTextFile {
      name = "${lib.toLower name}.remmina";
      destination = "/etc/remmina/${lib.toLower name}.remmina";
      text = ''
        [remmina]
        name=${name}
        protocol=RDP
        server=${fqdn}
        username=
        domain=AZ-GROUP
        security=
        colordepth=32
        resolution=multimonitor
        viewmode=2
        fullscreen=1
        multimon=1
        audio-mode=1
        audiocapture=0
        clipboard=both
        quality=2
        kerberos=1
        enable-authecol=kerberos
        disableclipboard=0
        redirectsound=1
        redirectprinter=0
        redirectdrive=0
        redirectusb=0
        keyboard-grab=1
        showcursor=1
      '';
    };
in {
  options.az.tc.rdp = {
    servers = mkOption {
      type = types.listOf (types.submodule {
        options = {
          name = mkOption {
            type = types.str;
            description = "Display name (e.g. 'TS Berlin', 'TS ERP').";
          };
          fqdn = mkOption {
            type = types.str;
            description = "FQDN of the TS endpoint (e.g. 'ts-berlin.az-group.local').";
          };
        };
      });
      default = [
        # TODO: fill real TS endpoints
        {
          name = "TS Berlin";
          fqdn = "ts-berlin.az-group.local";
        }
      ];
      description = ''
        List of Terminal Server endpoints. One Remmina profile per entry
        is generated system-wide.
      '';
    };
  };

  config = mkIf cfg.enable {
    environment.systemPackages = with pkgs; [
      remmina
      freerdp3
    ];

    # System-wide Remmina profiles
    environment.etc = builtins.listToAttrs (builtins.map (server: {
        name = "remmina/${lib.toLower server.name}.remmina";
        value.source = (mkRemminaProfile server) + "/etc/remmina/${lib.toLower server.name}.remmina";
      })
      config.az.tc.rdp.servers);

    # Allow Domain Users to read the system-wide profiles
    systemd.tmpfiles.rules = [
      "d /etc/remmina 0755 root root -"
    ];
  };
}