# Bootable installer ISO: the live system, `router-install` and the target
# system's closure. SSH is open to the target's root keys so secrets can be
# copied over (`scp -r secrets root@<installer>:`) before installing.
{
  config,
  lib,
  modulesPath,
  ...
}:
{
  imports = [
    (modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")
    ./install-script.nix
  ];

  isoImage.volumeID = "ROUTER_INSTALL";
  isoImage.squashfsCompression = "zstd -Xcompression-level 6";

  services.openssh = {
    enable = true;
    settings.PermitRootLogin = "prohibit-password";
  };

  users.motd =
    if config.router.installer.system != null then
      ''

        nixos-router installer
          1. (optional) scp -r secrets root@<this-host>:secrets
          2. router-install --secrets /root/secrets /dev/<disk>
        The disk is erased after confirmation.
      ''
    else
      ''

        nixos-router installer
          Run `sudo router-setup`: it asks a few questions, erases the chosen disk
          and installs the router. Everything else is set up in the web UI.
      '';
}