{ pkgs, ... }:

let
 script = ''
 set -euo pipefail

 # Wenn dein NixOS-Repo nicht in /etc/nixos liegt, diesen Pfad hier anpassen.
 repo_root="/etc/nixos"

 # Das muss zum Namen in flake.nix unter nixosConfigurations.<name> passen.
 flake_target="template"
 rebuild_mode="switch"
 update_inputs=false
 dry_run=false
 needs_sudo=false

 usage() {
 cat <<'EOF'
Usage: nixos-update [switch|boot] [update-inputs] [dry-run]

Syncs this repo and rebuilds NixOS from the local flake config.

Arguments:
 switch Build and activate the new system immediately
 boot Build and activate for next boot instead of switching now
 update-inputs Run `nix flake update` before rebuilding
 dry-run Show commands without executing them
 help Show this help
EOF
 }

 while [[ $# -gt 0 ]]; do
 case "$1" in
 update-inputs)
 update_inputs=true
 ;;
 switch)
 rebuild_mode="switch"
 ;;
 boot)
 rebuild_mode="boot"
 ;;
 dry-run)
 dry_run=true
 ;;
 help|-h|--help)
 usage
 exit 0
 ;;
 *)
 echo "Unknown option: $1" >&2
 usage >&2
 exit 1
 ;;
 esac
 shift
 done

 step() {
 printf '\n==> %s\n' "$1"
 }

 print_command() {
 printf ' $'
 printf ' %q' "$@"
 printf '\n'
 }

 run() {
 print_command "$@"

 if [[ "$dry_run" == true ]]; then
 return 0
 fi

 "$@"
 }

 run_repo() {
 if [[ "$needs_sudo" == true ]]; then
 run sudo "$@"
 else
 run "$@"
 fi
 }

 echo "Repo: $repo_root"
 echo "Flake target: $flake_target"
 echo "Rebuild mode: $rebuild_mode"

 if [[ ! -d "$repo_root" ]]; then
 echo "Repo path does not exist: $repo_root" >&2
 echo "Adjust repo_root in modules/updater.nix or move the repo to that path." >&2
 exit 1
 fi

 if [[ ! -w "$repo_root" ]]; then
 needs_sudo=true
 fi

 if [[ "$needs_sudo" == true ]]; then
 echo "Repo ist nicht als normaler Benutzer beschreibbar. Git- und Flake-Befehle laufen mit sudo."
 step "Prüfe sudo"
 run sudo -v
 fi

 step "Wechsle ins Repo"
 print_command cd "$repo_root"
 cd "$repo_root"

 if [[ "$needs_sudo" == true ]]; then
 git_check=(sudo git rev-parse --is-inside-work-tree)
 else
 git_check=(git rev-parse --is-inside-work-tree)
 fi

 if ! "''${git_check[@]}" >/dev/null 2>&1; then
 echo "Repo path is not a Git repository: $repo_root" >&2
 echo "Clone your config repo there or adjust repo_root in modules/updater.nix." >&2
 exit 1
 fi

 if ! run_repo git diff --quiet || ! run_repo git diff --cached --quiet; then
 echo "Working tree has local changes. git pull may fail if upstream changed the same files."
 fi

 step "Aktualisiere Git-Repo"
 run_repo git pull --ff-only

 if [[ "$update_inputs" == true ]]; then
 step "Aktualisiere Flake-Inputs"
 run_repo nix flake update
 fi

 step "Prüfe sudo für den NixOS-Rebuild"
 run sudo -v

 step "Starte nixos-rebuild"
 run sudo nixos-rebuild "$rebuild_mode" --flake "$repo_root#$flake_target"
 '';

 nixosUpdate = pkgs.writeShellScriptBin "nixos-update" script;

 updateNixosCompat = pkgs.writeShellScriptBin "update-nixos" ''
 exec ${nixosUpdate}/bin/nixos-update "$@"
 '';

 nixosSyncCompat = pkgs.writeShellScriptBin "nixos-sync" ''
 exec ${nixosUpdate}/bin/nixos-update "$@"
 '';
in

{
 environment.systemPackages = [
 nixosUpdate
 nixosSyncCompat
 updateNixosCompat
 ];
}