{ pkgs, ... }:

let
  # nixpkgs' rootless podman ships without /etc/containers config, so short
  # names (nginx:1.29-alpine) and the signature policy can't resolve. These are
  # the two files podman looks for under ~/.config/containers.
  registriesConf = pkgs.writeText "registries.conf" ''
    unqualified-search-registries = ["docker.io"]
  '';
  policyJson = pkgs.writeText "policy.json" ''
    { "default": [ { "type": "insecureAcceptAnything" } ] }
  '';
in
{
  # Static site — no language toolchain needed, just the image build.
  packages = [
    # --- build & ship the image ---
    pkgs.podman # `podman build -t git.0x29a.ch/aaron/website:1.0.0 .`
    #           # reads the Dockerfile natively; push with `podman push`.
  ];

  enterShell = ''
    # Seed rootless-podman config once, so `podman build` resolves short image
    # names and finds a signature policy. Never clobbers existing user config.
    conf="$HOME/.config/containers"
    if [ ! -e "$conf/registries.conf" ] || [ ! -e "$conf/policy.json" ]; then
      mkdir -p "$conf"
      [ -e "$conf/registries.conf" ] || install -m644 ${registriesConf} "$conf/registries.conf"
      [ -e "$conf/policy.json" ]     || install -m644 ${policyJson} "$conf/policy.json"
      echo "seeded rootless-podman config in $conf"
    fi

    # Persist registry logins. Rootless podman defaults to the volatile
    # $XDG_RUNTIME_DIR (wiped on reboot); point it at ~/.config so a single
    # `podman login git.0x29a.ch` survives reboots. The token lives in
    # auth.json (base64, outside the repo) — never committed.
    export REGISTRY_AUTH_FILE="$HOME/.config/containers/auth.json"

    echo "website devenv ready — build:  podman build -t git.0x29a.ch/aaron/website:1.0.0 ."
  '';
}