# { pkgs ? import <nixpkgs> {} }:

# taken from
# https://git.clerie.de/clerie/nixfiles/src/branch/master/secrets.nix

# nix eval --impure --expr 'import ./secrets.nix'

# As we're generating the secret.nix, we have a bootstrapping problem:
# agenix assumes that the to be generated secret is present in the
# secret.nix file, but we've not created it yet.
# Due to this, we've got a "new" file in the secrets directory that can be used
# and renamed afterwards

let
  pubkeysFor =
    directory:
    let
      instances = builtins.attrNames (builtins.readDir directory);
      instancesWithPubkey = builtins.filter (
        i: builtins.pathExists (directory + "/${i}/ssh.pub")
      ) instances;
    in
    builtins.listToAttrs (
      # map (i: { name = i; value = builtins.readFile (directory + "/${i}/ssh.pub"); }
      map (i: {
        name = i;
        value = (import (directory + "/${i}/")).sshKey;
      }) instancesWithPubkey
    );

  hosts = pubkeysFor ./nix/hosts;
  users = pubkeysFor ./nix/users;

  secretsForHost =
    hostname:
    let

      secretFiles = builtins.attrNames (builtins.readDir (./nix/hosts + "/${hostname}/secrets"));

      listOfSecrets = builtins.filter (
        i:
        (builtins.stringLength i) > 4
        && builtins.substring ((builtins.stringLength i) - 4) (builtins.stringLength i) i == ".age"
      ) secretFiles;

    in
    if
      builtins.pathExists (./nix/hosts + "/${hostname}/secrets")
      && builtins.pathExists (./nix/hosts + "/${hostname}/ssh.pub")
    then
      map (secret: {
        name = "nix/hosts/${hostname}/secrets/${secret}";
        value = {
          publicKeys = [
            users.emile
            hosts."${hostname}"
          ];
        };
      }) (listOfSecrets ++ [ "new" ])
    else
      [ ];
in
builtins.listToAttrs (
  builtins.concatMap (hostname: secretsForHost hostname) (
    builtins.attrNames (builtins.readDir ./nix/hosts)
  )
)