{ self, inputs, ... }:
let
  bootstrapWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      caURL = lib.mkOption {
        type = lib.types.str;
      };
      fingerprint = lib.mkOption {
        type = lib.types.str;
      };
      install = lib.mkEnableOption "Install the cert to the system trust store";
    };

    config = {
      binName = "bootstrap";
      package = config.pkgs.step-cli; # (1)!
      args = [
        "ca" "bootstrap"
        "--ca-url" config.caURL
        "--fingerprint" config.fingerprint
      ];
    };
  });

  mkPrincipalArgs = principals:
    builtins.concatLists (map (principal: [ "--principal" principal ]) principals);

  signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      provisioner = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = "admin";
      };
      extraPrincipals = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
      };
      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
    };

    config = {
      binName = "sign-ssh-host-cert";
      package = config.pkgs.step-cli;
      extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
      preHook = ''
        HOSTNAME=$(hostname -s)
        IP_ADDRESS=$(ip -4 -o addr show scope global | while read -r _ _ _ addr _; do
          case "$addr" in
            192.168.1.*/*)
              printf '%s\n' "''${addr%%/*}"
              break
              ;;
          esac
        done)
        echo "Signing SSH host cert for $HOSTNAME at $IP_ADDRESS"
      '';
      args =
        [
          "ssh" "certificate"
          "--host" "--sign"
          "--principal" "$HOSTNAME"
          "--principal" "$IP_ADDRESS"
        ]
        ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
        ++ lib.optionals config.overwrite [ "-f" ]
        ++ mkPrincipalArgs config.extraPrincipals;
      postHook = ''
        systemctl reload-or-restart sshd
      '';
    };
  });
in
{
  perSystem = { system, self', pkgs, lib, ... }: {
    packages.step-client = inputs.wrappers.lib.wrapPackage {
      inherit pkgs;
      package = (pkgs.symlinkJoin {
        name = "step";
        meta.mainProgram = "step";
        paths = with pkgs; [
          self'.packages.step-bootstrap
          (signHostWrapper.apply {
            inherit pkgs;
            provisioner = "admin";
            overwrite = true;
            # extraPrincipals = [ "home-pc" ];
          }).wrapper
        ];
      });
    };

    packages.step-bootstrap = (bootstrapWrapper.apply {
      inherit pkgs;
      caURL = "https://janus.john-stream.com";
      fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
      install = true;
    }).wrapper;
  };
}