{ inputs, ... }:
let
  inputs' = inputs;  # save a reference before it's shadowed
in
{
  flake-file.inputs = {
    # Adding sops-nix to the flake-file inputs causes it to get added to the inputs in flake.nix when it gets generated.
    # This also makes the sops-nix module available
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
  };
  
  # Define the homeModules that are used by flake-parts
  # https://flake.parts/options/home-manager.html#opt-flake.homeModules
  flake.homeModules.sops = { inputs, config, pkgs, lib, ... }:
  let
    sopsBin = lib.getExe pkgs.sops;
    sopsConfigPath = ../../.sops.yaml;
    sopsSecretsPath = ../../keys/secrets.yaml;
    ageKeyFile = "${config.xdg.configHome}/sops/age/keys.txt";
  in
  {
    home.packages = with pkgs; [
      eza
      age
      sops # This is necessary to make the sops binary available
      ssh-to-age
      (writeShellScriptBin "gen-age-key" ''
        ${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.IdentityFile} -private-key > ${ageKeyFile}
        echo -n "Created ${ageKeyFile}: "
        echo $(show-age-key)
      '')
      (writeShellScriptBin "show-age-key" "exec ${lib.getExe' pkgs.age "age-keygen"} -y ${ageKeyFile}")
      (writeShellScriptBin "edit-secrets" "exec ${sopsBin} --config ${sopsConfigPath} ${sopsSecretsPath}")
      (writeShellScriptBin "ls-secrets" "exec ${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
    ];

    programs.zsh.shellAliases.sops = "exec ${sopsBin} --config ${sopsConfigPath}";

    imports = [
      # This import makes the sops config attribute available below
      inputs'.sops-nix.homeManagerModules.sops
    ];

    home.sessionVariables = {
      GMAIL_CREDS_PATH = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
    };

    # Option definitions for the sops home-manager module:
    # https://github.com/Mic92/sops-nix/blob/master/modules/home-manager/sops.nix
    sops = {
      defaultSopsFile = "${sopsSecretsPath}";
      defaultSopsFormat = "yaml";

      # Not sure any of these are necessary
      # age.sshKeyPaths = [ "${config.sshIdentityFile}" ];
      # age.keyFile = "${ageKeyFile}";
      # age.generateKey = true;

      # secrets."api/gmail_client_secret" = {
      #   path = "${config.xdg.configHome}/resticprofile/dendrite.txt";
      # };
      
      templates."gmail_creds" = {
        path = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
        content = ''
          {
              "installed": {
                  "bad: key,
                  "client_id": "499012320469-vtml6emu6bmujpsj9lud2b44jqu7h26j.apps.googleusercontent.com",
                  "project_id": "python-apis-423500",
                  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
                  "token_uri": "https://oauth2.googleapis.com/token",
                  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
                  "client_secret": "${config.sops.placeholder."api/gmail_client_secret"}",
                  "redirect_uris": [ "http://localhost" ]
              }
          }
        '';
      };
    };
  };
}