{ self, inputs, ... }:
let
  defaultCaUrl = "https://janus.john-stream.com/";
  defaultFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
  defaultRoot = ../hosts/janus/public/root_ca.crt;

  mkStepBootstrap = { pkgs, caUrl, fingerprint, install ? false }:
    (inputs.self.wrappers.stepBootstrap.apply {
      inherit pkgs install;
      ca-url = caUrl;
      inherit fingerprint;
    }).wrapper;

  mkDefaultsText = cfg: builtins.toJSON {
    ca-url = cfg.caUrl;
    fingerprint = cfg.fingerprint;
    root = cfg.root;
  };
in
{
  flake.modules.nixos.step-client = { config, pkgs, lib, ... }:
    let
      cfg = config."step-client";
    in
    {
      options."step-client" = {
        enable = lib.mkOption {
          description = "Enable step-ca client bootstrap";
          type = lib.types.bool;
          default = true;
        };

        caUrl = lib.mkOption {
          description = "The step-ca URL used for bootstrap and renewal.";
          type = lib.types.str;
          default = defaultCaUrl;
        };

        fingerprint = lib.mkOption {
          description = "The SHA256 fingerprint of the step-ca root certificate.";
          type = lib.types.str;
          default = defaultFingerprint;
        };

        root = lib.mkOption {
          description = "The step-ca root certificate used for bootstrap.";
          type = lib.types.path;
          default = defaultRoot;
        };

        certDir = lib.mkOption {
          description = "Directory used to store root CA material for mTLS and step bootstrap.";
          type = lib.types.str;
          default = "/etc/step-ca/certs";
        };
      };

      config = lib.mkIf cfg.enable {
        environment.systemPackages = [
          (mkStepBootstrap {
            inherit pkgs;
            caUrl = cfg.caUrl;
            fingerprint = cfg.fingerprint;
          })
        ];

        environment.etc."step-ca/defaults.json".text = mkDefaultsText cfg;

        systemd.tmpfiles.rules = [
          "d ${cfg.certDir} 0750 root root -"
          "L+ ${cfg.certDir}/root_ca.crt - - - - ${cfg.root}"
          "d /root/.step 0700 root root -"
          "d /root/.step/config 0700 root root -"
          "d /root/.step/certs 0700 root root -"
          "L+ /root/.step/config/defaults.json - - - - /etc/step-ca/defaults.json"
          "L+ /root/.step/certs/root_ca.crt - - - - ${cfg.certDir}/root_ca.crt"
        ];
      };
    };

  flake.modules.homeManager.step-client = { config, pkgs, lib, ... }:
    let
      cfg = config."step-client";
    in
    {
      options."step-client" = {
        enable = lib.mkOption {
          description = "Enable step-ca client bootstrap";
          type = lib.types.bool;
          default = true;
        };

        caUrl = lib.mkOption {
          description = "The step-ca URL used for bootstrap and renewal.";
          type = lib.types.str;
          default = defaultCaUrl;
        };

        fingerprint = lib.mkOption {
          description = "The SHA256 fingerprint of the step-ca root certificate.";
          type = lib.types.str;
          default = defaultFingerprint;
        };

        root = lib.mkOption {
          description = "The step-ca root certificate used for bootstrap.";
          type = lib.types.path;
          default = defaultRoot;
        };

        certDir = lib.mkOption {
          description = "Directory used to store root CA material for mTLS and step bootstrap.";
          type = lib.types.str;
          default = "${config.home.homeDirectory}/.step/certs";
        };
      };

      config = lib.mkIf cfg.enable (
        let
          certDirPath = lib.removePrefix "${config.home.homeDirectory}/" cfg.certDir;
        in
        {
        home.packages = [
          (mkStepBootstrap {
            inherit pkgs;
            caUrl = cfg.caUrl;
            fingerprint = cfg.fingerprint;
          })
        ];

        home.file.".step/config/defaults.json".text = mkDefaultsText cfg;
        home.file."${certDirPath}/root_ca.crt".source = cfg.root;
        }
      );
    };

  perSystem = { system, pkgs, lib, ... }: {
    packages.step-bootstrap = mkStepBootstrap {
      inherit pkgs;
      caUrl = defaultCaUrl;
      fingerprint = defaultFingerprint;
      install = true;
    };
  };

  flake.wrappers.stepBootstrap = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      ca-url = lib.mkOption {
        type = lib.types.str;
      };
      fingerprint = lib.mkOption {
        type = lib.types.str;
      };
      install = lib.mkEnableOption "Install the cert to the system trust store";
    };

    config = {
      binName = "step-bootstrap";
      package = config.pkgs.step-cli;
      args = [
        "ca" "bootstrap"
        "--ca-url" config.ca-url
        "--fingerprint" config.fingerprint
      ]
      ++ lib.optional config.install "--install";
    };
  });
}