{ self, inputs, ... }:
let
  mkPrincipalArgs = principals:
    builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
in
{
  flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      provisioner = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = "admin";
      };
      provisionerPasswordFile = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
      };
      extraPrincipals = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
      };
      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
    };

    config = {
      binName = "ssh-host-cert-sign";
      package = config.pkgs.step-cli;
      extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
      preHook = ''
        HOSTNAME=$(hostname -s)
        IP_ADDRESS=$(ip -4 -o addr show scope global | while read -r _ _ _ addr _; do
          case "$addr" in
            192.168.1.*/*)
              printf '%s\n' "''${addr%%/*}"
              break
              ;;
          esac
        done)
        echo "Signing SSH host cert for $HOSTNAME at $IP_ADDRESS"
      '';
      args =
        [
          "ssh" "certificate"
          "--host" "--sign"
          "--principal" "$HOSTNAME"
          "--principal" "$IP_ADDRESS"
        ]
        ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
        ++ lib.optionals (config.provisionerPasswordFile != null) [
          "--provisioner-password-file" "${config.provisionerPasswordFile}"
        ]
        ++ lib.optionals config.overwrite [ "-f" ]
        ++ mkPrincipalArgs config.extraPrincipals;
    };
  });

  flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      sshHostKeyFile = lib.mkOption {
        type = lib.types.str;
        default = "/etc/ssh/ssh_host_ed25519_key";
      };
      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
    };

    config = {
      binName = "ssh-host-cert-renew";
      package = config.pkgs.step-cli;
      extraPackages = with config.pkgs; [ systemd ];
      args =
        [ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ]
        ++ lib.optionals config.overwrite [ "-f" ];
    };
  });

  flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      certPath = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = "/etc/ssh/ssh_host_ed25519_key-cert.pub";
      };
    };

    config = {
      binName = "ssh-host-cert-check";
      package = config.pkgs.openssh;
      exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
      args = [ "-Lf" "${config.certPath}" ];
    };
  });

  flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      provisioner = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = "admin";
      };
      provisionerPasswordFile = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
      };
      validUsers = lib.mkOption {
        description = "A list of the user names that this cert will be valid for";
        type = lib.types.listOf lib.types.str;
        default = [ ];
      };
      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
    };

    config = {
      binName = "ssh-user-cert-sign";
      package = config.pkgs.step-cli;
      args = [ "ssh" "certificate" "--sign" ]
        ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
        ++ lib.optionals (config.provisionerPasswordFile != null) [
          "--provisioner-password-file" "${config.provisionerPasswordFile}"
        ]
        ++ lib.optionals config.overwrite [ "-f" ]
        ++ mkPrincipalArgs config.validUsers;
    };
  });

  flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      certPath = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = "$HOME/.ssh/id_ed25519-cert.pub";
      };
    };

    config = {
      binName = "ssh-user-cert-check";
      package = config.pkgs.openssh;
      exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
      args = [ "-Lf" "${config.certPath}" ];
    };
  });

  flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
    options = {
      certPath = lib.mkOption {
        type = lib.types.nullOr lib.types.str;
        default = "$HOME/.ssh/id_ed25519-cert.pub";
      };
      expires-in = lib.mkOption {
        type = lib.types.str;
        default = "4h";
      };
    };
    config = {
      binName = "ssh-renewal-check";
      package = config.pkgs.step-cli;
      preHook = ''
        echo "Checking SSH cert at ${config.certPath}"
      '';
      args = [
        "ssh" "needs-renewal" "${config.certPath}"
        "--expires-in" "${config.expires-in}"
      ];
    };
  });
}