{ self, inputs, lib, config, ... }:
let
  mtlsConfigModule = config.optionModules.mtls;
  mkSANArgs = sans: builtins.concatLists (map (name: [ "--san" name ]) sans);
in
{
  flake.wrappers.mtls = {
    generate = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
      imports = [ mtlsConfigModule ];
      config = {
        binName = "mtls-generate";
        package = config.pkgs.step-cli;
        extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
        preHook = "mkdir -p ${config.certDir}";
        args = [
          "ca" "certificate"
          "${config.subject}" "${config.certFile}" "${config.keyFile}"
          "--not-before" "-5m"
          "--not-after" "24h"
        ]
        ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
        ++ lib.optionals (config.provisionerPasswordFile != null) [
          "--provisioner-password-file" "${config.provisionerPasswordFile}"
        ]
        ++ lib.optionals config.overwrite [ "-f" ]
        ++ mkSANArgs config.SANs;
        postHook = ''
          (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
        '';
      };
    });

    renew = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
      # https://github.com/Lassulus/wrappers#generating-systemd-services
      imports = [
        wlib.modules.systemd mtlsConfigModule
        mtlsConfigModule
      ];
      config = {
        binName = "mtls-renew";
        package = config.pkgs.step-cli;
        extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
        args = [
          "ca" "renew"
          "${config.certFile}" "${config.keyFile}"
        ];
        postHook = ''
          (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
        '';

        systemd = {
          description = "Renew the mTLS certificate when Smallstep marks it ready";
          documentation = [
            "https://smallstep.com/docs/step-ca/certificate-authority-server-production"
          ];
          startLimitIntervalSec = 0;
          after = [ "network-online.target" ];
          wants = [ "network-online.target" ];
          serviceConfig = {
            Type = lib.mkDefault "oneshot";
            ExecCondition = "${lib.getExe config.pkgs.step-cli} certificate needs-renewal ${config.certFile}";
          };
          startAt = "hourly";
        };
      };
    });

    check = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
      imports = [ mtlsConfigModule ];
      config = {
        binName = "mtls-check";
        # This pattern is necessary to wrap packages like openssl that provide more than one binary
        package = config.pkgs.symlinkJoin {
          name = "openssl";
          paths = [ config.pkgs.openssl.bin config.pkgs.openssl.man ];
          meta.mainProgram = "openssl";
        };
        args = [
          "x509"
          "-noout"
          "-in" config.bundleFile
          "-subject"
          "-issuer"
          "-ext" "subjectAltName,extendedKeyUsage"
          "-enddate"
        ];
      };
    });
  };
}