dendritic/modules/programs/sops.nix

{ inputs, ... }:
let
  inputs' = inputs;  # save a reference before it's shadowed
in
{
  flake-file.inputs = {
    # Adding sops-nix to the flake-file inputs causes it to get added to the inputs in flake.nix when it gets generated.
    # This also makes the sops-nix module available
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
  };

  flake.modules.nixos.mysops = {
    imports = [ inputs.sops-nix.nixosModules.sops ];
  };

  # Define the homeModules that are used by flake-parts
  # https://flake.parts/options/home-manager.html#opt-flake.modules.homeManager
  flake.modules.homeManager.mysops = { inputs, config, pkgs, lib, ... }:
  let
    cfg = config.mysops;
    sopsBin = lib.getExe pkgs.sops;
    sopsConfigPath = ../../.sops.yaml;
    sopsSecretsPath = ../../keys/secrets.yaml;

    editScript = lib.optional (cfg.hostSecretFile != null) (pkgs.writeShellScriptBin  "edit-secrets" ''
      ${sopsBin} --config ${sopsConfigPath} ${cfg.hostSecretFile}
    '');
  in
  {
    imports = [
      # This import makes the sops config attribute available below
      inputs'.sops-nix.homeManagerModules.sops
    ];

    options.mysops = {
      ageKeyFile = lib.mkOption {
        description = "Default location for the age key";
        type = lib.types.str;
        default = "${config.xdg.configHome}/sops/age/keys.txt";
      };
      hostSecretFile = lib.mkOption {
        description = "Path to the secrets file for this host. Used to create the edit-secrets script";
        type = lib.types.nullOr lib.types.str;
        default = null;
      };
    };

    config =
    let
      echo = lib.getExe' pkgs.coreutils "echo";
      dirname = lib.getExe' pkgs.coreutils "dirname";
      mkdir = lib.getExe' pkgs.coreutils "mkdir";
      show-age-key = (pkgs.writeShellScriptBin "show-age-key" ''
        ${lib.getExe' pkgs.age "age-keygen"} -y ${cfg.ageKeyFile}
      '');
    in
    {
      home.packages = with pkgs; [
        age
        sops # This is necessary to make the sops binary available
        ssh-to-age
        (writeShellScriptBin "gen-age-key" ''
          set -eu

          if [ ! -f "${config.ssh.identityFile}" ]; then
            ${echo} "SSH identity file not found: ${config.ssh.identityFile}" >&2
            exit 1
          fi

          if [ -e "${cfg.ageKeyFile}" ]; then
            ${echo} "Refusing to overwrite existing age key file: ${cfg.ageKeyFile}" >&2
            exit 1
          fi

          ${mkdir} -p "$(${dirname} "${cfg.ageKeyFile}")"
          ${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.identityFile} -private-key > ${cfg.ageKeyFile}
          ${echo} -n "Created ${cfg.ageKeyFile}: "
          ${echo} $(${lib.getExe show-age-key})
        '')
        show-age-key
        (writeShellScriptBin "ls-secrets" "${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
      ] ++ editScript;

      home.shellAliases.sops = "${sopsBin} --config ${sopsConfigPath}";

      # Option definitions for the sops home-manager module:
      # https://github.com/Mic92/sops-nix/blob/master/modules/home-manager/sops.nix
      sops = {
        defaultSopsFile = sopsSecretsPath;
        defaultSopsFormat = "yaml";
        age.sshKeyPaths = [ "${config.ssh.identityFile}" ];
      };
    };
  };
}