dendritic/modules/programs/sops.nix

{ inputs, ... }:
let
  inputs' = inputs;  # save a reference before it's shadowed
in
{
  flake-file.inputs = {
    # Adding sops-nix to the flake-file inputs causes it to get added to the inputs in flake.nix when it gets generated.
    # This also makes the sops-nix module available
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
  };

  flake.modules.nixos.mysops = {
    imports = [ inputs.sops-nix.nixosModules.sops ];
    # sops.defaultSopsFile = ../../keys/secrets.yaml;
  };

  # Define the homeModules that are used by flake-parts
  # https://flake.parts/options/home-manager.html#opt-flake.modules.homeManager
  flake.modules.homeManager.mysops = { inputs, config, pkgs, lib, ... }:
  let
    cfg = config.mysops;
    sopsBin = lib.getExe pkgs.sops;
    sopsConfigPath = ../../.sops.yaml;
    sopsSecretsPath = ../../keys/secrets.yaml;
    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
  in
  {
    imports = [
      # This import makes the sops config attribute available below
      inputs'.sops-nix.homeManagerModules.sops
    ];

    options.mysops = {
      enable = lib.mkEnableOption "Customized SOPS tools";
      ageKeyFile = lib.mkOption {
        description = "Default location for the age key";
        type = lib.types.str;
        default = "${config.xdg.configHome}/sops/age/keys.txt";
      };
      hostSecretFile = lib.mkOption {
        description = "Path to the secrets file for this host";
        type = lib.types.nullOr lib.types.str;
        default = null;
      };
    };

    config = {
      home.packages = with pkgs; [
        eza
        age
        sops # This is necessary to make the sops binary available
        ssh-to-age
        (writeShellScriptBin "gen-age-key" ''
          set -eu

          if [ ! -f "${config.ssh.IdentityFile}" ]; then
            echo "SSH identity file not found: ${config.ssh.IdentityFile}" >&2
            exit 1
          fi

          if [ -e "${cfg.ageKeyFile}" ]; then
            echo "Refusing to overwrite existing age key file: ${cfg.ageKeyFile}" >&2
            exit 1
          fi

          mkdir -p "$(dirname "${cfg.ageKeyFile}")"
          ${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.IdentityFile} -private-key > ${cfg.ageKeyFile}
          echo -n "Created ${cfg.ageKeyFile}: "
          echo $(show-age-key)
        '')
        (writeShellScriptBin "show-age-key" "${lib.getExe' pkgs.age "age-keygen"} -y ${cfg.ageKeyFile}")
        (writeShellScriptBin "ls-secrets" "${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
      ] ++ lib.optional (cfg.hostSecretFile != null) (writeShellScriptBin "edit-secrets" ''
        set -e
        ${sopsBin} --config ${sopsConfigPath} ${cfg.hostSecretFile}
      '');

      home.shellAliases.sops = "${sopsBin} --config ${sopsConfigPath}";

      # Option definitions for the sops home-manager module:
      # https://github.com/Mic92/sops-nix/blob/master/modules/home-manager/sops.nix
      sops = {
        # defaultSopsFile = sopsSecretsPath;
        defaultSopsFormat = "yaml";
        age.sshKeyPaths = [ "${config.ssh.IdentityFile}" ];
      };
    };
  };
}