{ config, pkgs, ... }:

let
  thisDir = ./.;

  unlocker = pkgs.writeScriptBin "unlocker" ''
    #!${pkgs.bash}/bin/bash
    set -euo pipefail
    if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
      install -m 600 /dev/null /run/secrets.env
      ${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age" > /run/secrets.env
    fi

    mkdir -p /run/secrets/gpg

    if [[ -f "${thisDir}/gpg.age" ]]; then
      ${pkgs.age}/bin/age -d \
        -i "${config.users.users."me".home}/.ssh/id_ed25519" \
        "${thisDir}/gpg.age" | \
        ${pkgs.gnupg}/bin/gpg --homedir /run/secrets/gpg --import
    fi

    chown -R me:users /run/secrets/gpg
    chmod -R 700 /run/secrets/gpg
  '';
in
{
  environment.systemPackages = [ unlocker ];

  systemd.services.unlocker = {
    description = "Secrets manager";
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      User = "root";
      RemainAfterExit = true;
    };
    script = "${unlocker}/bin/unlocker";
  };
}