{ config, pkgs, ... }:

let
  thisDir = ./.;

  unlocker = pkgs.writeScriptBin "unlocker" ''
    #!${pkgs.bash}/bin/bash
    set -euo pipefail
    if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
      ${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age" > /run/secrets.env
    fi
  '';
in
{
  environment.systemPackages = [ unlocker ];

  systemd.services.unlocker = {
    description = "Secrets manager";
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      User = "root";
      RemainAfterExit = true;
    };
    script = "${unlocker}/bin/unlocker";
  };
}