{ config, lib, pkgs, ... }:

let
  cfg = config.services.gebos.secrets;
  secretsFile = ../secrets/secrets.yaml;
  hasSecrets = builtins.pathExists secretsFile;

  # Map from logical group → list of secret keys in secrets.yaml.
  # Keys are flat (e.g. "supabase_jwt_secret") so .sops.yaml regex rules can
  # filter per-host without nested-path footguns.
  supabaseKeys = [
    "supabase_postgres_password"
    "supabase_jwt_secret"
    "supabase_anon_key"
    "supabase_service_role_key"
    "supabase_dashboard_password"
  ];
  ingesterKeys = [ "ingester_postgres_password" ];
  postgresAdminKeys = [ "postgres_admin_password" ];

  # Render an env file body from a list of (key, envVarName) pairs.
  envBody = pairs: lib.concatStringsSep "\n" (map
    ({ key, var }: "${var}=${config.sops.placeholder.${key}}")
    pairs);

  enabledPairs =
    lib.optionals cfg.supabase [
      { key = "supabase_postgres_password";   var = "POSTGRES_PASSWORD"; }
      { key = "supabase_jwt_secret";          var = "JWT_SECRET"; }
      { key = "supabase_anon_key";            var = "ANON_KEY"; }
      { key = "supabase_service_role_key";    var = "SERVICE_ROLE_KEY"; }
      { key = "supabase_dashboard_password";  var = "DASHBOARD_PASSWORD"; }
    ]
    ++ lib.optionals cfg.ingester [
      { key = "ingester_postgres_password";   var = "GEBOS_POSTGRES_PASSWORD"; }
    ]
    ++ lib.optionals cfg.postgresAdmin [
      { key = "postgres_admin_password";      var = "POSTGRES_ADMIN_PASSWORD"; }
    ];

  enabledKeys =
       lib.optionals cfg.supabase      supabaseKeys
    ++ lib.optionals cfg.ingester      ingesterKeys
    ++ lib.optionals cfg.postgresAdmin postgresAdminKeys;
in
{
  options.services.gebos.secrets = {
    supabase = lib.mkEnableOption ''
      Supabase compose stack secrets: POSTGRES_PASSWORD, JWT_SECRET, ANON_KEY,
      SERVICE_ROLE_KEY, DASHBOARD_PASSWORD.'';

    ingester = lib.mkEnableOption ''
      Ingester DB password: GEBOS_POSTGRES_PASSWORD (for the gebos_ingest role).'';

    postgresAdmin = lib.mkEnableOption ''
      Postgres bootstrap admin password applied via a one-shot ALTER ROLE unit.'';

    envFile = lib.mkOption {
      type = lib.types.path;
      readOnly = true;
      description = ''
        Path of the rendered env file consumed by service units' EnvironmentFile=.
        Resolves to the sops-templated file under /run/secrets when sops material
        is present, or to a baked-in dev-defaults file otherwise (so first-boot
        eval and local NixOS VMs work without any secrets bootstrap).
      '';
      default =
        if hasSecrets
        then config.sops.templates."gebos-env".path
        else "${pkgs.writeText "gebos-env-dev-defaults" (
          # Dev fallback. Never used in prod — overridden once secrets.yaml exists.
          lib.concatStringsSep "\n" (map ({ var, ... }: "${var}=dev-${var}") enabledPairs)
        )}";
    };
  };

  config = lib.mkIf hasSecrets {
    sops = {
      defaultSopsFile = secretsFile;
      # Derive each host's age identity from its existing ssh host key.
      # No extra key material to provision — ssh-to-age handles conversion.
      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

      secrets = lib.listToAttrs (map
        (key: { name = key; value = { }; })
        enabledKeys);

      templates."gebos-env" = lib.mkIf (enabledPairs != []) {
        content = envBody enabledPairs;
        mode = "0400";
        owner = "root";
      };
    };
  };
}