{ pkgs, lib, config, ... }:
with builtins;
with lib;
let cfg = config.security.systemd-creds; in
{
  options.security.systemd-creds = {
    target = mkOption {
      type = types.str;
      description = ''
        Destination address of the target host able to encrypt the credentials.
        Used by the default {option}`security.systemd-creds.shell`.
      '';
      default = "root@${config.networking.hostName}.${config.networking.domain}";
      defaultText = mdLiteral "root@\${config.networking.hostName}.\${config.networking.domain}";
      example = mdLiteral "''${config.networking.hostName}.wg";
    };
    decrypt = mkOption {
      type = with types; listOf str;
      description = mdDoc ''
        Command to get the cleartext of a credential.
        `credBase` is derived from the path of the credential in `LoadCredentialEncrypted=`,
        by removing the `storeDir` prefix and then one directory level if any,
        and then the `.cred` suffix if any.
      '';
      apply = concatStringsSep " ";
      default = [ "gpg" "--batch" "--decrypt" "\${credBase}.gpg" ];
      example = [ "pass" "\${credBase}" ];
    };
    shell = mkOption {
      type = with types; listOf str;
      description = mdDoc ''
        Command to get a shell on the target host.
      '';
      apply = concatStringsSep " ";
      default = [
        "ssh" "-o" "StrictHostKeyChecking=yes"
        "-o" "ControlMaster=auto"
        "-o" "ControlPersist=16s"
        "\"\${SYSTEMD_CREDS_TARGET:-${cfg.target}}\""
      ];
      defaultText = mdLiteral ''
        ssh -o StrictHostKeyChecking=yes \
            -o ControlMaster=auto \
            -o ControlPersist=16s \
            \"''${SYSTEMD_CREDS_TARGET:-root@''${config.security.systemd-creds.target}}\"
      '';
      example = [ "sudo" ];
    };
    encrypt = mkOption {
      type = with types; listOf str;
      description = mdDoc ''
        Command to run `systemd-creds encrypt` on the target host.
      '';
      apply = concatStringsSep " ";
      default = [ "systemd-creds" "encrypt" "--name" "\"$credID\"" "--with-key=auto" ];
      example = ["sudo" "systemd-creds" "encrypt" "--with-key=host"];
    };
    install = mkOption {
      type = with types; listOf str;
      apply = concatStringsSep " ";
      description = mdDoc ''
        Command to install the encrypted credential on the orchestrating host.
      '';
      default = [ "install" "-D" "-m" "640" "/dev/stdin" "\"$credBase\".cred" ];
    };
    script = mkOption {
      type = types.lines;
      apply = pkgs.writeShellScriptBin "systemd-creds-encrypt-${replaceStrings ["@"] ["-"] cfg.target}";
      description = mdDoc ''
        Encrypt credentials referenced in the `LoadCredentialEncrypted=`
        of enabled systemd services, by running `systemd-creds` on the {option}`security.systemd-creds.target` host.
        Only *existing* and *empty* credential files, are considered.
        Recursively if the credential path is a directory.
        Note that when using flakes, the sandboxing requires those empty files to be added to Git beforehand.

        Example of use:
        ```console
        $ sudo wg genkey | gpg --encrypt --sign --recipient @$USER wireguard/wg-intra/privateKey.cred --output wireguard/wg-intra/privateKey.gpg
        $ tee </dev/null >wireguard/wg-intra/privateKey.cred
        $ git add wireguard/wg-intra/privateKey.cred
        ```

        ```nix
        systemd.services."wireguard-wg-intra".serviceConfig.LoadCredentialEncrypted =
          [ "privateKey:''${wireguard/wg-intra/privateKey.cred}" ];
        ```

        ```console
        $ nix run .#nixosConfigurations.''${hostName}.config.security.systemd-creds.script
        $ git add wireguard/wg-intra/privateKey.cred
        ```
      '';
    };
  };
  config = {
    security.systemd-creds.script = ''
      shopt -s extglob globstar nullglob
      set -o pipefail
      set -eux
      '' + concatMapStringsSep "\n"
        (service:
          concatMapStringsSep "\n"
            (credential: let
              cred = splitString ":" credential;
              credID = elemAt cred 0;
              credPath = elemAt cred 1;
            in ''
              credID=${escapeShellArg credID}
              credPath=${escapeShellArg credPath}
              if test -f "$credPath" -a ! -s "$credPath"; then
                credBase=''${credPath#${storeDir}/}
                credBase=''${credBase#*/}
                credBase=''${credBase%.cred}
                { ${cfg.decrypt}; } |
                { ${cfg.shell} -- ${cfg.encrypt} - -; } |
                { ${cfg.install}; }
              elif test -d "$credPath"; then
                for credPath in "$credPath"/**(.); do
                  if test ! -s "$credPath"; then
                    credBase=''${credPath#${storeDir}/}
                    credBase=''${credBase#*-}
                    credBase=''${credBase%.cred}
                    { ${cfg.decrypt}; } |
                    { ${cfg.shell} -- ${cfg.encrypt} - -; } |
                    { ${cfg.install}; }
                  fi
                done
              fi
            ''
            )
            service.serviceConfig.LoadCredentialEncrypted)
        (attrValues
          (filterAttrs (serviceName: service:
            service.enable &&
            hasAttr "LoadCredentialEncrypted" service.serviceConfig
            ) config.systemd.services
          )
        );
  };
}