{pkgs, lib, config, ...}:
let inherit (builtins) toString;
    inherit (lib) types;
    inherit (config.services) x509;
in
{
options.services.x509 = {
  enable = lib.mkEnableOption "Configuration of one X.509 certificate";
  scheme = lib.mkOption {
    type        = types.enum [ "manual" "self-signed" "letsencrypt" ];
    default     = "self-signed";
    description = ''
      Scheme for X.509 material.
      
      manual:
        Use certificate and key manually copied on the target at certFile and keyFile.
      self-signed:
        Generate a self-signed certificate.
      letsencrypt:
        Generate a certificate signed by Let's Encrypt.
    '';
  };
  dir = lib.mkOption {
    type        = types.string;
    default     = "/var/x509";
    description = ''In "self-signed" scheme: directory of the certificate and key.'';
  };
  certFile = lib.mkOption {
    type        = types.path;
    example     = "/var/x509/cert.pem";
    description = ''In "manual" scheme: location of the certificate'';
  };
  keyFile = lib.mkOption {
    type        = types.path;
    example     = "/var/x509/key.pem";
    description = ''In "manual" scheme: location of the key file.'';
  };
  host = lib.mkOption {
    type    = types.nullOr types.string;
    default = config.networking.domain;
  };
  distributionHost = lib.mkOption {
    type    = types.string;
    default = config.networking.domain;
  };
  domains = lib.mkOption {
    type    = with types; listOf string;
    example = [ "example.coop" ];
    default = [];
  };
  days = lib.mkOption {
    type    = types.int;
    default = 3650;
  };
  keySize = lib.mkOption {
    type    = types.int;
    default = 4096;
  };
  cert = lib.mkOption {
    type    = types.string;
    default =
      if x509.scheme == "manual"
      then x509.certFile
      else if x509.scheme == "self-signed"
           then "${x509.dir}/${x509.host}.cert.self-signed.pem"
           else if x509.scheme == "letsencrypt"
                then "/var/lib/acme/${x509.host}/fullchain.pem"
                else throw ''Error: Certificate Scheme must be in [ "manual" "self-signed" "letsencrypt" ]'';
  };
  key = lib.mkOption {
    type    = types.string;
    default =
      if x509.scheme == "manual"
      then x509.keyFile
      else if x509.scheme == "self-signed"
           then "${x509.dir}/${x509.host}.key.pem"
            else if x509.scheme == "letsencrypt"
                 then "/var/lib/acme/${x509.host}/key.pem"
                 else throw ''Error: Certificate Scheme must be in [ "manual" "self-signed" "letsencrypt" ]'';
  };
  opensslConf = lib.mkOption {
    type  = (with types; attrsOf string);
    default = x509.opensslConf_common //
              x509.opensslConf_self-signed //
              x509.opensslConf_auth-signed //
              x509.opensslConf_user-cert;
    apply = cnf:
      pkgs.writeText "openssl.conf"
        (lib.concatStrings
          (lib.mapAttrsToList
            (title: body:
              (if title == "" then "" else "[ ${title} ]\n") +
              body)
            cnf));
  };
  opensslConf_common = lib.mkOption {
    type    = (with types; attrsOf string);
    default = {
      "" = ''
        RANDFILE    = /var/x509/openssl.rand
        oid_section = extra_oids
      '';
      extra_oids = ''
        # NOTE: only useful for Extended Validation (EV)
        jurisdictionOfIncorporationLocalityName        = 1.3.6.1.4.1.311.60.2.1.1
        jurisdictionOfIncorporationStateOrProvinceName = 1.3.6.1.4.1.311.60.2.1.2
        jurisdictionOfIncorporationCountryName         = 1.3.6.1.4.1.311.60.2.1.3
      '';
      req = ''
        prompt = no
        distinguished_name = distinguished_name
        string_mask = pkix
        #x509_extensions = root_extensions
        #req_extensions = extension
        #attributes = req_attributes
      '';
      distinguished_name = ''
        commonName = ${x509.host}
        #countryName =
        #stateOrProvinceName =
        #localityName =
        #"0.organizationName" =
        #organizationalUnitName =
        #businessCategory =
        #jurisdictionOfIncorporationLocalityName = $stateOrProvinceName
        #jurisdictionOfIncorporationStateOrProvinceName = $stateOrProvinceName
        #jurisdictionOfIncorporationCountryName = $countryName
      '';
    };
  };
  opensslConf_self-signed = lib.mkOption {
    type    = (with types; attrsOf string);
    default = {
      self_signed_extensions = ''
        basicConstraints       = critical,CA:TRUE,pathlen:0
        keyUsage               = keyCertSign,cRLSign,digitalSignature,keyEncipherment
        subjectAltName         = ${lib.concatMapStringsSep "," (dom: "DNS:${dom}") x509.domains}
        subjectKeyIdentifier   = hash
        issuerAltName          = issuer:copy
        authorityKeyIdentifier = keyid:always,issuer:always
        authorityInfoAccess    = caIssuers;URI:http://${x509.distributionHost}/x509/${x509.host}.cert.pem
        crlDistributionPoints  = URI:http://${x509.distributionHost}/x509/${x509.host}.crl.self-signed.pem
      '';
      self_signed_ca = ''
        dir         = ${x509.dir}/pub
        private_key = $dir/sec/key.pem
        crl_dir     = $dir
        crlnumber   = $dir/crl.self-signed.num
        crl         = $dir/crl.self-signed.pem
        database    = $dir/idx.self-signed.txt
      '';
    };
  };
  opensslConf_auth-signed = lib.mkOption {
    type    = (with types; attrsOf string);
    default = {
      auth_signed_extensions = ''
        basicConstraints       = critical,CA:FALSE
        keyUsage               = digitalSignature,keyEncipherment
        subjectAltName         = ${lib.concatMapStringsSep "," (dom: "DNS:${dom}") x509.domains}
        subjectKeyIdentifier   = hash
        issuerAltName          = issuer:copy
        authorityKeyIdentifier = keyid:always,issuer:always
        authorityInfoAccess    = caIssuers;URI:http://${x509.distributionHost}/x509/${x509.host}.cert.pem
        crlDistributionPoints  = URI:http://${x509.distributionHost}/x509/${x509.host}.crl.pem
        certificatePolicies    = @certificate_policies
      '';
      certificate_policies = ''
        policyIdentifier = 1.2.250.1.42
        CPS.1 = https://${x509.host}/x509/cps
      '';
      ca = ''
        dir         = ${x509.dir}/pub
        private_key = $dir/sec/key.pem
        crl_dir     = $dir
        crlnumber   = $dir/crl.num
        crl         = $dir/crl.pem
        database    = $dir/idx.txt
      '';
    };
  };
  opensslConf_user-cert = lib.mkOption {
    type    = (with types; attrsOf string);
    default = {
      user_cert_extensions = ''
        basicConstraints       = critical,CA:FALSE,pathlen:0
        keyUsage               = digitalSignature,keyEncipherment
        subjectAltName         = email:$ENV::user@${x509.host}
        subjectKeyIdentifier   = hash
        issuerAltName          = issuer:copy
        authorityKeyIdentifier = keyid:always,issuer:always
        authorityInfoAccess    = caIssuers;URI:http://${x509.distributionHost}/x509/${x509.host}.cert.pem
      '';
    };
  };
};

config = lib.mkIf (x509.scheme == "self-signed") {
  systemd.services.x509 = {
    enable        = true;
    wantedBy      = [ "multi-user.target" ];
    before        = [ "keys.target" ];
    serviceConfig = {
      ExecStart = pkgs.writeShellScript "x509.service" ''
        # Make private key
        [ -s "${x509.key}" ] || {
          mkdir -p ${x509.dir}
          (
            umask 077
            ${pkgs.openssl}/bin/openssl genrsa \
             -out "${x509.key}" \
             -rand /dev/urandom \
             ${toString x509.keySize}
          )
        }
        # Make self-signed certificate
        [ -s "${x509.cert}" ] &&
        [    "${x509.cert}" -nt "${x509.key}" ] || {
          user= \
          ${pkgs.openssl}/bin/openssl req \
           -batch \
           -new \
           -x509 \
           -utf8 \
           -rand       /dev/urandom \
           -config     ${x509.opensslConf} \
           -extensions self_signed_extensions \
           -reqexts    self_signed_extensions \
           -inform     PEM \
           -outform    PEM \
           -keyform    PEM \
           ${lib.optionalString (x509.days != null) "-days ${toString x509.days}"} \
           -set_serial 0x$(sleep 1; date '+%Y%m%d%H%M%S') \
           -reqopt     no_pubkey,no_sigdump \
           -key        ${x509.key} \
           -out        ${x509.cert}
        }
      '';
    };
  };
};

}