{ pkgs, lib, config, machineName, ... }:
let
  inherit (config.security) gnupg;
  rootKey = "root/key";
  initrdKey = "initrd/ssh.key";
  keygrip = "89F52A879E0019A966503AFFDE72EEA84CDFA3A7";
in
{
imports = [
  <nixpkgs/nixos/modules/profiles/hardened.nix>
];
security.gnupg.store = builtins.getEnv "PASSWORD_STORE_DIR" + "/machines/${machineName}";
services.openssh.extraConfig = ''
  StreamLocalBindUnlink yes
'';
installer.ssh-nixos = {
  PATH = [pkgs.gnupg pkgs.openssh];
  script = lib.mkMerge [
    (lib.mkBefore ''
      # Send the SSH key of the initrd
      gpg --decrypt '${gnupg.store}/${initrdKey}.gpg' |
      ssh '${config.installer.ssh-nixos.target}' \
      install -D -m 400 -o root -g root /dev/stdin /root/${initrdKey}
    '')
    (lib.mkBefore ''
      ssh '${config.installer.ssh-nixos.target}' \
      "gpg-connect-agent --no-autostart --homedir /var/lib/gnupg 'keyinfo --list' /bye 2>&1" |
      grep -qx -e "gpg-connect-agent: no gpg-agent running in this session" \
               -e "S KEYINFO ${keygrip} . . . 1 .*" || {
        # Send the rootKey
        gpg --decrypt '${gnupg.store}/${rootKey}.pass.gpg' |
        gpg --batch --pinentry-mode loopback --passphrase-fd 0 --export-secret-subkeys @root@${machineName} |
        ssh '${config.installer.ssh-nixos.target}' \
        gpg --no-autostart --homedir /var/lib/gnupg --no-autostart --batch --pinentry-mode loopback --import

        # Send the rootKey's passphrase
        gpg --decrypt '${gnupg.store}/${rootKey}.pass.gpg' |
        ssh '${config.installer.ssh-nixos.target}' \
        gpg-preset-passphrase --homedir /var/lib/gnupg --preset ${keygrip}
      }
    '')
  ];
};
boot.initrd.network.ssh.hostKeys = [ "/root/${initrdKey}" ];
}