nixos-module.nix

{ self, ... }:
{
  flake.nixosModules.default = self.nixosModules.sopsidy;
  flake.nixosModules.sopsidy =
    { lib, config, ... }:
    let
      inherit (lib) types;

      secretTypeModule =
        {
          options = {
            collect = {
              script = lib.mkOption {
                type = types.nullOr types.str;
                default = null;
                description = ''
                  Script that outputs secret.
                  If multiple configs/hosts define different scripts for the same secret
                  then the script from the last host in alphabetical order will be used.
                  Scripts should error out when the secret is inaccessible, which
                  will prevent editing of the overall sops file.
                '';
              };
              runtimeInputs = lib.mkOption {
                # Use functionTo so that secret collection scripts
                # are system architecture independent
                type = types.functionTo (types.listOf types.package);
                # Sops stores a manifest of all secrets in json
                # so we store the runtimeInputs function as a functor
                # with an outPath so that it can be serialized into json
                # and still be used as a function
                apply = func: {
                  __functor = self: func;
                  outPath = "function (input: pkgs; output: list of runtimeInputs)";
                };
                default = [ ];
                example = lib.literalExpression ''
                  pkgs: [ pkgs.rbw ]
                '';
                description = ''
                  Function that takes a nixpkgs instance and returns a list of
                  packages to include in $PATH for the script.
                  Be sure to use the pkgs input, so that the secret collection
                  script can be run on any system and not just the system that
                  this config system has been evaluated for.
                '';
              };
              stripTrailingCharacter = lib.mkOption {
                type = types.bool;
                default = true;
                description = ''
                  Remove typical trailing new line of command output by piping
                  output of command to `head -c -1` which removes the
                  last character.
                '';
              };
            };
          };
        };
    in {
      imports = [
        ./plugins/rbw.nix
      ];
      options = {
        sops.secretDefaults = lib.mkOption {
          type = types.deferredModule;
          default = { };
          description = ''
            Secret module to import for all secrets.
          '';
        };
        sops.secrets = lib.mkOption {
          type = types.attrsOf (types.submodule {
            imports = [ secretTypeModule config.sops.secretDefaults ];
          });
        };
        sops.hostPubKey = lib.mkOption {
          type = types.str;
          description = ''
            Age public key of the host.
            Will be used to encrypt all sops files defined in the host.
            Can be found with:
            `nix-shell -p ssh-to-age --run 'ssh-keyscan -t ed25519 <server-domain> | tail -n 1 | ssh-to-age'`
          '';
        };
      };
    };
}