{ config, ... }:

# sops-nix wiring for neptun (netcup VPS). Encrypted values in ../../secrets/neptun.yaml,
# decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml).
# The host key is pre-generated on the laptop and shipped at install
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
{
  sops.defaultSopsFile = ../../secrets/neptun.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

  sops.secrets.tailscale_authkey = { };

  # darman's console password (own hash = distinct from jupiter/mercury).
  sops.secrets.darman_password.neededForUsers = true;
  users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;

  # Authentik takes a single systemd EnvironmentFile (services/identity/authentik.nix);
  # no `owner` here on purpose, since systemd reads it as root before dropping to
  # DynamicUser. AUTHENTIK_SECRET_KEY signs sessions (rotating it logs everyone out);
  # the BOOTSTRAP_* vars only matter on the very first start (create `akadmin`) and are
  # inert after.
  sops.secrets.authentik_secret_key = { };
  sops.secrets.authentik_bootstrap_password = { };
  sops.secrets.authentik_bootstrap_email = { };
  sops.templates."authentik.env".content = ''
    AUTHENTIK_SECRET_KEY=${config.sops.placeholder.authentik_secret_key}
    AUTHENTIK_BOOTSTRAP_PASSWORD=${config.sops.placeholder.authentik_bootstrap_password}
    AUTHENTIK_BOOTSTRAP_EMAIL=${config.sops.placeholder.authentik_bootstrap_email}
  '';

  # Caddy's ACME account email. Same EnvironmentFile trick as authentik above,
  # and root:root 0400 is likewise correct — systemd reads it before dropping
  # to User=caddy. Wired up in configuration.nix.
  sops.secrets.caddy_acme_email = { };
  sops.templates."caddy.env".content = ''
    ACME_EMAIL=${config.sops.placeholder.caddy_acme_email}
  '';

  # Headplane's cookie_secret_path takes a path natively (no store leak); oidc.client_secret
  # and the headscale API key are still REPLACE_ME placeholders (services/vpn/headplane.nix)
  # until Authentik/headscale are deployed for real. Unlike authentik's EnvironmentFile,
  # headscale/headplane open these paths themselves as the headscale user, so each needs
  # an explicit owner — and headscale's OIDC client is a separate Authentik app from
  # headplane's, hence the second client secret.
  sops.secrets.headscale_oidc_client_secret.owner = "headscale";

  sops.secrets.headplane_cookie_secret.owner = "headscale";
  sops.secrets.headplane_oidc_client_secret.owner = "headscale";
  sops.secrets.headplane_headscale_api_key.owner = "headscale";
}