{ config, ... }:

# sops-nix wiring for mars. Encrypted values in ../../secrets/mars.yaml,
# decrypted with mars's own SSH host key (recipient in ../../.sops.yaml).
# The host key is pre-generated on the laptop and shipped at install
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
{
  sops.defaultSopsFile = ../../secrets/mars.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

  sops.secrets.darman_password.neededForUsers = true;
  users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;

  sops.secrets.tailscale_authkey = { };

  # Credentials file for the //jupiter/data cifs mount (see configuration.nix).
  # Same value as jupiter's own samba_password (services/network/samba.nix) —
  # mars authenticates as the same smb user, mirroring terra's setup.
  sops.secrets.samba_password = { };
  sops.templates."jupiter-smb.credentials".content = ''
    username=darman
    password=${config.sops.placeholder.samba_password}
  '';

  # Hermes Agent (hermes-agent.nix) — same Telegram bot token, opencode key,
  # and Authentik OIDC client secret as it used before moving here from
  # jupiter, so no new bot/app to provision.
  sops.secrets.opencode_go_api_key = { };
  sops.secrets.telegram_bot_token = { };
  sops.secrets.hermes_dashboard_oidc_client_secret = { };
  # Same value as secrets/jupiter.yaml (the sending side), stored WITHOUT a
  # trailing newline — a stray newline would change the HMAC key and fail
  # every delivery. Written host-side by hermes-agent-webhook-routes, so it
  # no longer needs to sit in the container's env where luna could read it.
  sops.secrets.gitea_hermes_webhook_secret = {
    restartUnits = [ "hermes-agent-webhook-routes.service" ];
  };
  sops.templates."hermes-agent.env".content = ''
    OPENCODE_GO_API_KEY=${config.sops.placeholder.opencode_go_api_key}
    TELEGRAM_BOT_TOKEN=${config.sops.placeholder.telegram_bot_token}
    TELEGRAM_HOME_CHANNEL=15151223
    TELEGRAM_ALLOWED_USERS=15151223
    WEBHOOK_ENABLED=true
    WEBHOOK_PORT=8644
    HERMES_DASHBOARD_OIDC_CLIENT_SECRET=${config.sops.placeholder.hermes_dashboard_oidc_client_secret}
  '';

  # luna's gitea push token (services/dev/gitea.nix provisions the account +
  # PR-tier access), generated once via `gitea admin user generate-access-token
  # --username luna --scopes write:repository,read:user` on jupiter — read:user
  # is required or `tea logins add` fails. restartUnits re-provisions the git
  # credential-store file and `tea` login on rotation, without a full deploy.
  sops.secrets.gitea_luna_token.restartUnits = [ "hermes-agent-prepare-dirs.service" ];

  # livesync-bridge (livesync-bridge.nix) — luna's Obsidian vault, mirrored
  # from CouchDB on jupiter. Consumed only via the rendered config.json, so
  # the sops default of root:root 0400 is fine here.
  #
  # ⚠️ couchdb_luna_password is jupiter's `obsidian` ADMIN password (same as
  # secrets/jupiter.yaml's couchdb_admin_password) and obsidian_luna_passphrase
  # reuses the personal vault's passphrase — reusing what already existed, but
  # it means mars (running an autonomous agent) can decrypt and read EVERY
  # vault database, not just luna's. To shrink that blast radius: give luna's
  # vault its own passphrase, and/or scope a CouchDB account to her database
  # via _security (README -> "Obsidian vaults"). Neither is required for the
  # bridge to work.
  sops.secrets.couchdb_luna_password = { };

  # The E2EE passphrase for luna's vault, as entered in the Obsidian plugin.
  # Vault passphrases otherwise never leave the clients (obsidian-livesync.nix)
  # — this has to be here because mars IS a client, decrypting to write real
  # markdown to disk. Also feeds the bridge's separate obfuscatePassphrase
  # field, since the plugin derives path obfuscation from the same value.
  sops.secrets.obsidian_luna_passphrase = { };
}