{ config, ... }:

# sops-nix wiring for neptun (netcup VPS). Encrypted values in ../../secrets/neptun.yaml,
# decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml).
# The host key is pre-generated on the laptop and shipped at install
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
{
  sops.defaultSopsFile = ../../secrets/neptun.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

  sops.secrets.tailscale_authkey = { };

  # darman's console password (own hash = distinct from jupiter/mercury).
  sops.secrets.darman_password.neededForUsers = true;
  users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;

  # Authentik takes a single systemd EnvironmentFile (services/identity/authentik.nix).
  # No `owner` here on purpose: systemd reads EnvironmentFile as root before
  # dropping to the service's DynamicUser, so root:root 0400 is what we want.
  #
  # AUTHENTIK_SECRET_KEY signs sessions/tokens — rotating it logs everyone out.
  # The BOOTSTRAP_* vars only take effect on the very first start, where they
  # create the `akadmin` superuser; they're inert on every boot after that.
  sops.secrets.authentik_secret_key = { };
  sops.secrets.authentik_bootstrap_password = { };
  sops.secrets.authentik_bootstrap_email = { };
  sops.templates."authentik.env".content = ''
    AUTHENTIK_SECRET_KEY=${config.sops.placeholder.authentik_secret_key}
    AUTHENTIK_BOOTSTRAP_PASSWORD=${config.sops.placeholder.authentik_bootstrap_password}
    AUTHENTIK_BOOTSTRAP_EMAIL=${config.sops.placeholder.authentik_bootstrap_email}
  '';

  # Caddy's ACME account email. Same EnvironmentFile trick as authentik above,
  # and root:root 0400 is likewise correct — systemd reads it before dropping
  # to User=caddy. Wired up in configuration.nix.
  sops.secrets.caddy_acme_email = { };
  sops.templates."caddy.env".content = ''
    ACME_EMAIL=${config.sops.placeholder.caddy_acme_email}
  '';

  # Headplane: cookie_secret_path takes a path natively (no store leak).
  # oidc.client_secret + the headscale API key are still REPLACE_ME
  # placeholders (see services/vpn/headplane.nix) until Authentik/headscale are
  # actually deployed and those get created for real.
  #
  # owner: unlike authentik's EnvironmentFile above, headplane opens these
  # paths itself, already running as headscale's user — so root:root 0400
  # would fail and each needs an explicit owner.
  sops.secrets.headplane_cookie_secret.owner = "headscale";
  sops.secrets.headplane_oidc_client_secret.owner = "headscale";
  sops.secrets.headplane_headscale_api_key.owner = "headscale";
}