{ config, ... }:

# sops-nix wiring for terra (desktop). Encrypted values in ../../secrets/terra.yaml,
# decrypted with terra's own SSH host key (recipient in ../../.sops.yaml).
# The host key is pre-generated on the laptop and shipped at install
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
{
  sops.defaultSopsFile = ../../secrets/terra.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

  sops.secrets.tailscale_authkey = { };

  sops.secrets.darman_password.neededForUsers = true;
  users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;

  # Credentials file for the //jupiter/data cifs mount (see configuration.nix).
  # samba_password mirrors jupiter's own samba_password secret (services/network/samba.nix) —
  # same value, just also encrypted to terra so it can authenticate as the same smb user.
  sops.secrets.samba_password = { };
  sops.templates."jupiter-smb.credentials".content = ''
    username=darman
    password=${config.sops.placeholder.samba_password}
  '';

  # LibreChat's CREDS_KEY/IV encrypt stored user credentials (linked 3rd-party
  # API keys etc) at rest in mongo; JWT_SECRET/JWT_REFRESH_SECRET sign session
  # tokens. All four are random, generated once with `sops --set` (see
  # CLAUDE.md) — losing/rotating them just invalidates existing sessions and
  # any saved per-user API keys, nothing else depends on their value.
  sops.secrets.librechat_creds_key = { };
  sops.secrets.librechat_creds_iv = { };
  sops.secrets.librechat_jwt_secret = { };
  sops.secrets.librechat_jwt_refresh_secret = { };
}