nixfiles/hosts/raspberry/secrets.nix

{pkgs, ...}: {
  services.secrets = {
    enable = true;

    packages = with pkgs; [rclone];

    extraFunctions = ''
      simple_get_obscure() {
        rclone obscure "$(simple_get "$@")"
      }
    '';

    requiredVaultPaths = [
      "private-public-keys/data/cryptsetup/raspberry-ext-drive" # used dynamically
      "private-public-keys/data/wireguard/chaos-internal/raspberry"
      "passwords/data/wifi/parentals-home"
      "api-keys/data/hetzner/storagebox"
    ];

    secrets = {
      # Used for fetching the encryption drive's key at runtime
      # can be revoked in case of hardware theft
      # Can also run vault-login on host before secrets-init to fetch secrets using raspberry's login
      vault_login_password = {
        manual = true;
      };

      home-wifi-password = {
        user = "root";
        group = "root";
        permissions = "600";
        path = "/etc/NetworkManager/system-connections/Home-WiFi.nmconnection";

        fetchScript = ''
          ssid=$(simple_get "/passwords/wifi/parentals-home" .ssid)
          password=$(simple_get "/passwords/wifi/parentals-home" .password)

          # Create path to if doesn't exist, useful for when using secrets-init on another host
          if [ ! -d "$SYSROOT/etc/NetworkManager/system-connections" ]; then
            mkdir -p "$SYSROOT/etc/NetworkManager/system-connections"
          fi

          cp ${./data/wifi-nmconnection.template} "$secretFile"
          sed -i "s/WIFI_ID/Home-WiFi/" "$secretFile"
          sed -i "s/WIFI_SSID/$ssid/" "$secretFile"
          sed -i "s/WIFI_PASSWORD/$password/" "$secretFile"
        '';
      };

      rclone_config = {
        fetchScript = ''
          TMP_DIR="$(mktemp -d)"

          cp ${./rclone_config.template} "$TMP_DIR/template"

          pushd "$TMP_DIR" >/dev/null

          STORAGEBOX_PASSWORD=$(simple_get_obscure /api-keys/hetzner/storagebox .password)
          sed -i "s/STORAGEBOX_PASSWORD/$STORAGEBOX_PASSWORD/" ./template

          cp ./template "$secretFile"

          popd >/dev/null

          rm -rf "$TMP_DIR"
        '';
      };

      # for internal wireguard VPN
      wg_priv = {
        fetchScript = ''
          simple_get "/private-public-keys/wireguard/chaos-internal/raspberry" .private > "$secretFile"
        '';
      };
      wg_preshared_hetzner-vm = {
        fetchScript = ''
          simple_get "/private-public-keys/wireguard/chaos-internal/raspberry" .preshared_keys.hetzner_vm > "$secretFile"
        '';
      };
      wg_preshared_vault = {
        fetchScript = ''
          simple_get "/private-public-keys/wireguard/chaos-internal/raspberry" .preshared_keys.vault > "$secretFile"
        '';
      };
    };
  };
}