dotfiles/nix/server/secrets.nix

{ config
, pkgs
, lib
, ...
}:
let
  cfg = config.kp2pml30.server;

  # Script to decrypt secrets.yaml and extract XRAY_UIDS
  decryptSecrets = pkgs.writeShellScript "decrypt-secrets" ''
    set -euo pipefail

    source /var/lib/secrets/.env

    if [ -z "''${KP2_DOTFILES_SECRET_KEY:-}" ]; then
      echo "Error: KP2_DOTFILES_SECRET_KEY environment variable not set" >&2
      exit 1
    fi

    if [ ! -f "${./secrets.yaml}" ]; then
      echo "Error: secrets.yaml not found" >&2
      exit 1
    fi

    # Decrypt and parse XRAY_UIDS
    ${pkgs.openssl}/bin/openssl enc -aes-256-cbc -pbkdf2 -iter 1000000 -base64 -d -k "$KP2_DOTFILES_SECRET_KEY" -in "${./secrets.yaml}" | ${pkgs.yq}/bin/yq '.XRAY_UIDS[]' -r
  '';

  xray-config-pre = builtins.toFile "xray-pre.json" (builtins.readFile ./xray-pre.json);
  xray-config-post = builtins.toFile "xray-post.json" (builtins.readFile ./xray-post.json);

  # Script to generate complete xray configuration
  generateXrayConfig = pkgs.writeShellScript "generate-xray-config" ''
    set -euo pipefail

    cat ${xray-config-pre}

    first=true
    while IFS= read -r uuid; do
      if [ "$first" = true ]; then
        first=false
      else
        echo ","
      fi
      echo "          {"
      echo "            \"id\": \"$uuid\","
      echo "            \"flow\": \"xtls-rprx-vision\""
      echo "          }"
    done < <(${decryptSecrets})

    cat ${xray-config-post}
  '';

in {
  options.kp2pml30.server.secretsDir = lib.mkOption {
    type = lib.types.str;
    default = "/var/lib/secrets";
    description = "Directory for secrets management";
  };

  config = lib.mkIf cfg.xray {
    # Ensure xray user and group exist
    users.users.xray = {
      isSystemUser = true;
      group = "xray";
    };

    users.groups.xray = {};

    # Create a systemd service to decrypt and prepare xray clients config
    systemd.services.xray-secrets = {
      description = "Decrypt Xray client configuration";
      wantedBy = [ "xray.service" ];
      before = [ "xray.service" ];

      serviceConfig = {
        Type = "oneshot";
        User = "root";
        EnvironmentFile = "${cfg.secretsDir}/.env";
      };

      script = ''
        mkdir -p /run/secrets
        ${generateXrayConfig} > /run/secrets/xray-config.json
        chown xray:xray /run/secrets/xray-config.json
        chmod 440 /run/secrets/xray-config.json
      '';
    };

    # Ensure secrets directory exists
    systemd.tmpfiles.rules = [
      "d ${cfg.secretsDir} 0750 root root -"
      "d /run/secrets 0755 root root -"
    ];
  };
}