#!/bin/sh -e

encto () {
  # Overwriting an existing encrypted file will change its content, even if
  # its decrypted content does not change, so leave it alone.
  [ -e "$2" ] && return 0
  hostkey=$(awk '$1 ~ /^\[?'"$1"'\.(twilken\.net|local|fritz\.box)\]?(:[0-9]+)?$/ && $2 == "ssh-ed25519" { print $2, $3 }' ~/.ssh/known_hosts)
  age -e -a -r "${hostkey:?No hostkey found for $1}" -o "$2"
}

store () {
  # Overwriting an existing encrypted file will change its content, even if
  # its decrypted content does not change, so leave it alone.
  [ -e "$3" ] && return 0
  pass show "$2" > /dev/null || return 1
  pass show "$2" | head -1 | encto "$1" "$3"
}

store_restic () {
  store "$1" "computers/vin/restic-repos/$2" "tw/system/files/restic/$2.enc"
}

# Wireguard secret keys and pre-shared keys.
for host in lap lud vin frm btl; do
  store "$host" "computers/wireguard/private/$host" "tw/services/files/wireguard/$host.key.enc"
  for host2 in lap lud vin pi3 fp4 frm btl; do
    [ $host = $host2 ] && continue
    store "$host" "computers/wireguard/preshared/$host-$host2" "tw/services/files/wireguard/$host-$host2.psk.enc"
  done
done

# Restic repository passwords.
for repo in vin-grafana timo-laptop timo-framework timo-battleship timo-phone timo-sync; do
  store_restic vin $repo
done

store_restic lud lud-paperless
store_restic lud lud-nextcloud
store_restic lud lud-git

store lud www/nextcloud/database tw/system/files/nextcloud-database-password.enc

encto lud tw/system/files/mythic-dns.scm.enc << EOF
"$(pass show www/mythic-beasts/dns-lud | sed -rn '/^username: /s///p')"  ; username
"$(pass show www/mythic-beasts/dns-lud | head -1)"  ; password
EOF

encto vin tw/system/files/grafana/metrics-credentials.enc << EOF
GF_METRICS_BASIC_AUTH_USERNAME=$(pass show computers/vin/grafana/metrics | sed -rn '/^username: /s///p')
GF_METRICS_BASIC_AUTH_PASSWORD=$(pass show computers/vin/grafana/metrics | head -1)
EOF

encto lud tw/system/files/paperless-secret-key.enc << EOF
PAPERLESS_SECRET_KEY=$(pass show computers/lud/paperless/secret-key | head -1)
EOF