{ config, lib, pkgs, ... }:

with lib;
let
  hostname = config.fudo.instance.hostname;
  has-attrs = set: length (attrNames set) > 0;
  host-keypairs = config.fudo.secrets.files.host-ssh-keypairs.${hostname};

  sshfp-filename = host: keypair: "ssh-${host}-${keypair.key-type}.sshfp-record";

  dns-sshfp-records = host: keypair: let
    filename = sshfp-filename host keypair;
  in mkDerivation {
    buildInputs = with pkgs; [ openssh ];

    buildPhase = ''
      ssh-keygen -r REMOVEME -f ${keypair.public-key} | sed 's/^REMOVEME IN SSHFP //' > ${filename}
    '';

    installPhase = ''
      mv ${filename} $out/${filename}
    '';
  };

in {
  config = {
    fudo = {
      secrets.host-secrets.${hostname} = mkIf (host-keypairs != [])
        map (keypair: {
          "host-${keypair.key-type}-private-key" = {
            source-file = keypair.private-key;
            target-file = "/var/run/ssh/private/host-${keypair.key-type}-private-key";
            user = "root";
          };
        });

      hosts = mapAttrs (hostname: keypairs: {
        ssh-pubkeys = map (keypair: keypair.public-key) keypairs;
        ssh-fingerprints = map (keypair:
          let
            fingerprint-derivation = dns-sshfp-records hostname keypair.public-key;
            filename = sshfp-filename hostname keypair;
          in builtins.readFile "${fingerprint-derivation}/${filename}") keypairs;
      } config.fudo.secrets.files.host-ssh-keypairs);


    };

    services.openssh.hostKeys = mkIf (host-keypairs != [])
      (map (keypair: {
        path = "/var/run/ssh/private/host-${keypair.key-type}-private-key";
        type = keypair.key-type;
      }) host-keypairs);

    programs.ssh.knownHosts = mapAttrs (hostname: keypairs: {
      publicKeyFile = keypairs.public-key;
      hostNames = let
        host-cfg = config.fudo.hosts.${hostname};
        domains = [host-cfg.domain] ++ host-cfg.extra-domains;
      in [ hostname ] ++
         (map (domain: "${hostname}.${domain}") domains);
    });
  };
}