{ lib, ... }:

with lib;
let
  hash-ldap-passwd-pkg = name: passwd-file: pkgs.stdenv.mkDerivation {
    name = "${name}-ldap-passwd";

    phases = [ "buildPhase" "installPhase" ];

    buildInputs = with pkgs; [ openldap ];

    buildPhase = ''
      slappasswd -T ${passwd-file} > ldap-passwd
    '';

    installPhase = ''
      mkdir $out
      mv ldap-passwd $out
    '';
  };

  hash-ldap-passwd = name: passwd-file: let
    passwd-pkgs = hash-ldap-passwd-pkg name passwd-file;
  in builtins.readFile "${passwd-pkgs}/ldap-passwd";

  generate-random-passwd = name: length: pkgs.stdenv.mkDerivation {
    name = "${name}-random-passwd";

    phases = [ "buildPhase" "installPhase" ];

    buildInputs = with pkgs; [ pwgen ];

    buildPhase = ''
      pwgen --symbols --num-passwords=1 ${length} > passwd
    '';

    installPhase = ''
      mkdir $out
      mv passwd $out
    '';
  };

in {
  hash-ldap-passwd = hash-ldap-passwd;

  random-passwd-file = name: length:
    toPath "${generate-random-passwd name length}/passwd";
}