{ config, pkgs, ... }:

# Home Assistant endpoint that puts Nethergarde (truenas VM) and ashenvale_crypt to rest.
# HTTP API (unprivileged) -> trigger file in /run/fde-lock-api -> path unit -> root oneshot.
# Token: /etc/nixos/secrets/fde-lock-token (not versioned).

let
  listen = "192.168.0.19";
  port = 8742;
  allowed = "192.168.0.14"; # varian (Home Assistant)

  fde-lock = pkgs.writeShellApplication {
    name = "fde-lock";
    runtimeInputs = with pkgs; [
      coreutils util-linux procps gawk gnused
      lvm2 cryptsetup
      config.virtualisation.incus.clientPackage
    ];
    text = builtins.readFile ./fde-lock/lock.sh;
  };

  lockService = mode: {
    description = "Put Nethergarde and ashenvale_crypt to rest (${mode})";
    # Never (re)started by a rebuild, only by its path unit.
    restartIfChanged = false;
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${fde-lock}/bin/fde-lock ${mode}";
      StandardInput = "null";
      TimeoutStartSec = "4min";
    };
  };

  trigger = name: {
    wantedBy = [ "paths.target" ];
    pathConfig = {
      PathChanged = "/run/fde-lock-api/${name}";
      Unit = "fde-${name}.service";
    };
  };
in
{
  systemd.services.fde-lock = lockService "lock";
  systemd.services.fde-check = lockService "check";
  systemd.paths.fde-lock = trigger "lock";
  systemd.paths.fde-check = trigger "check";

  users.users.fde-lock-api = { isSystemUser = true; group = "fde-lock-api"; };
  users.groups.fde-lock-api = { };

  systemd.tmpfiles.rules = [
    "d /run/fde-lock-api 0755 fde-lock-api fde-lock-api -"
    "d /run/fde-lock 0755 root root -"
  ];

  systemd.services.fde-lock-api = {
    description = "HTTP trigger for fde-lock (Home Assistant)";
    wantedBy = [ "multi-user.target" ];
    wants = [ "network-online.target" ];
    after = [ "network-online.target" ];
    environment = {
      FDE_LOCK_LISTEN = listen;
      FDE_LOCK_PORT = toString port;
      FDE_LOCK_ALLOWED = allowed;
    };
    serviceConfig = {
      ExecStart = "${pkgs.python3}/bin/python3 ${./fde-lock/api.py}";
      User = "fde-lock-api";
      Group = "fde-lock-api";
      LoadCredential = "token:/etc/nixos/secrets/fde-lock-token";
      Restart = "always";
      RestartSec = 5;
      NoNewPrivileges = true;
      ProtectSystem = "strict";
      ProtectHome = true;
      PrivateTmp = true;
      ReadWritePaths = [ "/run/fde-lock-api" ];
    };
  };
}