#!/usr/bin/env nix-shell
#!nix-shell -i bash -p bash -p coreutils-full -p openssh -p ssh-to-age
# unlocks the SOPS store (i.e. populate a SOPS key from the user's SSH key)

if test -f ~/.config/sops/age/keys.txt; then
  exit
fi

set -x

mkdir -p ~/.config/sops/age

tryUnlock() {
  # unlock the SSH key
  cp ~/.ssh/id_ed25519 ~/.config/sops/age/id_ed25519
  ssh-keygen -p -N "" -f ~/.config/sops/age/id_ed25519
  # convert ssh -> age
  ssh-to-age -private-key -i ~/.config/sops/age/id_ed25519 > ~/.config/sops/age/keys.txt
  chmod 600 ~/.config/sops/age/keys.txt
}

# there are some dependencies not properly conveyed within the services which may invoke sane-secrets-unlock.
# so show some grace if invoked e.g. before ~/.ssh/ symlinks have been created
tryUnlock \
  || (sleep 1 && tryUnlock) \
  || (sleep 1 && tryUnlock) \
  || (sleep 2 && tryUnlock) \
  || (sleep 4 && tryUnlock) \
  || (sleep 4 && tryUnlock) \
  || (sleep 4 && tryUnlock) \

# remove the unlocked SSH key
rm -f ~/.config/sops/age/id_ed25519

# present the pubkey for convenience (e.g. if this sops key is new)
echo pubkey: $(cat ~/.ssh/id_ed25519.pub | ssh-to-age)
