#!/usr/bin/env nix-shell
#!nix-shell -i bash -p gocryptfs -p rsync

# HOW TO USE
# ```sh
# $ sudo mkdir /nix/persist/private.new && sudo chown colin:users /nix/persist/private.new
# $ sane-private-change-passwd /nix/persist/private.new
# this should prompt you to enter a password for the new directory.
# now all data in the original /mnt/persist/private has been re-encrypted, into /nix/persist/private.new/cipher
# if the data on-disk looks reasonable, continue:
# $ sudo mv /nix/persist/private /nix/persist/private.old
# $ sudo mv /nix/persist/private.new/cipher /nix/persist/private
# $ sudo rmdir /nix/persist/private.new
# ```

set -ex

new_cipher="$1/cipher"
new_plain="$1/plain"
old_plain=/mnt/persist/private
old_cipher=/nix/persist/private

mkdir -p "$new_cipher"
mkdir -p "$new_plain"

# initialize the new store
gocryptfs -init "$new_cipher"

# mount the new store. assume the old store is mounted.
# if old store ISN'T mounted, then run this entire script inside `sane-private-do`
gocryptfs "$new_cipher" "$new_plain"

# transfer to the new store
rsync -arv "$old_plain/" "$new_plain/"

echo "now spot-check the data on-disk at $new_cipher"
echo "if it looks good, then:"
echo "  - sudo mv $old_cipher $old_cipher.old"
echo "  - sudo mv $new_cipher $old_cipher"
echo "  - sudo rmdir $new_plain && sudo rmdir $new_plain/.."
