{ lib, ... }:

let
  # host-keys/ is gitignored (private key material must never be committed),
  # which means flakes' git-filtered source tree can never see it via a
  # normal relative path — referencing it at all requires stepping outside
  # pure evaluation. builtins.getEnv is neutered to "" under normal
  # `nix build`/`nix eval` (no error, just empty), so this whole module is a
  # silent no-op unless the operator explicitly opts in with --impure and
  # the env var set — safe by default, including in CI.
  #
  #   NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure
  #
  # See docs/auto-installer.md.
  hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
  hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
  hostKeysDir = /. + hostKeysDirStr;

  keyFileNames =
    if hasHostKeysDir
    then
      lib.filter
        (name: lib.hasSuffix "_ssh_host_ed25519_key" name || lib.hasSuffix "_ssh_host_ed25519_key.pub" name)
        (lib.attrNames (builtins.readDir hostKeysDir))
    else [ ];
in
{
  environment.etc = lib.listToAttrs (map
    (name: {
      name = "host-keys/${name}";
      value = {
        source = hostKeysDir + "/${name}";
        mode = "0400";
      };
    })
    keyFileNames);
}