#!/usr/bin/env bash
# Generates a new machine's SSH host key ahead of installing it, so
# sops-nix has something to derive an age key from before the target
# ever boots.
#
# Why this is needed: sops-nix derives each host's decryption key from
# its own /etc/ssh/ssh_host_ed25519_key at *activation* time, but that
# activation runs before systemd would otherwise generate this key on
# first boot (sshd-keygen is a normal systemd service gated behind
# multi-user.target; activation scripts run earlier than that). Without
# pre-seeding, secrets — including the root/nixos login password — fail
# to decrypt on the machine's very first boot.
#
# This script only touches your admin workstation and this repo's
# .sops.yaml (it never contacts the target machine). Run it, follow the
# printed next steps, then use the resulting key with the auto-install.sh
# prompt (see modules/installer/common.nix) when you actually install the
# new machine.
set -euo pipefail

repo_root="$(cd "$(dirname "$0")/.." && pwd)"

hostname="${1:?usage: scripts/prepare-host-key.sh <hostname>}"
sops_yaml="${repo_root}/.sops.yaml"

if [[ ! -f "$sops_yaml" ]]; then
  echo "ERROR: $sops_yaml not found — is this script still under nixos/scripts/?" >&2
  exit 1
fi

keydir="${repo_root}/host-keys"
mkdir -p "$keydir"
keyfile="${keydir}/${hostname}_ssh_host_ed25519_key"

if [[ -f "$keyfile" ]]; then
  echo "ERROR: $keyfile already exists. Remove it first if you want to regenerate." >&2
  exit 1
fi

nix-shell -p openssh --run "ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}'" >/dev/null

age_pub="$(nix-shell -p ssh-to-age --run "ssh-to-age -i '${keyfile}.pub'")"

cat <<EOF

Generated: ${keyfile}(.pub)

=== 1. Add this line under keys: in ${sops_yaml} ===
  - &${hostname} ${age_pub}

=== 2. Add *${hostname} to whichever creation_rules key_groups this host needs ===
(e.g. secrets/common.yaml always; add a per-host secrets/${hostname}.yaml
 block too if this host will get its own secrets, same pattern as
 nix-cache/server.)

=== 3. Re-encrypt every secrets file you just added it to ===
  nix-shell -p sops --run 'sops updatekeys ${repo_root}/secrets/common.yaml'

=== 4. Commit + push this repo so the flake build picks up the new recipient ===

=== 5. Get the key onto the installer, one of two ways ===
  a) Rebuild the installer image with all host-keys/ baked in (see
     docs/auto-installer.md):
       NIXOS_HOST_KEYS_DIR="${keydir}" nix build .#iso --impure
     (or .#pxe — --impure is required since host-keys/ is gitignored and
     flakes can't see it otherwise)

  b) Or, for an image already built without keys, scp it in after boot:
       scp ${keyfile}{,.pub} root@<target-ip>:/root/host-keys/

Then continue with /etc/auto-install.sh as normal — it checks
/etc/host-keys (baked in) before /root/host-keys (scp'd) and installs
whichever it finds before running nixos-install.
EOF