# Fully declarative FreeIPA domain membership.
#
# Configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a
# pre-provisioned host keytab via sops-nix so no imperative ipa-client-install
# step is needed after deployment.
#
# Usage (in a host.nix imports list):
#   (import ../../modules/ipa/client.nix {
#     keytabSopsFile = ../../secrets/nix-cache.keytab;
#     caCertFile     = ../../certs/ipa-ca.crt;
#   })
#
# One-time operator setup per host (do this BEFORE deploying):
#
#   1. Fetch the IPA CA certificate (public — safe to commit):
#        curl -o certs/ipa-ca.crt http://<ipa-server>/ipa/config/ca.crt
#      Replace the placeholder at certs/ipa-ca.crt and commit it.
#
#   2. On the FreeIPA server, add the host and generate a keytab:
#        ipa host-add <fqdn> --ip-address=<ip>
#        ipa-getkeytab -s <ipa-server> -p host/<fqdn> -k /tmp/<host>.keytab
#
#   3. sops-encrypt the keytab as a binary secret from your admin machine:
#        sops -e --input-type binary /tmp/<host>.keytab \
#          > secrets/<host>.keytab
#      Add secrets/<host>.keytab to .sops.yaml with the host's age key as a
#      recipient (see the nix-cache.keytab entry for the pattern), then run:
#        scripts/secrets/sync-host-keys.sh <target>   # if not done yet
#        sops updatekeys secrets/<host>.keytab
#      Commit the encrypted file.
#
#   4. nixos-rebuild switch (or create-proxmox-resource.sh) — no further
#      manual enrollment steps required.
#
# vars dependencies: homeDomain, ipaServer

{ keytabSopsFile, caCertFile }:
{ config, lib, pkgs, vars, ... }:

let
  realm = lib.strings.toUpper vars.homeDomain;
  fqdn = "${config.networking.hostName}.${vars.homeDomain}";
  # "sweet.home" -> "dc=sweet,dc=home"
  basedn = lib.strings.concatMapStringsSep "," (c: "dc=${c}") (lib.strings.splitString "." vars.homeDomain);
  # security.ipa.certificate expects a derivation (package), not a raw path.
  caCertPkg = pkgs.writeText "ipa-ca.crt" (builtins.readFile caCertFile);
in
{
  security.ipa = {
    enable = true;
    domain = vars.homeDomain;
    realm = realm;
    server = vars.ipaServer;
    certificate = caCertPkg;
    basedn = basedn;
    ipaHostname = fqdn;
    offlinePasswords = true;
    cacheCredentials = true;
  };

  # Host keytab: pre-provisioned on the IPA server, sops-encrypted binary.
  # Placed at /etc/krb5.keytab before SSSD starts so the host authenticates
  # to IPA without running ipa-client-install.
  sops.secrets."ipa-host-keytab" = {
    sopsFile = keytabSopsFile;
    format = "binary";
    path = "/etc/krb5.keytab";
    owner = "root";
    group = "root";
    mode = "0600";
    restartUnits = [ "sssd.service" ];
  };
}