<commit_before>{ pkgs, config, lib, ... }:

with pkgs;
with lib;
with builtins;

let

  topConfig = config;
  cfg = config.crypto;

  decryptSecretScript = { secret, path, user, group }: ''
    mkdir -p "$(dirname "${path}")"
    touch "${path}"
    chmod ${if group == "root" then "0400" else "0440"} "${path}"
    chown "${user}"."${group}" "${path}"
    ${if cfg.dummy then ''
      echo "copying dummy secret ${secret.dummyContents} to ${path}"
      cat "${secret.dummyContents}" > "${path}"
    '' else ''
      ${cfg.decrypter} "${secret.encryptedPath}" > "${path}"
    ''}
  '';

  decryptSecretsScript = svcName: writeScript "decrypt-secrets-${svcName}" ''
    #!${bash}/bin/bash
    ${concatMapStrings ({svc,secretName,secret}:
      decryptSecretScript {
        inherit secret;
        inherit (svc) path user group;
      }
    ) (secretsForService svcName)}
  '';

  secretSvcOpts = secretName: secret: { name, config, ... }: {
    options = {
      path = mkOption {
        type = types.str;
      };
      user = mkOption {
        type = types.str;
        default =
          if topConfig.systemd.services ? ${name}.serviceConfig.User
          then topConfig.systemd.services.${name}.serviceConfig.User
          else "root";
      };
      group = mkOption {
        type = types.str;
        default = "root";
      };
    };
    config = {
      path = "/run/secrets/${secretName}.${name}";
    };
  };

  secretOpts = { name, config, ... }: {
    options = {
      services = mkOption {
        type = with types; attrsOf (submodule (secretSvcOpts name config));
        default = {};
      };
      encryptedPath = mkOption {
        type = types.path;
      };
      dummyContents = mkOption {
        type = types.path;
      };
    };
  };

  # String -> [{svc,secretName,secret}]
  secretsForService = svcName: flatten (mapAttrsToList (secretName: secret:
    let svc = findFirst ({name,value}: name == svcName) [] (
      mapAttrsToList nameValuePair secret.services
    ); in
      if svc == [] then []
      else { svc = svc.value; inherit secretName secret; }
  ) cfg.secrets);

  svcNames = unique (
    concatMap (s: attrNames s.services) (attrValues cfg.secrets)
  );

  dependentServices = map (svcName: {
    ${svcName} = {
      restartTriggers = singleton (hashString "sha256" (
        "${decryptSecretsScript svcName}"
      ));
    };
  }) svcNames;

  decryptServices = map (svcName: {
    "secrets-for-${svcName}" = rec {
      wantedBy = [ "${svcName}.service" ];
      before = wantedBy;
      script = "${decryptSecretsScript svcName}";
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
      };
    };
  }) svcNames;

  purgeOldSecrets = singleton {
    purge-old-secrets = {
      wantedBy = [ "multi-user.target" ];
      script = ''
        ${findutils}/bin/find /run/secrets -type f | ${gnugrep}/bin/grep -vf ${
          writeText "secret-paths" (
            concatStringsSep "\n" (concatMap (svcName:
              map ({svc,...}: svc.path) (secretsForService svcName)
            ) svcNames)
          )
        } | ${findutils}/bin/xargs -r rm -v
      '';
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
      };
    };
  };

  mkDecryptWrapper = secretNames: writeScript "decrypt-wrapper" ''
    #!${bash}/bin/bash
    set -eu

    PATH="${utillinux}/bin:$PATH"

    if ! [ "$(id -u)" == "0" ]; then
      echo >&2 "You must be root"
      exit 1
    fi<commit_msg>nixos/crypto: Create secrets dir if it doesn't exist<commit_after>{ pkgs, config, lib, ... }:

with pkgs;
with lib;
with builtins;

let

  topConfig = config;
  cfg = config.crypto;

  decryptSecretScript = { secret, path, user, group }: ''
    mkdir -p "$(dirname "${path}")"
    touch "${path}"
    chmod ${if group == "root" then "0400" else "0440"} "${path}"
    chown "${user}"."${group}" "${path}"
    ${if cfg.dummy then ''
      echo "copying dummy secret ${secret.dummyContents} to ${path}"
      cat "${secret.dummyContents}" > "${path}"
    '' else ''
      ${cfg.decrypter} "${secret.encryptedPath}" > "${path}"
    ''}
  '';

  decryptSecretsScript = svcName: writeScript "decrypt-secrets-${svcName}" ''
    #!${bash}/bin/bash
    ${concatMapStrings ({svc,secretName,secret}:
      decryptSecretScript {
        inherit secret;
        inherit (svc) path user group;
      }
    ) (secretsForService svcName)}
  '';

  secretSvcOpts = secretName: secret: { name, config, ... }: {
    options = {
      path = mkOption {
        type = types.str;
      };
      user = mkOption {
        type = types.str;
        default =
          if topConfig.systemd.services ? ${name}.serviceConfig.User
          then topConfig.systemd.services.${name}.serviceConfig.User
          else "root";
      };
      group = mkOption {
        type = types.str;
        default = "root";
      };
    };
    config = {
      path = "/run/secrets/${secretName}.${name}";
    };
  };

  secretOpts = { name, config, ... }: {
    options = {
      services = mkOption {
        type = with types; attrsOf (submodule (secretSvcOpts name config));
        default = {};
      };
      encryptedPath = mkOption {
        type = types.path;
      };
      dummyContents = mkOption {
        type = types.path;
      };
    };
  };

  # String -> [{svc,secretName,secret}]
  secretsForService = svcName: flatten (mapAttrsToList (secretName: secret:
    let svc = findFirst ({name,value}: name == svcName) [] (
      mapAttrsToList nameValuePair secret.services
    ); in
      if svc == [] then []
      else { svc = svc.value; inherit secretName secret; }
  ) cfg.secrets);

  svcNames = unique (
    concatMap (s: attrNames s.services) (attrValues cfg.secrets)
  );

  dependentServices = map (svcName: {
    ${svcName} = {
      restartTriggers = singleton (hashString "sha256" (
        "${decryptSecretsScript svcName}"
      ));
    };
  }) svcNames;

  decryptServices = map (svcName: {
    "secrets-for-${svcName}" = rec {
      wantedBy = [ "${svcName}.service" ];
      before = wantedBy;
      script = "${decryptSecretsScript svcName}";
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
      };
    };
  }) svcNames;

  purgeOldSecrets = singleton {
    purge-old-secrets = {
      wantedBy = [ "multi-user.target" ];
      script = ''
        mkdir -p /run/secrets
        ${findutils}/bin/find /run/secrets -type f | ${gnugrep}/bin/grep -vf ${
          writeText "secret-paths" (
            concatStringsSep "\n" (concatMap (svcName:
              map ({svc,...}: svc.path) (secretsForService svcName)
            ) svcNames)
          )
        } | ${findutils}/bin/xargs -r rm -v
      '';
      serviceConfig = {
        Type = "oneshot";
        RemainAfterExit = true;
      };
    };
  };

  mkDecryptWrapper = secretNames: writeScript "decrypt-wrapper" ''
    #!${bash}/bin/bash
    set -eu

    PATH="${utillinux}/bin:$PATH"

    if ! [ "$(id -u)" == "0" ]; then
      echo >&2 "You must be root"
      exit 1
    fi
{'fraction_non_alphanumeric': 0.1574244787973337, 'fraction_numerical': 0.003971067933626436, 'mean_word_length': 2.206912232833106, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7453130', 'n_tokens_mistral': 2353, 'n_tokens_neox': 2286, 'n_words': 501}