#!/bin/bash
{{ if eq .chezmoi.osRelease.id "nixos" }}
exit 0
{{ end }}

set -euo pipefail

echo "Setting up age key..."

KEY_FILE="{{ .defaultAgeKeyPath }}"
KEY_DIR="$(dirname "$KEY_FILE")"

{{ if .skipCreatingAgeKey }}
echo "Expecting age key to be at $KEY_FILE"
exit 0
{{ end }}

mkdir -p "$KEY_DIR"
chmod 700 "$KEY_DIR"

VW_URL="https://vault.benq-serv.top"
bw config server "$VW_URL" >/dev/null

STATUS=$(bw status 2>/dev/null | jq -r '.status')
case "$STATUS" in
  "locked")
    export BW_SESSION=$(bw unlock --raw)
    ;;
  "unauthenticated")
    export BW_SESSION=$(bw login --raw)
    ;;
  *)
    echo "Unknown bw status: $STATUS"
    exit 1
    ;;
esac

bw sync
bw get item "age-keys" \
  | jq -r '.fields[] | select(.name == "private_key") | .value' \
  > "$KEY_FILE"

if [[ -s "$KEY_FILE" ]]; then
    chmod 600 "$KEY_FILE"
else
    exit 1
fi