{ config
, lib
, pkgs
, ...
}:
let
  cfg = config.services.xinCA;
in
with lib; {
  options = {
    services.xinCA = {
      enable = mkEnableOption "Configure host as a xin certificate authority.";

      user = mkOption {
        type = types.str;
        default = "step-ca";
        description = ''
          User who will own the CA key material.
        '';
      };
    };
  };

  imports = [ ../modules/ts-rev-prox.nix ];
  config = mkIf cfg.enable {
    sops.secrets = {
      ca_password = {
        mode = "400";
        owner = cfg.user;
        sopsFile = config.xin-secrets.cert_authority;
      };
      "defaults.json" = {
        mode = "400";
        owner = cfg.user;
        path = "/var/lib/step-ca/config/defaults.json";
        sopsFile = config.xin-secrets.cert_authority;
      };
      "intermediate_ca.crt" = {
        mode = "444";
        owner = cfg.user;
        path = "/var/lib/step-ca/certs/intermediate_ca.crt";
        sopsFile = config.xin-secrets.cert_authority;
      };
      "intermediate_ca_key" = {
        mode = "400";
        owner = cfg.user;
        path = "/var/lib/step-ca/secrets/intermediate_ca_key";
        sopsFile = config.xin-secrets.cert_authority;
      };
      "root_ca.crt" = {
        mode = "444";
        owner = cfg.user;
        path = "/var/lib/step-ca/certs/root_ca.crt";
        sopsFile = config.xin-secrets.cert_authority;
      };
      "root_ca_key" = {
        mode = "400";
        owner = cfg.user;
        path = "/var/lib/step-ca/secrets/root_ca_key";
        sopsFile = config.xin-secrets.cert_authority;
      };
      "jwk_encryptedKey" = {
        mode = "400";
        owner = cfg.user;
        path = "/var/lib/step-ca/secrets/jwk_encryptedKey";
        sopsFile = config.xin-secrets.cert_authority;
      };
    };

    networking.hosts = { "127.0.0.1" = [ "ca.bolddaemon.com" ]; };

    environment.sessionVariables = { STEPPATH = "/var/lib/step-ca"; };
    environment.systemPackages = with pkgs; [
      step-cli
      step-kms-plugin
      opensc
      libressl
    ];

    services.step-ca = {
      enable = true;
      intermediatePasswordFile = "${config.sops.secrets.ca_password.path}";
      address = "127.0.0.1";
      port = 443;
      settings = {
        root = config.sops.secrets."root_ca.crt".path;
        crt = config.sops.secrets."intermediate_ca.crt".path;
        key = config.sops.secrets.intermediate_ca_key.path;
        dnsNames = [ "ca.bolddaemon.com" ];
        logger = { format = "text"; };
        db = {
          type = "badgerv2";
          dataSource = "/var/lib/step-ca/db";
          badgerFileLoadingMode = "";
        };
        authority = {
          provisioners = [
            {
              type = "SSHPOP";
              name = "sshpop";
              claims = { enableSSHCA = true; };
            }
          ];
        };

        tls = {
          cipherSuites = [
            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
          ];
          minVersion = 1.2;
          maxVersion = 1.3;
          renegotiation = false;
        };
      };
    };
  };
}