AGENIX_KEY ?= $(HOME)/.config/agenix/key.txt
AGENIX_PUBKEY = $(AGENIX_KEY).pub
EDITOR = ${EDITOR:-zeditor}
SECRETS_DIR = secrets
SECRETS = $(wildcard $(SECRETS_DIR)/*.age)

.DEFAULT_GOAL = help

.PHONY: help
help:
	@echo "Usage:"
	@echo "  make agenix-key     - Generate age key (if missing)"
	@echo "  make agenix-pubkey   - Show public key"
	@echo "  make agenix-edit F=<file> - Create/edit an encrypted secret"
	@echo "  make agenix-decrypt F=<file> - Decrypt and print a secret"
	@echo "  make agenix-rekey    - Re-encrypt all secrets to current key"

.PHONY: agenix-key
agenix-key:
	@if [ -f "$(AGENIX_KEY)" ]; then \
		echo "Key already exists at $(AGENIX_KEY)"; \
	else \
		mkdir -p "$(dir $(AGENIX_KEY))" && \
		nix run nixpkgs#age-keygen -- -o "$(AGENIX_KEY)" && \
		echo "Generated age key: $(AGENIX_KEY)"; \
	fi

.PHONY: agenix-pubkey
agenix-pubkey: agenix-key
	@nix run nixpkgs#age-keygen -- -y "$(AGENIX_KEY)" | tee "$(AGENIX_PUBKEY)"

.PHONY: agenix-edit
agenix-edit: agenix-key
	@if [ -z "$(F)" ]; then \
		echo "Usage: make agenix-edit F=secrets/example.age"; \
		exit 1; \
	fi
	@nix run nixpkgs#age -- -e -i "$(AGENIX_KEY)" -o "$(F)" 2>/dev/null; \
	if [ -f "$(F)" ]; then \
		nix run nixpkgs#age -- -d -i "$(AGENIX_KEY)" "$(F)" > /tmp/agenix-edit.$$ && \
		$${EDITOR} /tmp/agenix-edit.$$ && \
		nix run nixpkgs#age -- -e -i "$(AGENIX_KEY)" -o "$(F)" < /tmp/agenix-edit.$$ && \
		rm /tmp/agenix-edit.$$ && \
		echo "Encrypted: $(F)"; \
	fi

.PHONY: agenix-decrypt
agenix-decrypt: agenix-key
	@if [ -z "$(F)" ]; then \
		echo "Usage: make agenix-decrypt F=secrets/example.age"; \
		exit 1; \
	fi; \
	nix run nixpkgs#age -- -d -i "$(AGENIX_KEY)" "$(F)"

.PHONY: agenix-rekey
agenix-rekey: agenix-pubkey
	@pubkey=$$(cat "$(AGENIX_PUBKEY)"); \
	for secret in $(SECRETS); do \
		echo "Rekeying $$secret..."; \
		tmp=$$(mktemp); \
		nix run nixpkgs#age -- -d -i "$(AGENIX_KEY)" "$$secret" > "$$tmp" 2>/dev/null && \
		nix run nixpkgs#age -- -e -r "$$pubkey" -o "$$secret" < "$$tmp" && \
		rm "$$tmp"; \
	done; \
	echo "Done"