#!/run/current-system/profile/bin/guile --no-auto-compile
!#

(define-module (epistemia secrets rekey)
  #:use-module (ice-9 format)
  #:use-module (ice-9 match))

(define age-id  "/data/ssh/id_ed25519")
(define age-pub "/data/ssh/id_ed25519.pub")

;; use ssh-keyscan to get these, or ~/.ssh/known_hosts
(define saklas   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmdSO3VpL2Y18LV74dikABLEN2hE/abSlyoaiNn5kiR")
(define demiurge "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINVWXCI58LlxCHZ5tbXOH709jsjvjBs/TUFeKvpplECp")
(define hastur   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRBXSHca8R2M37jzVj87neBZ9TqZ+R0A0yaZCIFiNaA")

(define mappings
  `(("email_13f0"            . ,saklas)
    ("email_vinbiz"          . ,saklas)
    ("email_vineetk"         . ,saklas)
    ("wg1_saklas"            . ,saklas)
    ("saklas_smtpd_dkim"     . ,saklas)
    ("saklas_smtpd_passwd"   . ,saklas)
    ("saklas_smtpd_virtuals" . ,saklas)
    ("wg0_demiurge"          . ,demiurge)
    ("wg1_demiurge"          . ,demiurge)
    ("wg0_hastur"            . ,hastur)
    ("wg1_hastur"            . ,hastur)
    ("wg2_hastur"            . ,hastur)
    ("wpa_supplicant"        . ,hastur)))

(define (run fmt . args)
  (zero? (system (apply format #f fmt args))))

(for-each
 (match-lambda
   ((base . key)
    (let ((enc (string-append base ".age"))
          (tmp (string-append base ".age.tmp")))
      (cond
       ;; rekey existing encrypted file
       ((file-exists? enc)
        (format #t "rekeying ~a...~%" enc)
        (if (run "age -d -i ~a ~a | age -e -R ~a -r '~a' -o ~a"
                 age-id enc age-pub key tmp)
            (rename-file tmp enc)
            (format (current-error-port) "failed to rekey ~a~%" base)))

       ;; otherwise encrypt fresh plaintext
       ((file-exists? base)
        (format #t "encrypting ~a...~%" base)
        (if (run "age -e -R ~a -r '~a' -o ~a ~a"
                 age-pub key enc base)
            (delete-file base)
            (format (current-error-port) "failed to encrypt ~a~%" base)))

       (else
        (format (current-error-port) "file not found: ~a~%" base))))))
 mappings)