# The root-side copy of the cache facts the host's nix daemon, hive-priv and
# hive-c0re use: the key a downloaded closure must be signed by and the netrc
# the pull token goes out in. The script runs as root on the hive host under
# the hive's own store identity and writes:
#
# - the key and the netrc into `dir`, which only root can read (hive-priv's
#   check of the key);
# - a nix.conf fragment at `confFile` that the host's nix.conf includes, with
#   `extra-trusted-public-keys` and nothing else: no trusted substituter and no
#   netrc, so no other client of the daemon can fetch from the cache or send
#   the token;
# - a second copy of the netrc at `clientNetrc`, `root:<clientGroup> 0640`,
#   that hive-c0re passes to its own `nix copy --from` as a client setting.
#
# Nothing is read from a file hive-c0re (unprivileged) writes: the key and the
# token come from the store. The fragment holds no secret.
#
# A store that holds no facts yet, or cannot be reached, leaves what is in
# `dir`, `confFile` and `clientNetrc` as they are. Nothing here removes a file.
#
# Pure function — NOT a NixOS module. Call it from a unit's `script`, with
# `bao`, `coreutils`, `gnugrep` and `systemd` on its `path` and the `BAO_*`
# client environment set:
#
#   script = import ./lib/attic-root-facts.nix { inherit lib; } {
#     hive = "alpha"; host = "attic.example.org"; dir = "/run/hyperhive-priv/attic";
#     confFile = "/run/hyperhive-nix/cache.conf"; clientNetrc = "/run/hyperhive-nix/netrc";
#     clientGroup = "hive-core";
#   };
{ lib }:
{
  # The hive's name in the store: facts are read from
  # `secret/swarm/hives/<hive>/attic/`.
  hive,
  # The cache server's host name, which the netrc line names.
  host,
  # Where the key and the netrc go.
  dir,
  # Where the nix.conf fragment goes; its directory is root's and readable.
  confFile,
  # Where the netrc copy for the client goes, and the group that may read it.
  clientNetrc,
  clientGroup,
}:
''
  set -euo pipefail
  ${import ./store-seeded-secret.nix { }}
  ${import ./atomic-write-secret.nix { }}
  ${import ./refresh-consumer.nix { }}

  dir=${lib.escapeShellArg dir}
  conf=${lib.escapeShellArg confFile}
  client_netrc=${lib.escapeShellArg clientNetrc}
  install -d -m 0700 "$dir"
  install -d -m 0755 "$(dirname -- "$conf")" "$(dirname -- "$client_netrc")"

  store_init
  store_login
  if [ "$STORE_UP" != 1 ]; then
    echo "could not read the cache facts; $dir stays as it is." >&2
    exit 1
  fi

  # <leaf> <variable>. Sets the variable to the leaf's value. A leaf the store
  # does not hold sets `missing`; any other failure ends the run.
  missing=0
  fetch() {
    local value
    if value="$(store_bao kv get -field=value ${lib.escapeShellArg "secret/swarm/hives/${hive}/attic"}/"$1" 2>"$STORE_ERR")"; then
      printf -v "$2" '%s' "$value"
    elif grep -qi 'no value found' "$STORE_ERR"; then
      missing=1
    else
      cat "$STORE_ERR" >&2
      echo "could not read the cache fact $1; $dir stays as it is." >&2
      exit 1
    fi
  }

  key=""
  token=""
  fetch public-key key
  fetch pull-token token
  if [ "$missing" = 1 ]; then
    echo "the swarm has not given this hive its cache facts yet; $dir stays as it is."
    exit 0
  fi

  # One token each: both land in a file nix and hive-priv parse by whitespace.
  if [[ ! "$key" =~ ^[^[:space:]:]+:[^[:space:]]+$ ]] || [[ ! "$token" =~ ^[^[:space:]]+$ ]]; then
    echo "the stored cache facts are not a <name>:<key> and a single token; $dir stays as it is." >&2
    exit 1
  fi

  # Written only when the value changed, so the files keep their mtime between
  # runs. The owner is the running user, root, and the mode is 0600.
  if secret_differs "$dir/public-key" "$key"; then
    atomic_write_secret 0600 "" "$dir/public-key" "$key"
  fi
  netrc="machine ${host} password $token"
  if secret_differs "$dir/netrc" "$netrc"; then
    atomic_write_secret 0600 "" "$dir/netrc" "$netrc"
  fi

  # The client's copy: readable by the group, which is a deliberate grant of the
  # pull token to hive-c0re's user. Written before the fragment, so a host with
  # the key has the netrc.
  if secret_differs "$client_netrc" "$netrc"; then
    atomic_write_secret 0640 ":${clientGroup}" "$client_netrc" "$netrc"
  fi

  # Last. The mtime moves only with the content. Lix re-reads nix.conf for every
  # connection, CppNix only at start, so a daemon that started before this write
  # is restarted.
  fragment="extra-trusted-public-keys = $key"
  if secret_differs "$conf" "$fragment"; then
    atomic_write_secret 0644 "" "$conf" "$fragment"
  fi
  refresh_unit nix-daemon.service "$conf"
''