executable_kasm-secrets

#!/bin/bash
set -euo pipefail


# Configuration
TARGET_SECRETS_FILE="$HOME/dotfiles/.chezmoidata/kasm_secrets.yml"

# Edit this template to add/remove secrets
generate_config() {
    local output_file="$1"

    op inject --out-file "$output_file" <<EOF
# Mike Kasberg's Dotfiles Secrets
#
# This file is installed and managed by the kasm-secrets script.
# Check if secrets are installed in Chezmoi templates with 'if hasKey . "kasm_secrets"'.
# Reference secrets like '.kasm_secrets.foo.bar'.
#
# DO NOT commit this file to git.

kasm_secrets:
  ssh:
    nfs_user: "op://Private/jzuwmdmlxeeph64ccsofukc3vq/username"
    csysk_user: "op://Private/lsfoc7enro2pn4or5wqgkqljsi/username"
    id_ed25519: |
$(fetch_with_indent 'op://Private/SSH Mike id_ed25519/private key' 6)
    kas_catholic_id_rsa: |
$(fetch_with_indent 'op://Private/SSH kas_catholic_id_rsa/private key' 6)
  borg:
    passphrase: "op://Private/BorgBase/Borg Backup Passphrase"
EOF
}

usage() {
    echo "Usage: $(basename "$0") [install|diff|help]"
    echo ""
    echo "Commands:"
    echo "  install   (default) Fetch secrets and write to target file."
    echo "  diff      Fetch secrets and show diff against existing target file."
    echo "  help      Show this help message."
}

log_info() {
    echo -e "ℹ️  $1" >&2
}

log_success() {
    echo -e "✅  $1" >&2
}

log_error() {
    echo -e "❌  $1" >&2
}

check_deps() {
    local missing_deps=0
    for dep in op; do
        if ! command -v "$dep" &> /dev/null; then
            log_error "Missing dependency: $dep"
            missing_deps=1
        fi
    done
    if [ "$missing_deps" -ne 0 ]; then
        exit 1
    fi
}

fetch_with_indent() {
  local indent
  printf -v indent '%*s' "$2" ''
  op read "$1" | sed "s/^/$indent/"
}

main() {
    local cmd="${1:-install}"

    case "$cmd" in
        help|-h|--help)
            usage
            exit 0
            ;;
        install|diff)
            ;;
        *)
            usage
            exit 1
            ;;
    esac

    check_deps

    # Create a temporary file
    local temp_file
    temp_file=$(mktemp)

    # Ensure temp file is cleaned up on exit
    trap "rm -f '$temp_file'" EXIT

    # Generate content
    generate_config "$temp_file"

    if [ "$cmd" = "diff" ]; then
        if [ -f "$TARGET_SECRETS_FILE" ]; then
            log_info "Diffing against $TARGET_SECRETS_FILE:"
            if diff -u "$TARGET_SECRETS_FILE" "$temp_file"; then
                log_success "Up to date: $TARGET_SECRETS_FILE"
            fi
        else
            log_info "Target file does not exist. Content would be:"
            cat "$temp_file"
        fi
    elif [ "$cmd" = "install" ]; then
        mkdir -p "$(dirname "$TARGET_SECRETS_FILE")"
        mv "$temp_file" "$TARGET_SECRETS_FILE"
        chmod 600 "$TARGET_SECRETS_FILE"
        log_success "Secrets installed to $TARGET_SECRETS_FILE"
    fi
}

main "$@"