{ config, lib, ... }:
with lib;
let
  cfg = config.nyxs-nix.services.k3s;
in
{
  sops = mkIf cfg.enable {
    secrets = {
      pg_pass = {
        format = "json";
        key = "pg-pass";
        sopsFile = "${inputs.secrets}/cluster/authentik.json";
      };
      authentik_secret_key = {
        format = "json";
        key = "authentik-secret-key";
        sopsFile = "${inputs.secrets}/cluster/authentik.json";
      };
      sso_client_id = {
        format = "json";
        key = "sso_client_id";
        sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
      };
      sso_client_secret = {
        format = "json";
        key = "sso_client_secret";
        sopsFile = "${inputs.secrets}/cluster/vaultwarden.json";
      }
    };
    templates = {
      "authentik-secrets.yaml" = {
        content = ''
          apiVersion: v1
          kind: Secret
          metadata:
            name: authentik-secrets
            namespace: default
          type: Opaque
          stringData:
            pg_pass: ${config.sops.placeholder."pg_pass"}
            authentik_secret_key: ${config.sops.placeholder."authentik_secret_key"}
        '';
        path = "/var/lib/rancher/k3s/server/manifests/authentik-secrets.yaml";
      };
      "vaultwarden-secrets.yaml" = {
        content = ''
          apiVersion: v1
          kind: Secret
          metadata:
            name: vaultwarden-secrets
            namespace: default
          type: Opaque
          stringData:
            sso_client_id: ${config.sops.placeholder."sso_client_id"}
            sso_client_secret: ${config.sops.placeholder."sso_client_secret"}
        '';
        path = "/var/lib/rancher/k3s/server/manifests/vaultwarden-secrets.yaml";
      };
    };
  };
}