# just is a command runner; Justfile is like Makefile but simpler.
# The agenix operations run against the private secrets repository at ~/codes/nix-secrets.
# Uses nushell:  nix shell nixpkgs#just nixpkgs#nushell
set shell := ["nu", "-c"]
set working-directory := "../../codes/nix-secrets"

identity := "/etc/ssh/ssh_host_ed25519_key"
# `sudo` resets the environment, so the invoking user's `EDITOR` never reaches `agenix`.
# Pin the editor here instead of using `sudo -E`, which would trust the caller's environment.
editor := "hx"

# List all recipes
default:
    @just --list --justfile {{justfile()}}

# Partially edit an existing secret (interactive, needs sudo)
edit file:
    sudo env EDITOR={{quote(editor)}} agenix -i {{identity}} -e {{quote(file)}}

# Create a secret, or fully replace one, from plaintext on stdin (no sudo)
replace file:
    rm -f {{quote(file)}}
    agenix -e {{quote(file)}}

# Re-encrypt every secret after adding or changing a recipient key
[confirm("Re-encrypt every secret in ~/codes/nix-secrets?")]
rekey:
    sudo agenix -r -i {{identity}}
    sudo chown -R ryan:ryan *