move clanCore into nixosModules, add secrets generate command

nixosModules/clanCore/secrets/default.nix

@@ -0,0 +1,66 @@
+{ config, lib, ... }:
+{
+  options.clanCore.secrets = lib.mkOption {
+    type = lib.types.attrsOf
+      (lib.types.submodule (secret: {
+        options = {
+          name = lib.mkOption {
+            type = lib.types.str;
+            default = secret.config._module.args.name;
+            description = ''
+              namespace of the secret
+            '';
+          };
+          generator = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            description = ''
+              script to generate the secret.
+              can be set to null. then the user has to provide the secret via the clan cli
+            '';
+          };
+          secrets = lib.mkOption {
+            type = lib.types.attrsOf (lib.types.submodule (secret: {
+              options = {
+                name = lib.mkOption {
+                  type = lib.types.str;
+                  description = ''
+                    name of the secret
+                  '';
+                  default = secret.config._module.args.name;
+                };
+              };
+            }));
+            description = ''
+              path where the secret is located in the filesystem
+            '';
+          };
+          facts = lib.mkOption {
+            type = lib.types.attrsOf (lib.types.submodule (fact: {
+              options = {
+                name = lib.mkOption {
+                  type = lib.types.str;
+                  description = ''
+                    name of the fact
+                  '';
+                  default = fact.config._module.args.name;
+                };
+                path = lib.mkOption {
+                  type = lib.types.str;
+                  description = ''
+                    path to a fact which is generated by the generator
+                  '';
+                  default = "${config.clanCore.clanDir}/facts/${config.clanCore.machineName}/${fact.config._module.args.name}";
+                };
+                value = lib.mkOption {
+                  default = builtins.readFile fact.config.path;
+                };
+              };
+            }));
+          };
+        };
+      }));
+  };
+  imports = [
+    ./sops.nix # for now we have only one implementation, thats why we import it here and not in clanModules
+  ];
+}

nixosModules/clanCore/secrets/sops.nix

@@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }:
+{
+  config = {
+    system.clan.generateSecrets = pkgs.writeScript "generate_secrets" ''
+      #!/bin/sh
+      set -efu
+      set -x # remove for prod
+
+      PATH=$PATH:${lib.makeBinPath [
+        config.clanCore.clanPkgs.clan-cli
+      ]}
+
+      # initialize secret store
+      if ! clan secrets machines list | grep -q ${config.clanCore.machineName}; then (
+        INITTMP=$(mktemp -d)
+        trap 'rm -rf "$INITTMP"' EXIT
+        ${pkgs.age}/bin/age-keygen -o "$INITTMP/secret" 2> "$INITTMP/public"
+        PUBKEY=$(cat "$INITTMP/public" | sed 's/.*: //')
+        clan secrets machines add ${config.clanCore.machineName} "$PUBKEY"
+        tail -1 "$INITTMP/secret" | clan secrets set --machine ${config.clanCore.machineName} ${config.clanCore.machineName}-age.key
+      ) fi
+
+      ${lib.foldlAttrs (acc: n: v: ''
+        ${acc}
+        # ${n}
+        # if any of the secrets are missing, we regenerate all connected facts/secrets
+        (if ! ${lib.concatMapStringsSep " && " (x: "clan secrets get ${config.clanCore.machineName}-${x.name} >/dev/null") (lib.attrValues v.secrets)}; then
+
+          facts=$(mktemp -d)
+          trap "rm -rf $facts" EXIT
+          secrets=$(mktemp -d)
+          trap "rm -rf $secrets" EXIT
+          ${v.generator}
+
+          ${lib.concatMapStrings (fact: ''
+            mkdir -p "$(dirname ${fact.path})"
+            cp "$facts"/${fact.name} ${fact.path}
+          '') (lib.attrValues v.facts)}
+
+          ${lib.concatMapStrings (secret: ''
+            cat "$secrets"/${secret.name} | clan secrets set --machine ${config.clanCore.machineName} ${config.clanCore.machineName}-${secret.name}
+          '') (lib.attrValues v.secrets)}
+        fi)
+      '') "" config.clanCore.secrets}
+    '';
+    sops.secrets =
+      let
+        encryptedForThisMachine = name: type:
+          let
+            symlink = config.clanCore.clanDir + "/sops/secrets/${name}/machines/${config.clanCore.machineName}";
+          in
+          # WTF, nix bug, my symlink is in the nixos module detected as a directory also it works in the repl
+          type == "directory" && (builtins.readFileType symlink == "directory" || builtins.readFileType symlink == "symlink");
+        secrets = lib.filterAttrs encryptedForThisMachine (builtins.readDir (config.clanCore.clanDir + "/sops/secrets"));
+      in
+      builtins.mapAttrs
+        (name: _: {
+          sopsFile = config.clanCore.clanDir + "/sops/secrets/${name}/secret";
+          format = "binary";
+        })
+        secrets;
+  };
+}