{ config, pkgs, ... }:

{
  # Keep the LDAP bind password out of Dex's generated configuration. The
  # Dex LDAP connector expands $LDAP_BIND_PW after parsing the YAML, so this
  # covers the connector without putting the secret in the store.
  systemd.services.dex-ldap-env = {
    description = "Render the pinix Dex LDAP bind password into a runtime env file";
    before = [ "dex.service" ];
    requiredBy = [ "dex.service" ];
    after = [ "lldap.service" ];
    wants = [ "lldap.service" ];
    restartTriggers = [ config.age.secrets.pinixLldapAdmin.file ];
    path = [ pkgs.coreutils pkgs.gnused ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      RuntimeDirectory = "dex-ldap-env";
      RuntimeDirectoryMode = "0700";
      ExecStart = "${pkgs.writeShellScript "pinix-dex-ldap-env" (builtins.readFile ../../../scripts/dex-ldap-env.sh)} ${config.age.secrets.pinixLldapAdmin.path} /run/dex-ldap-env/bindpw.env";
    };
  };

  services.dex = {
    enable = true;
    environmentFile = "/run/dex-ldap-env/bindpw.env";
    settings = {
      logger.level = "info";
      issuer = "https://dex.${config.domain2}/dex";

      # Unlike the old blunix module, keep Dex's signing keys and sessions
      # across a restart. StateDirectory is created for the DynamicUser by
      # systemd and remains outside the Nix store.
      storage = {
        type = "sqlite3";
        config.file = "/var/lib/dex/dex.db";
      };

      web.http = "127.0.0.1:5556";

      # This is a separate control plane during bootstrap. Existing clients
      # continue using blunix until the new LLDAP account/group and a new
      # Headscale pre-auth key have been created manually.
      staticClients = [
        {
          id = "headscale";
          name = "headscale";
          redirectURIs = [ "https://head.${config.domain2}/oidc/callback" ];
          secretFile = config.age.secrets.oidcHeadscale.path;
        }
      ];

      connectors = [
        {
          type = "ldap";
          id = "ldap";
          name = "LDAP";
          config = {
            host = "127.0.0.1:3890";
            insecureNoSSL = true;
            startTLS = false;
            bindDN = "uid=admin,ou=people,${config.ldapBaseDN2}";
            bindPW = "$LDAP_BIND_PW";
            userSearch = {
              baseDN = "ou=people,${config.ldapBaseDN2}";
              username = "uid";
              idAttr = "uid";
              emailAttr = "mail";
              nameAttr = "displayName";
              preferredUsernameAttr = "uid";
            };
            groupSearch = {
              baseDN = "ou=groups,${config.ldapBaseDN2}";
              filter = "(objectClass=groupOfUniqueNames)";
              userMatchers = [
                {
                  userAttr = "DN";
                  groupAttr = "member";
                }
              ];
              nameAttr = "cn";
            };
          };
        }
      ];
    };
  };

  systemd.services.dex = {
    after = [ "lldap.service" ];
    wants = [ "lldap.service" ];
    serviceConfig = {
      StateDirectory = "dex";
      StateDirectoryMode = "0700";
      Restart = "on-failure";
      RestartSec = "5s";
    };
    restartTriggers = [
      config.age.secrets.pinixLldapAdmin.file
      config.age.secrets.oidcHeadscale.file
    ];
  };
}