{ pkgs, ... }:
let
  image = pkgs.fetchurl {
    url = "https://cdimage.debian.org/images/cloud/bookworm/20250703-2162/debian-12-genericcloud-amd64-20250703-2162.qcow2";
    hash = "sha256-hfcP4INSfyP90f9DWDqMLXsZa7teXMhePwK6Vyk+dG4=";
  };
  script = pkgs.writeShellApplication {
    name = "upload-openstack-base-debian-image-wrapped";
    runtimeInputs = [
      pkgs.openstackclient
    ];
    text = ''
      export OS_AUTH_URL="''${TF_VAR_openstack_auth_url:-}"
      # With the addition of Keystone we have standardized on the term **project**
      # as the entity that owns the resources.
      # export OS_PROJECT_ID=4840ee3bdd0e4285bc46586b8e14aafb
      export OS_PROJECT_NAME="khs"
      export OS_USER_DOMAIN_NAME="Default"
      export OS_PROJECT_DOMAIN_ID="default"
      # In addition to the owning entity (tenant), OpenStack stores the entity
      # performing the action as the **user**.
      export OS_USERNAME="''${TF_VAR_openstack_username:-}"
      export OS_PASSWORD="''${TF_VAR_openstack_password:-}"
      # If your configuration has multiple regions, we set that information here.
      # OS_REGION_NAME is optional and only valid in certain environments.
      export OS_REGION_NAME="''${TF_VAR_openstack_region:-}"
      export OS_INTERFACE="''${TF_VAR_endpoint_type:-}"
      export OS_IDENTITY_API_VERSION=3


      openstack image create \
        --container-format bare \
        --disk-format qcow2 \
        --property hw_disk_bus=scsi \
        --property hw_scsi_model=virtio-scsi \
        --property os_type=linux \
        --property os_distro=debian \
        --property os_admin_user=debian \
        --property os_version='12.0.0' \
        --file ${image} \
        debian-12
    '';
  };
in
pkgs.writeShellApplication {
  name = "upload-openstack-base-debian-image";
  runtimeInputs = [
    pkgs.khscodes.openbao-helper
    script
  ];
  text = ''
    openbao-helper wrap-program -e openstack -- upload-openstack-base-debian-image-wrapped
  '';
}
