let
  publicKeyBegin = ''"-----BEGIN PUBLIC KEY-----\n"'';
  publicKeyEnd = ''"-----END PUBLIC KEY-----\n"'';
  dkimPublicKey =
    tls_key:
    ''''${ replace(trimprefix(trimsuffix(${tls_key}.public_key_pem, ${publicKeyEnd}), ${publicKeyBegin}), "\n", "") }'';
in
{
  khscodes.services.vault-agent.templates = [
    {
      contents = ''
        {{- with secret "forgejo/data/mailserver/dkim/rsa" -}}
        {{ .Data.data.dkim_private_key }}
        {{- end -}}
      '';
      destination = "/var/lib/vault-agent/mailserver/dkim/rsa_private.key";
      perms = "0600";
      owner = "rspamd";
      group = "rspamd";
      restartUnits = [
        "rspamd.service"
        "postfix.service"
      ];
    }
    {
      contents = ''
        {{- with secret "forgejo/data/mailserver/dkim/ed25519" -}}
        {{ .Data.data.dkim_private_key }}
        {{- end -}}
      '';
      destination = "/var/lib/vault-agent/mailserver/dkim/ed25519_private.key";
      perms = "0600";
      owner = "rspamd";
      group = "rspamd";
      restartUnits = [
        "rspamd.service"
        "postfix.service"
      ];
    }
  ];
  khscodes.infrastructure.provisioning.pre.modules = [
    (
      { config, ... }:
      {
        terraform.required_providers.tls = {
          source = "hashicorp/tls";
          version = "4.1.0";
        };
        provider.tls = { };

        resource.tls_private_key.dkim_rsa = {
          algorithm = "RSA";
          rsa_bits = 2048;
        };
        resource.tls_private_key.dkim_ed25519 = {
          algorithm = "ED25519";
        };

        resource.cloudflare_record.dkim_rsa = {
          name = "snm_rsa._domainkey";
          zone_id = "\${ data.cloudflare_zone.dns_zone.id }";
          type = "TXT";
          content = ''"v=DKIM1;k=rsa;p=${dkimPublicKey "tls_private_key.dkim_rsa"}"'';
          comment = "app=kas.codes";
          ttl = 600;
        };

        resource.cloudflare_record.dkim_ed25519 = {
          name = "snm_ed25519._domainkey";
          zone_id = "\${ data.cloudflare_zone.dns_zone.id }";
          type = "TXT";
          content = ''"v=DKIM1;k=ed25519;p=${dkimPublicKey "tls_private_key.dkim_ed25519"}"'';
          comment = "app=kas.codes";
          ttl = 600;
        };

        resource.cloudflare_record.spf = {
          name = "@";
          zone_id = "\${ data.cloudflare_zone.dns_zone.id }";
          type = "TXT";
          content = ''"v=spf1 ip4:${config.khscodes.hcloud.output.server.compute.ipv4_address} ip6:${config.khscodes.hcloud.output.server.compute.ipv6_address} -all"'';
          comment = "app=kas.codes";
          ttl = 600;
        };
        resource.cloudflare_record.dmarc = {
          name = "_dmarc";
          zone_id = "\${ data.cloudflare_zone.dns_zone.id }";
          type = "TXT";
          content = ''"v=DMARC1; p=reject; adkim=s; aspf=s;"'';
          comment = "app=kas.codes";
          ttl = 600;
        };

        resource.vault_kv_secret_v2.dkim_rsa_secret = {
          mount = config.khscodes.vault.output.mount.forgejo.path;
          name = "mailserver/dkim/rsa";
          data_json = ''
            { "dkim_private_key": ''${ jsonencode(resource.tls_private_key.dkim_rsa.private_key_pem) } }
          '';
        };

        resource.vault_kv_secret_v2.dkim_ed25519_secret = {
          mount = config.khscodes.vault.output.mount.forgejo.path;
          name = "mailserver/dkim/ed25519";
          data_json = ''
            { "dkim_private_key": ''${ jsonencode(resource.tls_private_key.dkim_ed25519.private_key_pem) } }
          '';
        };
      }
    )
  ];
}
