{ pkgs, ... }:
pkgs.writeShellApplication {
  name = "set-unix-user-password";
  runtimeInputs = [
    pkgs.openssl
    pkgs.openbao
  ];
  text = ''
    function askpass() {
      stty -echo
      >&2 printf "%s: " "''${1:-Password}"
      read -r PASSWORD
      stty echo
      >&2 printf "\n"
      echo "$PASSWORD"
    }
    user="''${1:-}"
    if [[ "$user" == "" ]]; then
      >&2 echo "Usage: set-unix-user-password <username>"
      exit 1
    fi
    case "$user" in
      khs)
      ;;
      *)
        >&2 echo "Unknown user $user"
        exit 1
      ;;
    esac

    >&2 echo "Enter password for $user:"
    >&2 echo ""
    password="$(askpass "Password")"
    repeat_password="$(askpass "Repeat Password")"

    if [[ "$password" != "$repeat_password" ]]; then
      >&2 echo "Passwords don't match"
      exit 1
    fi
    hashed_password="$(openssl passwd -6 "$password")"
    echo -n "$hashed_password" | bao kv put -mount=unix-users "$user/password" hashedPassword=-
    >&2 echo "Password stored in vault"
  '';
}
