{ pkgs, ... }:
pkgs.writeShellApplication {
  name = "instance-new-secret-id";
  runtimeInputs = [
    pkgs.openbao
    pkgs.uutils-coreutils-noprefix
  ];
  text = ''
    instance="''${1:-}"
    if [[ "$instance" == "" ]]; then
      >&2 echo "Usage: instance-new-secret-id <instance>"
      exit 1
    fi
    secret_id="$(bao write -field=wrapping_token -force -wrap-ttl=1m "auth/approle/role/$instance/secret-id")"
    role_id="$(bao read -field=role_id "auth/approle/role/$instance/role-id")"

    ssh -t "$instance" -- sudo bao-import-secret "$role_id" "$secret_id"
  '';
}
