{ pkgs, lib, ... }:
let
  diskName = "nixos";
  espSize = "500M";
  bootPartName = "ESP";
  rootPartName = "primary";
  volumeGroupName = "mainpool";
  rootLvName = "root";
  zrootKey = "/run/secret/zroot.key";
  zfsLoadKeyScript = pkgs.writeShellApplication {
    name = "load-zfs-key";
    runtimeInputs = [ pkgs.zfs ];
    text = ''
      if ! zfs load-key -L ${zrootKey} zroot; then
        echo -n "tempkey" /tmp/tempkey
        zfs load-key -L /temp/tempkey zroot
        zfs change-key -o keylocation=${zrootKey} zroot
      fi
    '';
  };
in
{
  khscodes.services.vault-agent.templates = [
    {
      contents = ''
        {{- with pkiCert "mx.kaareskovgaard.net/data/zroot_encryption" -}}
        {{ .Data.data.key }}
        {{- end -}}
      '';
      destination = zrootKey;
      owner = "root";
      group = "root";
      perms = "0600";
      exec = lib.getExe zfsLoadKeyScript;
      restartUnits = [
        "postfix.service"
        "dovecot2.service"
        "rspamd.service"
      ];
    }
  ];
  khscodes.infrastructure.provisioning.pre.modules = [
    {
      resource.random_password.zroot_encryption_key = {
        length = 48;
        numeric = true;
        lower = true;
        upper = true;
        special = false;
      };
      resource.vault_kv_secret_v2.test = {
        mount = "mx.kaareskovgaard.net";
        name = "zroot_encryption";
        data_json = ''
          {
            "key": ''${ jsonencode(resource.random_password.zroot_encryption_key.result) }
          }
        '';
      };
    }
  ];
  khscodes.infrastructure.vault-server-approle.policy = {
    "mx.kaareskovgaard.net/data/zroot_encryption" = {
      capabilities = [ "read" ];
    };
  };
  disko.devices.disk = {
    "${diskName}" = {
      device = "/dev/sda";
      type = "disk";
      content = {
        type = "gpt";
        partitions = {
          "${bootPartName}" = {
            size = espSize;
            type = "EF00";
            content = {
              type = "filesystem";
              format = "vfat";
              mountpoint = "/boot";
              mountOptions = [ "umask=0077" ];
            };
          };
          "${rootPartName}" = {
            size = "100%";
            content = {
              type = "lvm_pv";
              vg = volumeGroupName;
            };
          };
        };
      };
    };
    zroot1 = {
      device = "/dev/sdb";
      type = "disk";
      content = {
        type = "gpt";
        partitions = {
          zfs = {
            size = "100%";
            content = {
              type = "zfs";
              pool = "zroot";
            };
          };
        };
      };
    };
  };
  devices.lvm_vg = {
    "${volumeGroupName}" = {
      type = "lvm_vg";
      lvs = {
        "${rootLvName}" = {
          size = "100%";
          content = {
            type = "filesystem";
            format = "ext4";
            mountpoint = "/";
            mountOptions = [ "defaults" ];
          };
        };
      };
    };
  };
  zpool = {
    zroot = {
      type = "zpool";
      rootFsOptions = {
        mountpoint = "none";
        compression = "zstd";
        acltype = "posixacl";
        xattr = "sa";
        "com.sun:auto-snapshot" = "true";
      };
      options.ashift = "12";
      datasets = {
        "mailserver" = {
          type = "zfs_fs";
          options = {
            encryption = "aes-256-gcm";
            keyformat = "passphrase";
            keylocation = "file:///tmp/tempkey";
          };
        };
        "mailserver/vmail" = {
          type = "zfs_fs";
          mountpoint = "/var/mailserver/vmail";
        };
        "mailserver/indices" = {
          type = "zfs_fs";
          mountpoint = "/var/mailserver/indices";
        };
      };
      mode = {
        topology = {
          type = "topology";
          vdev = [
            {
              members = [ "zroot1" ];
            }
          ];
        };
      };
    };
  };
}
