#!/usr/bin/env rc

rules=$RULES
if(~ $rules ())
	rules=./secrets.nix

rules_name=`{basename $rules}
rules_dir=`{dirname $rules}
rules_dir=`{cd $rules_dir && pwd -P}
if(! ~ $status 0)
	exit 1
rules=$rules_dir/$rules_name

files=`{nix eval --raw --file $rules --apply \
	'rules: builtins.concatStringsSep "\n" (builtins.attrNames rules)'}
if(! ~ $status 0)
	exit 1

if(! cd $rules_dir)
	exit 1

failed=()
for(file in $files) {
	echo rekeying $file... >[1=2]
	if(! RULES=$rules EDITOR=: agenix -e $file $*) {
		echo skipping $file after rekey failed >[1=2]
		failed=($failed $file)
	}
}

if(! ~ $failed ()) {
	printf '\nFailed to rekey %d secret(s):\n' $#failed >[1=2]
	for(file in $failed)
		printf '  %s\n' $file >[1=2]
	exit 1
}

echo >[1=2]
echo All secrets rekeyed successfully. >[1=2]