infrastructure/modules/extern/home/ssh.nix

let
  sshHostModule = {
    lib,
    gensokyo-zone,
    osConfig,
    homeConfig,
    config,
    name,
    ...
  }: let
    inherit (gensokyo-zone.lib) unmerged coalesce mkAlmostOptionDefault mapListToAttrs;
    inherit (lib.options) mkOption mkEnableOption;
    inherit (lib.modules) mkIf mkMerge mkOptionDefault mkDefault;
    inherit (lib.lists) head elem optional filter unique intersectLists;
    inherit (lib.attrsets) filterAttrs mapAttrsToList nameValuePair;
    inherit (lib.strings) optionalString;
    inherit (osConfig.gensokyo-zone) access;
    cfg = gensokyo-zone.ssh.cfg;
    system = gensokyo-zone.systems.${config.systemName}.config;
    networks = let
      fallbackNetwork =
        if system.network.networks.local.enable or false && access.local.enable
        then "local"
        else if system.access.global.enable
        then null
        else if system.network.networks.int.enable or false
        then "int"
        else if system.network.networks.local.enable or false
        then "local"
        else null;
      networks = map (name: coalesce [name fallbackNetwork]) config.networks;
    in
      unique networks;
  in {
    options = with lib.types; {
      enable =
        mkEnableOption "ssh client configuration"
        // {
          default = true;
        };
      name = mkOption {
        type = str;
        default = name;
      };
      systemName = mkOption {
        type = str;
      };
      user = mkOption {
        type = nullOr str;
        default = cfg.user;
      };
      networks = mkOption {
        type = listOf (nullOr str);
      };
      hostName = mkOption {
        type = nullOr str;
      };
      extraOptions = mkOption {
        type = unmerged.types.attrs;
      };
      set = {
        matchBlocksSettings = mkOption {
          type = unmerged.types.attrs;
          default = {};
        };
      };
    };
    config = {
      hostName = mkOptionDefault system.access.hostName;
      extraOptions = mkOptionDefault (unmerged.mergeAttrs cfg.extraOptions);
      user = mkIf (config.systemName == "u7pro") (mkAlmostOptionDefault "kittywitch");
      networks = let
        enabledNetworks = filterAttrs (_: net: net.enable) system.network.networks;
        networkNames = mapAttrsToList (_: net: net.name) enabledNetworks;
        networks = filter (name: name == null || elem name networkNames) cfg.networks;
      in
        mkOptionDefault networks;
      set = {
        matchBlocksSettings = let
          canonNetworkName' = intersectLists networks [null "int" "local"];
          canonNetworkName =
            if canonNetworkName' != []
            then head canonNetworkName'
            else null;
        in
          mapListToAttrs (network: let
            name = config.name + optionalString (network != canonNetworkName) "-${network}";
            inherit (system.exports.services) sshd;
            port = head (
              optional (network == null && sshd.ports.global.enable or false) sshd.ports.global.port
              ++ optional (sshd.ports.public.enable or false) sshd.ports.public.port
              ++ [sshd.ports.standard.port]
            );
            needsProxy = network == "int" || (network == "local" && !access.local.enable);
          in
            nameValuePair name {
              hostname = mkDefault (
                if network == null
                then system.access.fqdn
                else system.network.networks.${network}.fqdn
              );
              user = mkIf (config.user != null) (mkDefault config.user);
              port = mkIf (port != 22) (mkDefault port);
              proxyJump = mkIf needsProxy (lib.warnIf (config.name == cfg.proxyJump) "proxyJump self-reference" (mkAlmostOptionDefault (
                cfg.proxyJump
              )));
              identitiesOnly = mkIf (config.systemName == "u7pro") (mkAlmostOptionDefault true);
              extraOptions = mkMerge [
                (unmerged.mergeAttrs config.extraOptions)
                {
                  HostKeyAlias = mkIf (config.hostName != null && network != null) (mkOptionDefault system.access.fqdn);
                }
              ];
            })
          networks;
      };
    };
  };
  sshModule = {
    lib,
    gensokyo-zone,
    osConfig,
    homeConfig,
    config,
    pkgs,
    ...
  }: let
    inherit (lib.options) mkOption mkEnableOption;
    inherit (lib.modules) mkIf mkMerge mkOptionDefault;
    inherit (lib.attrsets) mapAttrs mapAttrsToList;
    inherit (gensokyo-zone.lib) unmerged;
    inherit (osConfig.gensokyo-zone) access;
  in {
    options = with lib.types; {
      enable = mkEnableOption "ssh client configuration";
      user = mkOption {
        type = nullOr str;
        default = null;
      };
      hosts = mkOption {
        type = attrsOf (submoduleWith {
          modules = [sshHostModule];
          specialArgs = {
            inherit gensokyo-zone osConfig homeConfig pkgs;
          };
        });
      };
      networks = mkOption {
        type = listOf (nullOr str);
        default = [null];
      };
      proxyJump = mkOption {
        type = str;
      };
      extraOptions = mkOption {
        type = unmerged.types.attrs;
        default = {};
      };
      set = {
        matchBlocksSettings = mkOption {
          type = unmerged.types.attrs;
          default = {};
        };
      };
    };
    config = {
      proxyJump = mkOptionDefault (
        if config.hosts.hakurei.enable
        then config.hosts.hakurei.name
        else gensokyo-zone.systems.hakurei.config.access.fqdn
      );
      networks = mkOptionDefault [
        (mkIf access.local.enable "local")
        (mkIf access.tail.enabled "tail")
      ];
      hosts = mapAttrs (name: system: let
        enabled = system.config.access.online.enable && system.config.exports.services.sshd.enable;
      in
        mkIf enabled {
          systemName = mkOptionDefault name;
        })
      gensokyo-zone.systems;
      set = {
        matchBlocksSettings = let
          mkMatchBlocksHost = host: mkIf host.enable (unmerged.mergeAttrs host.set.matchBlocksSettings);
        in
          mkMerge (
            mapAttrsToList (_: mkMatchBlocksHost) config.hosts
          );
      };
    };
  };
in
  {
    config,
    osConfig,
    lib,
    gensokyo-zone,
    pkgs,
    ...
  }: let
    inherit (lib.options) mkOption;
    inherit (lib.modules) mkIf;
    inherit (gensokyo-zone.lib) unmerged;
    cfg = config.gensokyo-zone.ssh;
  in {
    options.gensokyo-zone.ssh = mkOption {
      type = lib.types.submoduleWith {
        modules = [sshModule];
        specialArgs = {
          inherit gensokyo-zone pkgs;
          inherit osConfig;
          homeConfig = config;
        };
      };
      default = {};
    };

    config = {
      gensokyo-zone.ssh = {
      };
      programs.ssh = mkIf cfg.enable {
        matchBlocks = unmerged.mergeAttrs cfg.set.matchBlocksSettings;
      };
      lib.gensokyo-zone.ssh = {
        inherit cfg sshModule sshHostModule;
      };
    };
  }