# shellcheck disable=SC2148
export DIRENV_WARN_TIMEOUT=0
export NIXPKGS_ALLOW_UNFREE=1
use flake . --impure

export_sops_secret() {
  local var_name="$1" file="$2" key="$3" value
  if value=$(sops -d --extract "$key" "$file" 2>/dev/null); then
    export "$var_name=$value"
  else
    echo "direnv: skipping $var_name (could not decrypt $file)" >&2
  fi
}

export_sops_secret CLOUDFLARE_API_TOKEN secrets/cloudflare.yaml '["api_token"]'
export_sops_secret HCLOUD_TOKEN secrets/hetzner.yaml '["api_token"]'

# Terraform's s3 backend (pointing at B2) reads these.
export_sops_secret AWS_ACCESS_KEY_ID secrets/b2.yaml '["B2_KEY_ID"]'
export_sops_secret AWS_SECRET_ACCESS_KEY secrets/b2.yaml '["B2_APP_KEY"]'

# B2 native provider reads these.
export_sops_secret B2_APPLICATION_KEY_ID secrets/b2.yaml '["B2_KEY_ID"]'
export_sops_secret B2_APPLICATION_KEY secrets/b2.yaml '["B2_APP_KEY"]'

# Tailscale provider reads this.
export_sops_secret TAILSCALE_API_KEY secrets/tailscale-api.yaml '["api_key"]'
