install.fairie/home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.tmpl

#!/usr/bin/env bash

{{ includeTemplate "universal/logg" }}

XDG_CONFIG_HOME="$HOME/.config"

### Decrypt private key if it is not already present
if [ ! -f "${XDG_CONFIG_HOME}/age/chezmoi.txt" ]; then
  mkdir -p "${XDG_CONFIG_HOME}/age"
  logg star '`PRESS ENTER` if you have not set up your encryption token yet'
  age --decrypt --output "${XDG_CONFIG_HOME}/age/chezmoi.txt" "{{ .chezmoi.sourceDir }}/key.txt.age" || EXIT_CODE=$?
  if [ -n "$EXIT_CODE" ]; then
    logg info 'Proceeding without decrypting age encryption key stored at `~/.local/share/chezmoi/home/key.txt.age`'
    logg info 'To have Chezmoi handle your encryption (so you can store your private files publicly) take a look at https://shorturl.at/jkpzG'
    logg info 'Removing all files that begin with encrypted_ because decryption failed'
    find "$HOME/.local/share/chezmoi" -type f -name "encrypted_*" | while read ENCRYPTED_FILE; do
      logg info "Removing $ENCRYPTED_FILE"
      rm -f "$ENCRYPTED_FILE"
      FALLBACK_FILENAME="$(echo "$ENCRYPTED_FILE" | sed 's/encrypted_/encrypted-fallback_/')"
      if [ -f "$FALLBACK_FILENAME" ]; then
        NEW_FALLBACK_FILENAME="$(echo "$ENCRYPTED_FILE" | sed 's/encrypted-fallback_//')"
        cp "$FALLBACK_FILENAME" "$NEW_FALLBACK_FILENAME"
      fi
    done
  fi
fi

### Ensure proper permissions on private key
if [ -f "${XDG_CONFIG_HOME}/age/chezmoi.txt" ]; then
  logg info 'Ensuring proper permissions on Chezmoi / age decryption key'
  logg info 'Chezmoi / age decryption key is stored in '"${XDG_CONFIG_HOME}/age/chezmoi.txt"
  chmod 600 "${XDG_CONFIG_HOME}/age/chezmoi.txt"
fi