homeio

1import "server-only";
2
3import { eq, sql } from "drizzle-orm";
4import { db } from "@/lib/server/db/drizzle";
5import { settings } from "@/lib/server/db/schema";
6import { decryptSecret, encryptSecret } from "@/lib/server/modules/files/secrets";
7import type { TailscaleConfigPublic } from "@/lib/shared/contracts/tailscale";
8
9export type TailscaleConfig = {
10  tailnet: string;
11  apiKey: string;
12};
13
14async function ensureSettingsRow() {
15  await db.execute(sql`
16    INSERT INTO settings (id, appearance_json, updated_at)
17    VALUES ('singleton', '{}', NOW())
18    ON CONFLICT (id) DO NOTHING
19  `);
20}
21
22export async function getTailscaleConfig(): Promise<TailscaleConfig | null> {
23  await ensureSettingsRow();
24
25  const rows = await db
26    .select({
27      tailnet: settings.tailscaleTailnet,
28      apiKeyCiphertext: settings.tailscaleApiKeyCiphertext,
29      apiKeyIv: settings.tailscaleApiKeyIv,
30      apiKeyTag: settings.tailscaleApiKeyTag,
31    })
32    .from(settings)
33    .where(eq(settings.id, "singleton"))
34    .limit(1);
35
36  const row = rows[0];
37  if (!row?.tailnet || !row.apiKeyCiphertext || !row.apiKeyIv || !row.apiKeyTag) {
38    return null;
39  }
40
41  return {
42    tailnet: row.tailnet,
43    apiKey: decryptSecret({
44      ciphertext: row.apiKeyCiphertext,
45      iv: row.apiKeyIv,
46      tag: row.apiKeyTag,
47    }),
48  };
49}
50
51export async function getTailscaleConfigPublic(): Promise<TailscaleConfigPublic> {
52  await ensureSettingsRow();
53
54  const rows = await db
55    .select({
56      tailnet: settings.tailscaleTailnet,
57      apiKeyCiphertext: settings.tailscaleApiKeyCiphertext,
58    })
59    .from(settings)
60    .where(eq(settings.id, "singleton"))
61    .limit(1);
62
63  const row = rows[0];
64  return {
65    tailnet: row?.tailnet ?? "",
66    hasApiKey: Boolean(row?.apiKeyCiphertext),
67  };
68}
69
70export async function saveTailscaleConfig(config: TailscaleConfig): Promise<void> {
71  await ensureSettingsRow();
72
73  const encryptedApiKey = encryptSecret(config.apiKey);
74
75  await db
76    .update(settings)
77    .set({
78      tailscaleTailnet: config.tailnet,
79      tailscaleApiKeyCiphertext: encryptedApiKey.ciphertext,
80      tailscaleApiKeyIv: encryptedApiKey.iv,
81      tailscaleApiKeyTag: encryptedApiKey.tag,
82      updatedAt: new Date(),
83    })
84    .where(eq(settings.id, "singleton"));
85}
86
87export async function clearTailscaleConfig(): Promise<void> {
88  await ensureSettingsRow();
89
90  await db
91    .update(settings)
92    .set({
93      tailscaleTailnet: null,
94      tailscaleApiKeyCiphertext: null,
95      tailscaleApiKeyIv: null,
96      tailscaleApiKeyTag: null,
97      updatedAt: new Date(),
98    })
99    .where(eq(settings.id, "singleton"));
100}
101