# What every hyperhive service nixos-container sets for itself, imported
# inside the container's own `config`.
#
# The host module that declares `containers.<name>` sets the options below.
# They restate host-side facts the container cannot read on its own: its
# evaluation is nested inside `containers.<name>`, and reading the host side
# back from in here recurses.
#
# ⚠️ The container is `Type=notify`: the host's start job lasts until this
# guest's job queue is empty and ends in a kill at the container's
# `timeoutStartSec`, one minute unless the host module sets more. A unit in that
# queue, wanted by `multi-user.target` or required by a unit that is, states a
# `TimeoutStartSec` below that limit; a fetch that needs longer fails fast,
# restarts with a growing delay, and starts what depends on it with
# `systemctl start --no-block` (./swarm-journal-forwarder.nix is the pattern).
# `module-eval-swarm-services-switch` fails on a unit whose budget, stated or the
# manager's 90 s default, reaches the limit, unless the unit is listed there with
# a reason. It also adds the budgets of units ordered one after another by
# `after`/`before`, and fails when the longest such chain reaches the limit (a
# unit listed there adds 0 s) or the ordering has a cycle.
{ config, lib, ... }:
let
  cfg = config.services.hyperhive.swarmContainer;
in
{
  options.services.hyperhive.swarmContainer = {
    privateNetwork = lib.mkOption {
      type = lib.types.bool;
      description = ''
        Must equal the host-side `containers.<name>.privateNetwork`. When
        `false` the container shares the host netns, so its own
        firewall.service would rewrite the HOST ruleset at every boot; the
        container's firewall is turned off and the host firewall owns all
        filtering.
      '';
    };

    writesOwnResolvConf = lib.mkOption {
      type = lib.types.bool;
      default = true;
      description = ''
        Something in this container writes `/etc/resolv.conf` itself (the
        `swarm-container-resolver.nix` unit, or a static file), so
        resolvconf is forced off. Left on, host-tracking would regenerate the
        file empty, since the host's copy doesn't cross the boundary after
        start.
      '';
    };
  };

  config = lib.mkMerge [
    {
      # A container that sets its own keeps it. Changing this value changes
      # it for every container that doesn't, and that is a state migration
      # for each of them.
      system.stateVersion = lib.mkDefault "26.05";
    }
    (lib.mkIf (!cfg.privateNetwork) {
      networking.firewall.enable = false;
    })
    # A private-netns container with an interface takes its address from the
    # hive's DHCP. dhcpcd counts an IPv4LL address as an address, so without
    # these `network-online.target` is reached on 169.254.x before the lease.
    (lib.mkIf cfg.privateNetwork {
      networking.dhcpcd.extraConfig = "noipv4ll";
      networking.dhcpcd.wait = "ipv4";
    })
    (lib.mkIf cfg.writesOwnResolvConf {
      networking.resolvconf.enable = lib.mkForce false;
    })
  ];
}