# swarm-heavyduty: the builder, the forge's CI runner and the binary cache.
{ config, lib, ... }:
let
  hyperhive = config.services.hyperhive;

  # Leaves copied from swarm-central, where the secret store runs. See
  # swarm-services.nix for the helper's naming.
  pki = "/var/lib/swarm-pki";
  pair = option: stem: {
    "${option}ClientCertFile" = "${pki}/${stem}.pem";
    "${option}ClientKeyFile" = "${pki}/${stem}-key.pem";
  };
in
{
  services.hyperhive = {
    deploy.builder.enable = true;
    deploy.ci-runner.enable = true;
    deploy.attic.enable = true;

    # The cache answers on the private addresses only.
    gateway.vhosts = lib.genAttrs [ hyperhive.swarm.attic.ownDomain ] (_: {
      public = false;
    });

    deploy.bao = lib.mergeAttrsList [
      (pair "builder" "builder")
      (pair "ciRunner" "ci-runner")
      (pair "attic" "attic")
      (pair "forwarderOidc" "forwarder-oidc")
      (pair "servicesIssuer" "services-issuer")
    ];
  };

  # The cache is served through the gateway, over the VPN only.
  networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.gateway.httpsPort ];
}