# swarm-services: the forge, the matrix homeserver, SSO, the queue, and the
# metrics and log stack.
{ config, lib, ... }:
let
  hyperhive = config.services.hyperhive;

  # The secret store runs on swarm-central, so each service here checks it
  # against the CA (`ca.pem`) and reads it with a leaf, both copied from there.
  # `pair "grafanaOidc" "grafana-oidc"` names the options
  # `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
  # `grafana-oidc.pem` and `grafana-oidc-key.pem`.
  pki = "/var/lib/swarm-pki";
  pair = option: stem: {
    "${option}ClientCertFile" = "${pki}/${stem}.pem";
    "${option}ClientKeyFile" = "${pki}/${stem}-key.pem";
  };
in
{
  services.hyperhive = {
    # Everything once-per-swarm that is not placed elsewhere below.
    deploy.allSwarmServices = true;

    # The gateway's ports are open to everyone. The forge and the matrix
    # homeserver answer there, and so does the SSO login they send browsers
    # to. Every other vhost here answers on the private addresses only.
    gateway.openFirewall = true;
    gateway.vhosts =
      lib.genAttrs
        (with hyperhive.swarm; [
          nats.domain
          otel.domain
          grafana.domain
          victoriametrics.domain
          victorialogs.domain
        ])
        (_: {
          public = false;
        });

    deploy.bao = lib.mergeAttrsList [
      {
        enable = false;
        serverCaFile = "${pki}/ca.pem";
      }
      (pair "forgePublisher" "forge-publisher")
      (pair "servicesIssuer" "services-issuer")
      (pair "grafanaOidc" "grafana-oidc")
      (pair "otelOidc" "otel-oidc")
      (pair "forwarderOidc" "forwarder-oidc")
      (pair "reviewClassifier" "review-classifier")
      (pair "notifyRouter" "notify-router")
      (pair "claudeLogin" "claude-login")
      (pair "ciMetrics" "ci-metrics")
    ];
    deploy.matrix = {
      ctlBaoClientCertFile = "${pki}/matrix-ctl.pem";
      ctlBaoClientKeyFile = "${pki}/matrix-ctl-key.pem";
    };
    deploy.nats = {
      baoClientCertFile = "${pki}/nats.pem";
      baoClientKeyFile = "${pki}/nats-key.pem";
      authBaoClientCertFile = "${pki}/nats-auth.pem";
      authBaoClientKeyFile = "${pki}/nats-auth-key.pem";
    };
    deploy.swarm-secret-publisher = {
      baoClientCertFile = "${pki}/secret-publisher.pem";
      baoClientKeyFile = "${pki}/secret-publisher-key.pem";
    };
    deploy.victoriametrics = {
      authBaoClientCertFile = "${pki}/metrics-auth.pem";
      authBaoClientKeyFile = "${pki}/metrics-auth-key.pem";
    };
    deploy.victorialogs = {
      authBaoClientCertFile = "${pki}/logs-auth.pem";
      authBaoClientKeyFile = "${pki}/logs-auth-key.pem";
    };
  };

  # The queue is reachable over the VPN only.
  networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.nats.port ];
}