# swarm-central: the swarm controller (and the swarm UI it serves) and the
# secret store.
{ config, lib, ... }:
let
  mesh = import ./mesh.nix;
  hyperhive = config.services.hyperhive;
in
{
  services.hyperhive = {
    deploy.swarm-controller.enable = true;
    deploy.bao.enable = true;

    # The store also listens on this machine's VPN address, for the services
    # and hives on other machines.
    deploy.bao.extraListenAddresses = [ mesh.swarm-central.address ];

    # The gateway's ports are open to everyone. The swarm UI is the one vhost
    # that answers there; the store's browser UI answers on the private
    # addresses only.
    gateway.openFirewall = true;
    gateway.vhosts = lib.genAttrs [ hyperhive.swarm.bao.ui.domain ] (_: {
      public = false;
    });
  };

  # The store is reachable over the VPN only.
  networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.bao.port ];
}