# A hive. Identical on hive-one and hive-two: the machine `hive-<name>` runs the
# hive `<name>`.
{ config, lib, ... }:
let
  hyperhive = config.services.hyperhive;
  name = lib.removePrefix "hive-" config.networking.hostName;

  # The store's CA (`ca.pem`, from `/var/lib/swarm-bao-pki/`) and the leaves
  # for this hive, copied from swarm-central, where the secret store runs:
  # `client.pem` and `client-key.pem` from
  # `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
  # `hive-leaf.pem` and `hive-leaf-key.pem`, which the hive's gateway
  # certificate comes from. All of them sit in one directory.
  pki = "/var/lib/swarm-pki";
in
{
  services.hyperhive = {
    deploy = {
      hive-controller = {
        enable = true;
        hiveName = name;
      };
      bao = {
        serverCaFile = "${pki}/ca.pem";
        clientCertFile = "${pki}/client.pem";
        clientKeyFile = "${pki}/client-key.pem";
      };
    };

    # The hive's dashboard and its domain answer on the private addresses only.
    gateway.vhosts =
      lib.genAttrs
        [
          hyperhive.swarm.dashboardDomains.${name}
          hyperhive.swarm.hives.${name}.domain
        ]
        (_: {
          public = false;
        });
  };

  # The dashboard is reachable over the VPN only.
  networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.gateway.httpsPort ];
}