# A hive. Identical on hive-one and hive-two: the machine `hive-<name>` runs the
# hive `<name>`.
{ config, lib, ... }:
let
  # The leaves for this hive, copied from swarm-central, where the secret store
  # runs: `client.pem` and `client-key.pem` from
  # `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
  # `hive-leaf.pem` and `hive-leaf-key.pem`, which the hive's gateway
  # certificate comes from. Both pairs sit in one directory.
  pki = "/var/lib/swarm-pki";
in
{
  services.hyperhive.deploy = {
    hive-controller = {
      enable = true;
      hiveName = lib.removePrefix "hive-" config.networking.hostName;
    };
    bao = {
      clientCertFile = "${pki}/client.pem";
      clientKeyFile = "${pki}/client-key.pem";
    };
  };

  # The dashboard is reachable over the VPN only.
  networking.firewall.interfaces.wg0.allowedTCPPorts = [
    config.services.hyperhive.gateway.httpsPort
  ];
}