# swarm-central: the swarm controller (and the swarm UI it serves) and the
# secret store.
{ config, ... }:
let
  mesh = import ./mesh.nix;
  hyperhive = config.services.hyperhive;
in
{
  services.hyperhive = {
    deploy.swarm-controller.enable = true;
    deploy.bao.enable = true;

    # The store also listens on this machine's VPN address, for the services
    # and hives on other machines.
    deploy.bao.extraListenAddresses = [ mesh.swarm-central.address ];

    # The swarm UI is public.
    gateway.openFirewall = true;
  };

  # The store is reachable over the VPN only.
  networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.bao.port ];
}