# swarm-services: the forge, the matrix homeserver, SSO, the queue, and the
# metrics and log stack.
{ config, lib, ... }:
let
  hyperhive = config.services.hyperhive;

  # The secret store runs on swarm-central, so each service here reads it with
  # a leaf copied from there. `pair "grafanaOidc" "grafana-oidc"` names the
  # options `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
  # `grafana-oidc.pem` and `grafana-oidc-key.pem`.
  pki = "/var/lib/swarm-pki";
  pair = option: stem: {
    "${option}ClientCertFile" = "${pki}/${stem}.pem";
    "${option}ClientKeyFile" = "${pki}/${stem}-key.pem";
  };
in
{
  services.hyperhive = {
    # Everything once-per-swarm that is not placed elsewhere below.
    deploy.allSwarmServices = true;

    # The forge and the matrix homeserver are public, and so is the SSO login
    # they send browsers to.
    gateway.openFirewall = true;

    deploy.bao = lib.mergeAttrsList [
      { enable = false; }
      (pair "forgePublisher" "forge-publisher")
      (pair "servicesIssuer" "services-issuer")
      (pair "grafanaOidc" "grafana-oidc")
      (pair "otelOidc" "otel-oidc")
      (pair "forwarderOidc" "forwarder-oidc")
      (pair "reviewClassifier" "review-classifier")
      (pair "notifyRouter" "notify-router")
      (pair "claudeLogin" "claude-login")
      (pair "ciMetrics" "ci-metrics")
    ];
    deploy.matrix = {
      ctlBaoClientCertFile = "${pki}/matrix-ctl.pem";
      ctlBaoClientKeyFile = "${pki}/matrix-ctl-key.pem";
    };
    deploy.nats = {
      baoClientCertFile = "${pki}/nats.pem";
      baoClientKeyFile = "${pki}/nats-key.pem";
      authBaoClientCertFile = "${pki}/nats-auth.pem";
      authBaoClientKeyFile = "${pki}/nats-auth-key.pem";
    };
    deploy.swarm-secret-publisher = {
      baoClientCertFile = "${pki}/secret-publisher.pem";
      baoClientKeyFile = "${pki}/secret-publisher-key.pem";
    };
    deploy.victoriametrics = {
      authBaoClientCertFile = "${pki}/metrics-auth.pem";
      authBaoClientKeyFile = "${pki}/metrics-auth-key.pem";
    };
    deploy.victorialogs = {
      authBaoClientCertFile = "${pki}/logs-auth.pem";
      authBaoClientKeyFile = "${pki}/logs-auth-key.pem";
    };
  };

  # The queue is reachable over the VPN only.
  networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.nats.port ];
}