# Glue: point the swarm controller at the bao leaf minted for it.
#
# ONE PAIRING PER FILE — controller ← bao, and nothing else. Deleting this
# leaves a controller that takes operator-provided certificate paths, which is
# what every deployment that does not mint its own already does.
#
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
# leaf, because the thing that owns a private key owns issuing from it; a
# second signer would duplicate that file's `openssl` helper to no benefit.
# What belongs here is the pairing: which paths this host's controller reads.
#
# ⚠️ Gated on a PKI directory existing (the store runs here, or the operator
# named a reader leaf), not on the store alone. A controller on the store's own
# host is one deployment; a controller three networks away holding a leaf
# issued out of band is another, and both want the same wiring.
#
# Everything is `mkDefault`. An operator naming their own paths wins.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  deployCfg = hyperhiveCfg.deploy;
  baoDeploy = deployCfg.bao;

  # Where ./glue-bao-tls.nix puts the leaves. An operator's own `clientCertFile`
  # names the directory when one is set (an operator who moves the PKI moves
  # both, and the two cannot drift apart); on a store host that runs no hive
  # there is no reader leaf to derive from, so it is the store's directory.
  haveMintedPki = baoDeploy.clientCertFile != null || baoDeploy.enable;
  pkiDir =
    if baoDeploy.clientCertFile != null then
      builtins.dirOf baoDeploy.clientCertFile
    else if baoDeploy.enable then
      import ./lib/bao-pki-dir.nix
    else
      null;
in
{
  config = lib.mkIf (deployCfg.swarm-controller.enable && haveMintedPki) {
    services.hyperhive.deploy.swarm-controller = {
      baoClientCertFile = lib.mkDefault "${pkiDir}/controller.pem";
      baoClientKeyFile = lib.mkDefault "${pkiDir}/controller-key.pem";
    }
    // lib.optionalAttrs (baoDeploy.clientCaFile != null) {
      # The authority the store already trusts hives by, handed to the daemon
      # that has to write it into each hive's role. One file, two readers —
      # a second copy would authenticate hives the store does not.
      hiveClientCaFile = lib.mkDefault baoDeploy.clientCaFile;
    };
  };
}