# The fixtures more than one `checks.module-eval-*` cluster reads, each
# evaluated once. ../checks.nix imports this file once and hands the result to
# every cluster that uses one; a cluster rebinds the fixture under its own
# local name.
#
# ⚠️ Sharing only pays when ../checks.nix instantiates this file ONCE: a
# cluster that ran `import ./shared.nix` itself would get its own copy of
# every fixture, the same as defining them locally. The cost is that each
# fixture here stays live for the whole evaluation rather than one cluster's.
#
# Holds only configs that are identical across their users. A cluster whose
# claim needs one more option set defines its own fixture.
{
  pkgs,
  lib,
  self,
  nixosSystem,
}:
let
  inherit
    (import ./lib.nix {
      inherit
        pkgs
        lib
        self
        nixosSystem
        ;
    })
    hive
    hiveWithController
    agent
    agentWith
    ;

  # The four auth responder packages pinned to four distinct derivations, so
  # a unit's ExecStart names which option it read. Nothing else reads them.
  marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out";
in
{
  agentBare = agent { };

  agentWithBao = agentWith { services.hyperhive.agent.bao.addr = "https://bao.t.local:8200"; };

  bare = hive { };

  bareWithController = hiveWithController { };

  allLocal = hiveWithController {
    deploy.singleHostSwarm = true;
    deploy.victorialogs.authPackage = marker "logs";
    deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana";
    deploy.victoriametrics.authPackage = marker "metrics";
    deploy.victoriametrics.agentAuthPackage = marker "metrics-agent";
  };

  autheliaOnly = hive { deploy.authelia.enable = true; };

  forgeHere = hive { deploy.forgejo.enable = true; };

  baoOnly = hive { deploy.bao.enable = true; };

  servicesHere = hive { deploy.allSwarmServices = true; };

  # The all-swarm-services switch on the controller's host, the services box
  # shape that hives elsewhere join.
  swarmServicesWithController = hiveWithController { deploy.allSwarmServices = true; };

  # The queue with no store identity.
  natsQueueOnly = hive {
    deploy.nats.enable = true;
    deploy.nats.authPackage = pkgs.emptyDirectory;
  };

  # The queue on the store's host with the hive's own reader pointed
  # somewhere else.
  natsOnStoreHostReaderMoved = hive {
    deploy.bao.enable = true;
    deploy.nats.enable = true;
    deploy.bao.clientCertFile = "/etc/pki/h1.pem";
    deploy.bao.clientKeyFile = "/etc/pki/h1-key.pem";
  };

  controllerAlone = hive { deploy.swarm-controller.enable = true; };

  matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };

  baoWithMatrix = hiveWithController {
    deploy.bao.enable = true;
    deploy.matrix.enable = true;
  };

  # A second job declared as bare `host:port`, so a case can read one rendered
  # scrape list where the store's entry carries a path and this one carries
  # none.
  baoWithCollector = hive {
    deploy.bao.enable = true;
    deploy.swarm-otel.enable = true;
    swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
  };

  # `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
  # demands of any host running a hive.
  baoWithHiveOtel = hiveWithController {
    deploy.bao.enable = true;
    otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
  };

  # The swarm collector with the IdP on another host and the store leaf placed
  # by hand, without and with the collector's own OIDC pair.
  otelReaderMissingLeaf = hive {
    deploy.swarm-otel.enable = true;
    swarm.authelia.url = "https://auth.example.invalid";
    deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
    deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
  };
  otelReaderNamedInFull = hive {
    deploy.swarm-otel.enable = true;
    swarm.authelia.url = "https://auth.example.invalid";
    deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
    deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
    deploy.bao.otelOidcClientCertFile = "/etc/pki/bao-otel-oidc.pem";
    deploy.bao.otelOidcClientKeyFile = "/etc/pki/bao-otel-oidc-key.pem";
  };
}