# Glue: point the matrix container's `swarm-matrix-ctl` at the bao leaf minted for it.
#
# ONE PAIRING PER FILE — matrix-ctl ← bao, and nothing else. Deleting this leaves a
# binary that takes operator-provided certificate paths, which is what any
# deployment not minting its own already does.
#
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
# leaf, because the thing that owns a private key owns issuing from it. What
# belongs here is the pairing: which paths matrix-ctl presents.
#
# ⚠️ Gated on the store running on this host, the only place the leaf is
# minted. Not on `deploy.bao.clientCertFile`, the hive's own reader. A
# homeserver host without the store gets no default here; the operator places
# matrix-ctl's leaf and names it.
#
# Everything is `mkDefault`. An operator naming their own paths wins.
{
  lib,
  config,
  ...
}:
let
  deployCfg = config.services.hyperhive.deploy;
  pkiDir = import ./lib/bao-pki-dir.nix;
in
{
  config = lib.mkIf (deployCfg.matrix.enable && deployCfg.bao.enable) {
    services.hyperhive.deploy.matrix = {
      ctlBaoClientCertFile = lib.mkDefault "${pkiDir}/matrix-ctl.pem";
      ctlBaoClientKeyFile = lib.mkDefault "${pkiDir}/matrix-ctl-key.pem";
    };
  };
}