# Git settings for the host processes that hand nix a forge URL: hive-c0re
# (prebuilds as `hive-core`) and hive-priv (builds as root, with a HOME of its
# own), each through its own `$HOME/.gitconfig`. nix runs `git` for a `git+…`
# input, so git's config is the only credential and URL plumbing it has.
#
# - `credential`: the forge host answers through `git-credential-hive-forge`,
#   which reads the live `core` token file. An empty `helper =` first resets the
#   list, so no /etc/gitconfig helper (e.g. `oauth`, which waits on a browser)
#   runs ahead of ours.
# - `url`: the swarm's `internal/meta` lock names its inputs by the forge's
#   `https` URL, which only the builder's credential helper answers for. They
#   are fetched over the `http` URL the helper above is scoped to.
#
# Pure function — NOT a NixOS module (don't add it to the host-modules
# aggregator). Call it from a module's `let`:
#
#   forgeGit = import ./lib/hive-forge-git.nix { inherit pkgs; forgeDomain = …; };
#   # then put `forgeGit.credentialHelper` on the unit's `path` and
#   # `forgeGit.config` into its gitconfig.
{ pkgs, forgeDomain }:
{
  # Answers only `get`, for the forge `core` user, from the live token file
  # (`/var/lib/hyperhive/forge-core-token`, hive-c0re's `paths::FORGE_CORE_TOKEN`)
  # on every invocation, so it never holds a stale copy and survives token
  # rotation; prints nothing where the file is absent.
  credentialHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
    [ "''${1:-}" = "get" ] || exit 0
    if [ -r /var/lib/hyperhive/forge-core-token ]; then
      printf 'username=core\n'
      printf 'password=%s\n' "$(cat /var/lib/hyperhive/forge-core-token)"
    fi
  '';

  config = ''
    [credential]
    helper =
    [credential "http://${forgeDomain}"]
    helper =
    helper = hive-forge
    username = core
    [url "http://${forgeDomain}/"]
    insteadOf = https://${forgeDomain}/
  '';
}