# Glue: point the queue's auth-callout responder at the bao leaf minted for it.
#
# ONE PAIRING PER FILE — the swarm-nats-auth principal ← bao, and nothing else.
# Deleting this leaves a queue with no responder identity unless the operator
# names one, which ./swarm-nats.nix refuses at eval.
#
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
# leaf. What belongs here is the pairing: which paths the responder presents.
#
# ⚠️ Gated on the store running on this host, the only place the leaf is
# minted. Not on `deploy.bao.clientCertFile`, the hive's own reader: a queue
# host need not run a hive. A queue host without the store gets no default
# here; the operator places the responder's leaf and names it.
#
# Everything is `mkDefault`. An operator naming their own paths wins.
{
  lib,
  config,
  ...
}:
let
  deployCfg = config.services.hyperhive.deploy;
  pkiDir = import ./lib/bao-pki-dir.nix;
in
{
  config = lib.mkIf (deployCfg.nats.enable && deployCfg.bao.enable) {
    services.hyperhive.deploy.nats = {
      authBaoClientCertFile = lib.mkDefault "${pkiDir}/nats-auth.pem";
      authBaoClientKeyFile = lib.mkDefault "${pkiDir}/nats-auth-key.pem";
    };
  };
}