# Glue: hand the hive's trust bundle to the daemons that dial the swarm over TLS.
#
# ONE PAIRING PER FILE — hive-c0re and the swarm controller ← the trust bundle
# ./hive-tls.nix assembles. Deleting this leaves daemons that trust only the
# platform roots: the swarm-queue clients die at
# `invalid peer certificate: UnknownIssuer` against an authelia signed by the
# swarm CA.
#
# `*_OIDC_CA_FILE` names the same anchor for the swarm-queue clients that mint a
# token from authelia over TLS. `swarm-queue-client` builds a bare
# `reqwest::Client`, so it trusts only the platform roots without it. Where the
# gateway is not self-signed ./hive-tls.nix contributes no bundle and nothing is
# set here, which is correct for a swarm fronted by a public certificate.
#
# ⚠️ One gate per daemon, each ANDed with the bundle existing: the gateway also
# runs on hosts with no hive and no controller, and defining an environment key
# on a unit that does not exist CREATES a unit fragment for it — inert (no
# `ExecStart`, empty `wantedBy`, never activated), and it evaluates and builds
# clean.
#
# ⚠️ Files like this are the only place a `deploy.<foo>` value may derive from
# a `deploy.<bar>.enable`. Everywhere else that is forbidden.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  deployCfg = hyperhiveCfg.deploy;
  gatewayCfg = hyperhiveCfg.gateway;

  # ./hive-tls.nix writes the bundle only where the gateway serves its own
  # self-signed cert.
  haveBundle = gatewayCfg.enable && gatewayCfg.useSelfSigned;
  trustBundle = "${deployCfg.hive-controller.tls.stateDir}/trust-bundle.pem";
in
{
  config = lib.mkIf haveBundle (
    lib.mkMerge [
      (lib.mkIf deployCfg.hive-controller.enable {
        systemd.services.hive-c0re.environment = {
          HIVE_C0RE_OIDC_CA_FILE = trustBundle;
        };
      })
      (lib.mkIf deployCfg.swarm-controller.enable {
        systemd.services.swarm-controller.environment.SWARM_CONTROLLER_OIDC_CA_FILE = trustBundle;
      })
    ]
  );
}