# Glue: register the homeserver container's journal forwarder as an OIDC
# client wherever authelia runs.
#
# ONE PAIRING PER FILE: that forwarder ← authelia, and nothing else.
# Without it authelia mints no secret, the publisher has nothing to copy into
# the store, and the forwarder's export is a 401.
#
# Gated on authelia being HERE, not on this host running the homeserver: a
# client is a row in THIS host's provider config, the split
# ./glue-swarm-bao-otel-oidc-client.nix makes for the same reason.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  clientId = hyperhiveCfg.swarm.matrix.otel.clientId;
in
{
  config = lib.mkIf hyperhiveCfg.deploy.authelia.enable {
    services.hyperhive.swarm.authelia.oidc.clients = [
      {
        id = clientId;
        description = "HyperHive homeserver journal forwarder";
        kind = "machine";
        redirectUris = [ ];
        # Its own id as its own permitted audience, the one the swarm
        # collector's receiver for this container checks.
        audience = [ clientId ];
        # The receiver verifies the token offline against `/jwks.json`;
        # authelia's default opaque handle fails there.
        accessTokenSignedResponseAlg = "RS256";
      }
    ];
  };
}