# Glue: where authelia runs on this host, the hive collector's wait for its
# client secret file is ordered after authelia's container, because the
# named file may be one authelia mints.
#
# ONE PAIRING PER FILE — the hive collector's secret-wait unit ← authelia's
# container, and nothing else. Deleting this leaves a wait that polls for the
# file without ordering against anything, which is what a host without
# authelia already gets.
#
# ⚠️ Gated on the unit existing, not only on authelia being here: setting
# `systemd.services.hive-otel-client-secret.after` on a host without the unit
# would define one with no ExecStart. The gate restates ./otel.nix's `waits`
# (a sender identity, and a secret file that is not the one the store fetch
# writes); a change to `waits` must change it here too.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  otel = hyperhiveCfg.otel;
  autheliaMachine = hyperhiveCfg.swarm.authelia.machine;

  # ./otel.nix: `senderAuth`, `hiveLeaf`, `fetches`, `fetchedSecretPath`.
  senderAuth = otel.clientSecretFile != null && hyperhiveCfg.hiveName != null;
  hiveLeaf =
    hyperhiveCfg.deploy.bao.clientCertFile != null && hyperhiveCfg.deploy.bao.clientKeyFile != null;
  fetchedSecretPath = "/var/lib/hive-otel-oidc/${hyperhiveCfg.swarm.authelia.hiveClientPrefix}${toString hyperhiveCfg.hiveName}.secret";
  fetches = senderAuth && hiveLeaf && otel.clientSecretFile == fetchedSecretPath;
  waits = senderAuth && !fetches;
in
{
  config = lib.mkIf (hyperhiveCfg.deploy.authelia.enable && otel.collector.enable && waits) {
    systemd.services.hive-otel-client-secret = {
      after = [ "container@${autheliaMachine}.service" ];
      requires = [ "container@${autheliaMachine}.service" ];
    };
  };
}