# Glue: turn the secret publisher on wherever authelia mints the secrets.
#
# ONE PAIRING PER FILE — publisher ← authelia, and nothing else. Deleting this
# leaves the publisher off unless an operator enables it, so every OIDC client
# secret authelia mints stays in its container and no reader gets one, this
# host's included.
#
# ⚠️ Gated on authelia alone, NOT on `deploy.bao.enable`: a publisher beside a
# remote store, holding a leaf issued out of band, is a deployment the
# publisher exists to serve (see that option's description).
{
  lib,
  config,
  ...
}:
let
  deployCfg = config.services.hyperhive.deploy;
in
{
  # `mkDefault`: an operator's explicit value wins.
  config = lib.mkIf deployCfg.authelia.enable {
    services.hyperhive.deploy.swarm-secret-publisher.enable = lib.mkDefault true;
  };
}