# Removal shim for `services.hyperhive.swarm.ca.*` and the host-held swarm
# root it generated.
#
# The secret store's `pki` root is the only trust anchor: it issues every
# hive's gateway leaf and the swarm's service names, and its key never leaves
# the store. Nothing generates, reads or bundles a root under
# `/var/lib/swarm-ca`, so a definition of these options fails evaluation with
# a message, and the directory is deleted on every host.
#
# Self-contained and deletable, like ./swarm-peers-removed.nix: one file to
# remove when the deprecation window closes.
{ lib, ... }:
let
  removed =
    name:
    lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "ca" name ] ''
      The host-held swarm root CA is gone: the secret store's pki root is the
      only trust anchor, and nothing generates or reads a root under
      /var/lib/swarm-ca. Remove this definition. See docs/swarm/ca.md.
    '';
in
{
  imports = map removed [
    "autoConfigure"
    "stateDir"
    "validityDays"
  ];

  # The root's private key is a secret outside the store, and the
  # certificate beside it is an anchor nothing issues under. The option's
  # default path only: a relocated `stateDir` is the operator's to delete.
  systemd.tmpfiles.rules = [ "R /var/lib/swarm-ca" ];
}