# Glue: register the swarm builder as an OIDC client wherever authelia runs.
#
# ONE PAIRING PER FILE — swarm-builder ← authelia, and nothing else. Deleting
# this leaves a builder whose token requests authelia answers with a 401, and
# no minted secret for swarm-secret-publish to put in the store.
#
# ⚠️ Gated on authelia being HERE, and NOT on this host running the builder,
# for ./glue-controller-oidc-client.nix's reason: a client is a row in THIS
# host's provider config. Registered whether or not any host enables the
# builder: nothing in `swarm.*` records that, so a swarm without one carries
# one unused client and one unused minted secret.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  deployCfg = hyperhiveCfg.deploy;
  clientId = hyperhiveCfg.swarm.builder.clientId;
in
{
  config = lib.mkIf deployCfg.authelia.enable {
    services.hyperhive.swarm.authelia.oidc.clients = [
      {
        id = clientId;
        description = "HyperHive swarm builder";
        # `client_credentials`: a daemon authenticating as itself.
        kind = "machine";
        audience = [ clientId ];
        # The container's journal forwarder mints its token as this client, for
        # the swarm collector's receiver, which verifies it offline against
        # `/jwks.json`; authelia's default opaque handle fails there.
        accessTokenSignedResponseAlg = "RS256";
      }
    ];
  };
}