# Glue: point the metrics store's Grafana auth responder at the bao leaf minted
# for it.
#
# ONE PAIRING PER FILE — the swarm-metrics-auth principal ← bao, and nothing
# else. Deleting this leaves a metrics store with no responder identity unless
# the operator names one, which ./swarm-victoriametrics.nix refuses at eval.
#
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
# leaf. What belongs here is the pairing: which paths the responder presents.
#
# ⚠️ Gated on the store running on this host, the only place the leaf is
# minted. A metrics-store host without the store gets no default here; the
# operator places the responder's leaf and names it.
#
# Everything is `mkDefault`. An operator naming their own paths wins.
{
  lib,
  config,
  ...
}:
let
  deployCfg = config.services.hyperhive.deploy;
  pkiDir = import ./lib/bao-pki-dir.nix;
in
{
  config = lib.mkIf (deployCfg.victoriametrics.enable && deployCfg.bao.enable) {
    services.hyperhive.deploy.victoriametrics = {
      authBaoClientCertFile = lib.mkDefault "${pkiDir}/metrics-auth.pem";
      authBaoClientKeyFile = lib.mkDefault "${pkiDir}/metrics-auth-key.pem";
    };
  };
}