# Glue: point the queue's TLS-leaf unit at the bao leaf minted for it.
#
# ONE PAIRING PER FILE — the swarm-nats principal ← bao, and nothing else.
# Deleting this leaves a queue host that takes an operator-provided path to
# that credential, which is what any deployment not minting its own already
# does.
#
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
# leaf, because the thing that owns a private key owns issuing from it. What
# belongs here is the pairing: which paths `swarm-bao-nats-tls` presents.
#
# ⚠️ Gated on the store running on this host, the only place the leaf is
# minted. Not on `deploy.bao.clientCertFile`, the hive's own reader: a queue
# host need not run a hive. A queue host without the store gets no default
# here; the operator places the queue's leaf and names it.
#
# Everything is `mkDefault`. An operator naming their own paths wins.
{
  lib,
  config,
  ...
}:
let
  deployCfg = config.services.hyperhive.deploy;
  pkiDir = import ./lib/bao-pki-dir.nix;
in
{
  config = lib.mkIf (deployCfg.nats.enable && deployCfg.bao.enable) {
    services.hyperhive.deploy.nats = {
      baoClientCertFile = lib.mkDefault "${pkiDir}/nats.pem";
      baoClientKeyFile = lib.mkDefault "${pkiDir}/nats-key.pem";
    };
  };
}