# Where `swarm-bao-hive-otel-oidc` lands this hive's OIDC client secret on
# the host, and where it sat before it moved. Spelled once because
# ../otel.nix, ../glue-hive-otel-authelia.nix and
# ../glue-bao-readers-store-order.nix each compare `otel.clientSecretFile`
# against it to decide whether the fetch unit exists; a copy that drifts makes
# that comparison false and the secret stops refreshing.
#
# `path` is on /run (tmpfs): the secret never reaches persistent disk and the
# unit fetches it again after a reboot.
#
# Pure function — NOT a NixOS module. Call it from a module's `let`:
#
#   hiveOtelSecret = import ./lib/hive-otel-secret.nix { inherit (cfg) hiveClientPrefix hiveName; };
{ hiveClientPrefix, hiveName }:
let
  file = "${hiveClientPrefix}${toString hiveName}.secret";
in
{
  dir = "/run/hive-otel-oidc";
  path = "/run/hive-otel-oidc/${file}";
  legacyPath = "/var/lib/hive-otel-oidc/${file}";
}