# The binary cache the swarm pushes agent closures to, as every host sees it:
# which attic server, and which cache on it. The swarm runs no attic of its
# own yet; the instance is the operator's, outside the swarm.
{ lib, ... }:
{
  options.services.hyperhive.swarm.attic = {
    domain = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
      example = "cache.example.org";
      description = ''
        Name of the attic server, with no scheme: the swarm builder pushes to
        `https://<domain>`, and trusts the certificate the system roots do, so
        a Let's Encrypt certificate works and none is pinned. Set together with
        {option}`services.hyperhive.swarm.attic.cache`; evaluation fails when only
        one is set.

        Null pushes nothing: the swarm builder does not push, and the closure
        record says it is not cached.

        The push token is not an option. The operator writes it to
        `secret/swarm/services/attic/push-token` in the swarm secret store
        (field `value`), and the builder reads it on every push.
      '';
    };

    cache = lib.mkOption {
      # attic's own rule for a cache name; the builder checks the same at start.
      type = lib.types.nullOr (lib.types.strMatching "^[A-Za-z0-9][A-Za-z0-9_+-]{0,49}$");
      default = null;
      example = "grid";
      description = ''
        Name of the cache on {option}`services.hyperhive.swarm.attic.domain`
        that the swarm builder pushes closures to. The push token must be
        allowed to push to it. The name follows attic's rule: 1 to 50 letters,
        digits, `-`, `_` or `+`, starting with a letter or digit.
      '';
    };
  };
}