# Removal shim for the queue's callout nkey options, and for the copies of
# their seeds and of the responder's OIDC client secret inside the
# `swarm-nats` container.
#
# The callout issuer and user keys live in the swarm secret store beside the
# callout xkey: `swarm-bao-nats-callout-xkey` in ./swarm-nats.nix creates
# them there, and the server renders their public halves from the store. A
# definition of a removed option fails evaluation with a message, under its
# `deploy.nats` path and under the `swarm.nats` one older configs use.
#
# The host seed files under /var/lib/swarm-nats-callout are NOT removed here:
# that unit stores each one before it removes it, and a tmpfiles rule could
# run first.
#
# Self-contained and deletable, like ./host-ca-removed.nix: one file to
# remove when the deprecation window closes.
{ lib, ... }:
let
  inStore = ''
    The queue's callout issuer and user keys live in the swarm secret store:
    swarm-bao-nats-callout-xkey creates them there, and the server renders
    their public halves from it. Remove this definition. See
    docs/swarm/secrets.md.
  '';
  # The seed-file options name a key an operator may want to keep.
  seedFile = name: ''
    ${inStore}
    A seed at /var/lib/swarm-nats-callout/${name} is what that unit stores
    when the store holds none, so a key placed there keeps its public half;
    otherwise a new key is created.
  '';
  removed = name: message: [
    (lib.mkRemovedOptionModule [ "services" "hyperhive" "deploy" "nats" name ] message)
    (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "nats" name ] message)
  ];

  containerSecretDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
in
{
  imports = lib.concatLists [
    (removed "autoGenerateCallout" inStore)
    (removed "calloutUserPublicKey" inStore)
    (removed "calloutIssuerPublicKey" inStore)
    (removed "calloutUserSeedFile" (seedFile "callout-user.seed"))
    (removed "calloutIssuerSeedFile" (seedFile "issuer.seed"))
  ];

  # The responder reads both seeds and its OIDC client secret from the store
  # and names none of these files.
  systemd.tmpfiles.rules = map (f: "r ${containerSecretDir}/${f}") [
    "callout-user.seed"
    "issuer.seed"
    "oidc-client.secret"
  ];
}