# Glue: register the CI run poller as an OIDC client wherever authelia runs.
#
# ONE PAIRING PER FILE: that poller ← authelia, and nothing else.
# Without it authelia mints no secret, the publisher has nothing to copy into
# the store, and the poller's push is a 401.
#
# Gated on authelia being HERE, not on this host running the poller: a
# client is a row in THIS host's provider config, the split
# ./glue-ci-runner-otel-oidc-client.nix makes for the same reason.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  clientId = hyperhiveCfg.swarm.ci-metrics.clientId;
in
{
  config = lib.mkIf hyperhiveCfg.deploy.authelia.enable {
    services.hyperhive.swarm.authelia.oidc.clients = [
      {
        id = clientId;
        description = "HyperHive CI run poller";
        kind = "machine";
        redirectUris = [ ];
        # Its own id as its own permitted audience, the one the swarm
        # collector's receiver for the poller checks.
        audience = [ clientId ];
        # The receiver verifies the token offline against `/jwks.json`;
        # authelia's default opaque handle fails there.
        accessTokenSignedResponseAlg = "RS256";
      }
    ];
  };
}