# Glue: point the gateway-leaf issuance at the hive's own bao identity minted
# for it.
#
# ONE PAIRING PER FILE — the hive's gateway-leaf principal ← bao, and nothing
# else. Deleting this leaves a hive that takes an operator-provided path to
# that credential, which is what every hive on a host without the store does.
#
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
# leaf, because the thing that owns a private key owns issuing from it.
#
# Gated on the minted PKI existing, as that file is, and on a hive running
# here: a host without one has no hive leaf to ask for.
#
# Everything is `mkDefault`. An operator naming their own paths wins.
{
  lib,
  config,
  ...
}:
let
  baoDeploy = config.services.hyperhive.deploy.bao;

  # Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own
  # path rather than repeating that file's directory literal.
  haveMintedPki = baoDeploy.clientCertFile != null;
  pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
in
{
  config = lib.mkIf (haveMintedPki && config.services.hyperhive.deploy.hive-controller.enable) {
    services.hyperhive.deploy.hive-controller.tls = {
      baoHiveIdentityCertFile = lib.mkDefault "${pkiDir}/hive-leaf.pem";
      baoHiveIdentityKeyFile = lib.mkDefault "${pkiDir}/hive-leaf-key.pem";
    };
  };
}