From 94be1b72500d4fd64d0953ad0dd7541d99eabedc Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 21 Jun 2026 16:36:06 +0200
Subject: [PATCH] nix(loadtest): remove --rsa option from genTargets

The public key is not needed for target generation, only the private
key, so it's enough to pass that.
---
 nix/tools/generate_targets.py | 14 ++------------
 nix/tools/loadtest.nix        |  6 +++---
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/nix/tools/generate_targets.py b/nix/tools/generate_targets.py
index 5c434b96d..5f9769063 100644
--- a/nix/tools/generate_targets.py
+++ b/nix/tools/generate_targets.py
@@ -89,8 +89,8 @@ def main():
         dest="private_key_path",
         metavar="PRIVATE_KEY_PATH",
         type=Path,
+        help="Path to the RSA private key file",
         default=None,
-        help="Path to the RSA private key file (required when --rsa is used)",
     )
     parser.add_argument(
         "--worst",
@@ -99,20 +99,12 @@ def main():
         default=False,
         help="Generate worst case targets for a JWT cache",
     )
-    parser.add_argument(
-        "--rsa",
-        dest="jwk_path",
-        metavar="JWK_PATH",
-        type=Path,
-        default=None,
-        help="Path to an existing RSA JWK file used for signing tokens",
-    )
 
     args = parser.parse_args()
 
     rsa_private_key: Optional[jwt.algorithms.RSAAlgorithm] = None
 
-    is_hs = args.jwk_path is None
+    is_hs = args.private_key_path is None
 
     nsamples = 1000
 
@@ -123,8 +115,6 @@ def main():
         ntargets = 50000
 
     if not is_hs:
-        if args.private_key_path is None:
-            parser.error("--rsa requires the --private-key option")
         try:
             private_key_data = args.private_key_path.read_text()
         except OSError as e:
diff --git a/nix/tools/loadtest.nix b/nix/tools/loadtest.nix
index d7a1ee0f4..ea90a7392 100644
--- a/nix/tools/loadtest.nix
+++ b/nix/tools/loadtest.nix
@@ -102,7 +102,7 @@ let
             ${genRsaMaterials} --rsa="$_arg_testdir"/gen_jwk.json --private-key="$_arg_testdir"/gen_private.json
             export PGRST_JWT_SECRET="@$_arg_testdir/gen_jwk.json"
 
-            ${genTargets} --rsa="$_arg_testdir"/gen_jwk.json --private-key="$_arg_testdir"/gen_private.json "$_arg_testdir"/gen_targets.http
+            ${genTargets} --private-key="$_arg_testdir"/gen_private.json "$_arg_testdir"/gen_targets.http
 
             # shellcheck disable=SC2145
             ${withTools.withPg} -f "$_arg_testdir"/fixtures.sql \
@@ -115,7 +115,7 @@ let
             ${genRsaMaterials} --rsa="$_arg_testdir"/gen_jwk.json --private-key="$_arg_testdir"/gen_private.json
             export PGRST_JWT_SECRET="@$_arg_testdir/gen_jwk.json"
 
-            ${genTargets} --rsa="$_arg_testdir"/gen_jwk.json --private-key="$_arg_testdir"/gen_private.json "$_arg_testdir"/gen_targets.http
+            ${genTargets} --private-key="$_arg_testdir"/gen_private.json "$_arg_testdir"/gen_targets.http
 
             # shellcheck disable=SC2145
             ${withTools.withPg} -f "$_arg_testdir"/fixtures.sql \
@@ -128,7 +128,7 @@ let
             ${genRsaMaterials} --rsa="$_arg_testdir"/gen_jwk.json --private-key="$_arg_testdir"/gen_private.json
             export PGRST_JWT_SECRET="@$_arg_testdir/gen_jwk.json"
 
-            ${libfaketime}/bin/faketime '2000-01-01 00:00:00' ${genTargets} --worst --rsa="$_arg_testdir"/gen_jwk.json --private-key="$_arg_testdir"/gen_private.json "$_arg_testdir"/gen_targets.http
+            ${libfaketime}/bin/faketime '2000-01-01 00:00:00' ${genTargets} --worst --private-key="$_arg_testdir"/gen_private.json "$_arg_testdir"/gen_targets.http
 
             # shellcheck disable=SC2145
             ${withTools.withPg} -f "$_arg_testdir"/fixtures.sql \