fetch the secrets unit's store leaves concurrently and log how long each phase takes

nix/host-modules/lib/oidc-client-secrets.nix

@@ -27,7 +27,7 @@
   client_secret_read() {
     CLIENT_SECRET_VALUE=""
     [ "$STORE_UP" = 1 ] || return 2
-    if CLIENT_SECRET_VALUE="$(store_bao kv get -field=value "$1" 2>"$STORE_ERR")" \
+    if CLIENT_SECRET_VALUE="$(store_read "$1")" \
       && [ -n "$CLIENT_SECRET_VALUE" ]; then
       return 0
     fi

nix/host-modules/lib/store-seeded-secret.nix

@@ -8,6 +8,11 @@
 # race reads the winner's back. A read of the leaf that fails for any reason
 # but "No value found" prints the store's error and neither mints nor writes.
 #
+# `store_prefetch` reads many leaves concurrently, and the first `store_read` of
+# a leaf returns that answer, status and error included, instead of asking
+# again, so what a caller decides from a read is the same. Later reads of the
+# leaf, such as one that checks a write, ask the store.
+#
 # Pure function — NOT a NixOS module. Call it from a module's `let`:
 #
 #   storeSeededSecret = import ./lib/store-seeded-secret.nix { };
@@ -31,7 +36,8 @@
   store_init() {
     STORE_ERR="$(mktemp)"
     STORE_UP=0
-    trap 'rm -f "$STORE_ERR"' EXIT
+    STORE_PREFETCH="$(mktemp -d)"
+    trap 'rm -rf "$STORE_ERR" "$STORE_PREFETCH"' EXIT
   }
 
   # Sets STORE_UP. A store that cannot be logged in to leaves every secret to
@@ -48,6 +54,41 @@
     fi
   }
 
+  # <leaf>… Starts the first read of each leaf now, at most STORE_PREFETCH_JOBS
+  # at a time, and returns when all have ended. Each read is bounded by
+  # `store_bao`, and its answer is kept for `store_read`. Does nothing without
+  # a login.
+  store_prefetch() {
+    local leaf key
+    [ "$STORE_UP" = 1 ] || return 0
+    for leaf in "$@"; do
+      while [ "$(jobs -rp | wc -l)" -ge "''${STORE_PREFETCH_JOBS:-8}" ]; do
+        wait -n || true
+      done
+      key="$STORE_PREFETCH/$(printf '%s' "$leaf" | tr / _)"
+      (
+        rc=0
+        store_bao kv get -field=value "$leaf" >"$key.out" 2>"$key.err" || rc=$?
+        echo "$rc" >"$key.rc"
+      ) &
+    done
+    wait
+  }
+
+  # <leaf>. `store_bao kv get -field=value <leaf>`, with the error in
+  # $STORE_ERR: the answer `store_prefetch` kept, once, then the store's.
+  store_read() {
+    local key="$STORE_PREFETCH/$(printf '%s' "$1" | tr / _)" rc
+    if [ -e "$key.rc" ]; then
+      rc="$(< "$key.rc")"
+      cat "$key.out"
+      cat "$key.err" >"$STORE_ERR"
+      rm -f "$key.out" "$key.err" "$key.rc"
+      return "$rc"
+    fi
+    store_bao kv get -field=value "$1" 2>"$STORE_ERR"
+  }
+
   # <leaf> <earlier file> <mint command…>. The value on stdout; status 1 when
   # neither the store nor the file can give one. `kv get` exits 2 both for a
   # leaf that holds nothing ("No value found at <path>") and for a refused
@@ -58,7 +99,7 @@
     local leaf="$1" earlier="$2" value candidate rc=0
     shift 2
     if [ "$STORE_UP" = 1 ]; then
-      value="$(store_bao kv get -field=value "$leaf" 2>"$STORE_ERR")" || rc=$?
+      value="$(store_read "$leaf")" || rc=$?
       if [ "$rc" = 0 ] && [ -n "$value" ]; then
         printf '%s' "$value"
         return 0