run swarm-attic in its own network namespace

the gateway reaches atticd over a unix socket a relay in the container
forwards, and the host unit that creates the cache dials its public name.

nix/host-modules/lib/attic-init.nix

@@ -31,7 +31,8 @@
   url,
   # The cache's name on the server.
   cache,
-  # Where the host reaches atticd, scheme included.
+  # Where the host reaches atticd, scheme included: the gateway, which answers
+  # 502 while atticd is down.
   endpoint,
   # The server's config file, which the host's `atticadm` reads as well.
   configFile,
@@ -110,16 +111,23 @@ in
   # tokens are signed here with the key the store holds; the cache is created
   # through the API by a token that lives for five minutes and is never stored.
   provision = ''
+    # The gateway answers 502 while atticd is down, so only a status below 500
+    # is atticd answering.
     up=0
+    code=000
     for _ in $(seq 1 30); do
-      if curl -s -o /dev/null --max-time 2 ${q endpoint}; then
-        up=1
-        break
-      fi
+      code="$(curl -s -o /dev/null --max-time 2 -w '%{http_code}' ${q endpoint} || true)"
+      case "$code" in
+        "" | 000 | 5??) ;;
+        *)
+          up=1
+          break
+          ;;
+      esac
       sleep 2
     done
     if [ "$up" != 1 ]; then
-      echo "atticd did not answer at ${endpoint}." >&2
+      echo "atticd did not answer at ${endpoint} (last status $code)." >&2
       exit 1
     fi