run swarm-attic in its own network namespace

the gateway reaches atticd over a unix socket a relay in the container
forwards, and the host unit that creates the cache dials its public name.

nix/script-tests/attic-init.sh

@@ -95,8 +95,14 @@ chmod +x "$dir/bin/"*
 
 cat >"$dir/bin/curl" <<STUB
 #!$BASH
-echo curl >>"$calls"
-[ "\${CURL_FAIL:-0}" != 1 ]
+echo "curl \$*" >>"$calls"
+# A curl that cannot connect prints 000 and exits 7; CURL_CODE is the status of
+# a server that answered.
+if [ "\${CURL_FAIL:-0}" = 1 ]; then
+  printf 000
+  exit 7
+fi
+printf %s "\${CURL_CODE:-200}"
 STUB
 printf '#!%s\nexit 0\n' "$BASH" >"$dir/bin/sleep"
 # A container that is not running has nothing to refresh.
@@ -246,6 +252,25 @@ expect "exit status" $? 1
 expect "nothing minted" "$(n '^atticadm')" 0
 expect "nothing stored" "$(n '^bao put')" 0
 
+case="a 502 from the gateway is not atticd answering"
+reset
+run "$ENSURE_JWT"
+: >"$calls"
+run "$PROVISION" CURL_CODE=502
+expect "exit status" $? 1
+expect "nothing minted" "$(n '^atticadm')" 0
+expect "nothing stored" "$(n '^bao put')" 0
+expect "the probe asked the gateway's name" "$(n '^curl .*https://cache.example')" 30
+
+case="a status from atticd below 500 is an answer, a 404 included"
+reset
+run "$ENSURE_JWT"
+: >"$calls"
+run "$PROVISION" CURL_CODE=404
+expect "exit status" $? 0
+expect "the cache is created" "$(n '^attic cache create')" 1
+expect "one probe" "$(n '^curl')" 1
+
 case="the client reads its token from a file, not from an argument"
 reset
 run "$ENSURE_JWT"