report the granter login's real error and retry on a standby store

nix/host-modules/swarm-bao.nix

@@ -311,27 +311,18 @@ let
   # config and no token.
   baoStoreUp = ''HOME=/var/empty bao status >/dev/null 2>>"$err"'';
 
-  # The login every granting unit starts with. It FAILS rather than skips: a
-  # grant that was not written is otherwise invisible until whatever needs it
-  # fails somewhere else. `baoStoreUp` separates "the granter is not set up"
-  # from "retry later"; either way bao's own message follows.
-  granterLogin = ''
-    err="$(mktemp)"
-    trap 'rm -f "$err"' EXIT
-    if ! BAO_TOKEN="$(bao login -method=cert -token-only 2>"$err")"; then
-      if ${baoStoreUp}; then
-        echo ${lib.escapeShellArg "the store is unsealed but refused the granter's certificate (CN ${granterCn}): the ${granterPolicyName} role is not set up."} >&2
-        ${lib.optionalString haveBootstrapToken ''echo "swarm-bao-granter-role writes that role; journalctl -u swarm-bao-granter-role says why it has not." >&2''}
-        echo "one-time step, as root on this host (docs/getting-started/setup.md):" >&2
-        ${lib.concatMapStringsSep "\n" (l: "echo ${lib.escapeShellArg "  ${l}"} >&2") granterSetupSteps}
-      else
-        echo "the store is sealed or unreachable; retrying." >&2
-      fi
-      cat "$err" >&2
-      exit 1
-    fi
-    export BAO_TOKEN
-  '';
+  # The login every granting unit starts with; ./lib/granter-login.nix says
+  # which failures it reports as a missing role.
+  granterLogin = import ./lib/granter-login.nix {
+    inherit
+      lib
+      granterCn
+      granterPolicyName
+      haveBootstrapToken
+      baoStoreUp
+      ;
+    setupSteps = granterSetupSteps;
+  };
 
   # The granter's certificate for the granting units. The `baoCli` wrapper
   # only defaults these, so the unit's environment wins.