add a semi-spread example deploy and a check that evaluates it

docs/examples/semi-spread/hive.nix

@@ -0,0 +1,28 @@
+# A hive. Identical on hive-one and hive-two: the machine `hive-<name>` runs the
+# hive `<name>`.
+{ config, lib, ... }:
+let
+  # The leaves for this hive, copied from swarm-central, where the secret store
+  # runs: `client.pem` and `client-key.pem` from
+  # `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
+  # `hive-leaf.pem` and `hive-leaf-key.pem`, which the hive's gateway
+  # certificate comes from. Both pairs sit in one directory.
+  pki = "/var/lib/swarm-pki";
+in
+{
+  services.hyperhive.deploy = {
+    hive-controller = {
+      enable = true;
+      hiveName = lib.removePrefix "hive-" config.networking.hostName;
+    };
+    bao = {
+      clientCertFile = "${pki}/client.pem";
+      clientKeyFile = "${pki}/client-key.pem";
+    };
+  };
+
+  # The dashboard is reachable over the VPN only.
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [
+    config.services.hyperhive.gateway.httpsPort
+  ];
+}