push green meta builds to the attic cache and record cached

nix/host-modules/swarm-attic-options.nix

@@ -0,0 +1,37 @@
+# The binary cache the swarm pushes agent closures to, as every host sees it:
+# which attic server, and which cache on it. The swarm runs no attic of its
+# own yet; the instance is the operator's, outside the swarm.
+{ lib, ... }:
+{
+  options.services.hyperhive.swarm.attic = {
+    domain = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "cache.example.org";
+      description = ''
+        Name of the attic server, with no scheme: the swarm builder pushes to
+        `https://<domain>`, and trusts the certificate the system roots do, so
+        a Let's Encrypt certificate works and none is pinned. Set together with
+        {option}`services.hyperhive.swarm.attic.cache`.
+
+        Null pushes nothing: the swarm builder does not push, and the closure
+        record says it is not cached.
+
+        The push token is not an option. The operator writes it to
+        `secret/swarm/services/attic/push-token` in the swarm secret store
+        (field `value`), and the builder reads it on every push.
+      '';
+    };
+
+    cache = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "grid";
+      description = ''
+        Name of the cache on {option}`services.hyperhive.swarm.attic.domain`
+        that the swarm builder pushes closures to. The push token must be
+        allowed to push to it.
+      '';
+    };
+  };
+}