move hiveName to deploy.hive-controller; only a hive host needs a name

docs/networking/gateway.md

@@ -24,7 +24,7 @@ You rarely switch it on yourself. `gateway.enable` defaults to off, and every mo
 
 A service module declares its vhost as `services.hyperhive.gateway.vhosts.<name>`: the locations, `forceSSL` and any `extraConfig` it needs. The gateway renders it into `services.nginx.virtualHosts.<name>` and adds the `listen` set, the certificate for that name and the [security headers](#security-headers) (ahead of the vhost's own `extraConfig`), and drops `addSSL` from a vhost that sets `forceSSL`. The eval fails for a vhost that sets `listen`, `addSSL`, `onlySSL`, `enableACME`, `useACMEHost`, `sslCertificate` or `sslCertificateKey` itself, and for any vhost declared while `gateway.enable` is false. A name with a certificate from outside the gateway's leaves (the queue's) sets `certificate = { cert; key; }` instead. `hive-gateway/vhosts.nix` declares the gateway's own catch-all (`_`) the same way, `hive-c0re/vhosts.nix` the dashboard and the hive domain, and `glue-matrix-hive-discovery.nix` adds the matrix redirect to the hive domain where the homeserver runs, and discovery there when the hive domain is the pinned server name. The catch-all sets `securityHeaders = false` because it sends no response, and the gateway renders a vhost's `default` at `mkDefault` priority.
 
-**The hive's own vhosts**: the dashboard's, named `<name>.hives.<swarm>` (`swarm.dashboardDomain`), and one named for the hive domain. They exist only on a host that runs a hive (`deploy.hive-controller.enable`); a host without a hive has none of these rows:
+**The hive's own vhosts**: the dashboard's, named `<name>.hives.<swarm>` (`deploy.hive-controller.dashboardDomain`), and one named for the hive domain. They exist only on a host that runs a hive (`deploy.hive-controller.enable`); a host without a hive has none of these rows:
 
 | URL | upstream | when |
 | --- | --- | --- |
@@ -116,7 +116,7 @@ Give the gateway the real cert (`tls.certDir` or `tls.acme`) so it serves proper
 
 ## Dashboard access
 
-The dashboard answers on `<name>.hives.<swarm>` (`swarm.dashboardDomain`, derived from the hive name and `swarm.domain`), behind an authelia `auth_request`. Log in with your authelia account; only accounts in the `admins` group get in, the same rule as the swarm UI. Add one with `swarmctl user add <name> --group admins` ([`swarm/sso.md`](../swarm/sso.md)).
+The dashboard answers on `<name>.hives.<swarm>` (`deploy.hive-controller.dashboardDomain`, derived from the hive name and `swarm.domain`), behind an authelia `auth_request`. Log in with your authelia account; only accounts in the `admins` group get in, the same rule as the swarm UI. Add one with `swarmctl user add <name> --group admins` ([`swarm/sso.md`](../swarm/sso.md)).
 
 The name sits under the swarm domain so authelia's session cookie reaches it, whatever the hive's own domain is. Any path on the hive domain other than the matrix routes redirects there, so old bookmarks still land.
 

docs/networking/network.md

@@ -88,7 +88,7 @@ listener sits on `bridgeIp`, on the host's bridge interface.
 {
   services.hyperhive = {
     deploy.hive-controller.enable = true;
-    hiveName = "pr1ma";
+    deploy.hive-controller.hiveName = "pr1ma";
     swarm.domain = "darkest.space";
     swarm.hives.pr1ma = { };          # -> domain = pr1ma.darkest.space
     # network.bridgeIp = "10.42.0.1"; # default

docs/process/conventions.md

@@ -232,7 +232,7 @@ status_text, status_set_at, hive_name, swarm_name, matrix_accounts }`:
   or when `running = false` (see above).
 - `hive_name` / `swarm_name`: display names read from
   `HYPERHIVE_HIVE_NAME` / `HYPERHIVE_SWARM_NAME` env (sourced from
-  `services.hyperhive.hiveName` / `services.hyperhive.swarm.name`).
+  `services.hyperhive.deploy.hive-controller.hiveName` / `services.hyperhive.swarm.name`).
   Both `None` when the options aren't configured.
 - `matrix_accounts`: one `MatrixIdentity` per configured + live matrix
   account the agent can act as. Empty for agents with no matrix

docs/swarm/README.md

@@ -485,7 +485,7 @@ refused delivery logs `webhook: refused delivery` with the reason.
 ```nix
 services.hyperhive = {
   swarm.domain = "example.com";     # required — the swarm's DNS domain
-  hiveName = "pr1ma";               # required — this hive's label in it
+  deploy.hive-controller.hiveName = "pr1ma"; # required on a hive host — this hive's label in it
   swarm.name = "constellat1on";     # shared swarm display name (optional)
 
   # required — the directory, identical on every host in the swarm.
@@ -503,7 +503,7 @@ services.hyperhive = {
 Swarm options are identical on every host in the swarm, so `swarm.domain` is
 **required** on every host that runs any hyperhive service; a host that
 imports the module and enables nothing evaluates without it. `hiveName` is
-required on a host that runs a hive, the secret store or the homeserver. Eval fails with a hint naming
+required on a host that runs a hive (`deploy.hive-controller.hiveName`), and on no other. Eval fails with a hint naming
 each. Neither defaults, because a guessed value here is a wrong hostname
 that evaluates cleanly and deploys.
 
@@ -518,7 +518,7 @@ directory without this host would make every hive a peer, itself included.
 
 ```
 # hive A                          # hive B
-hiveName = "pr1ma";               hiveName = "edge";
+deploy.hive-controller.hiveName = "pr1ma";   deploy.hive-controller.hiveName = "edge";
 swarm.hives = { … };              swarm.hives = { … };   # byte-identical
 ```