move hiveName to deploy.hive-controller; only a hive host needs a name

hivectl/src/wg.rs

@@ -29,6 +29,9 @@ const HIVE_TLS_TRUST_BUNDLE_PATH: &str = "/var/lib/hive-tls/trust-bundle.pem";
 /// *and future* hive validates.
 const STORE_PKI_ROOT_PATH: &str = "/var/lib/hive-tls/swarm-services-root.pem";
 
+/// The option whose value keys a hive's entry in `services.hyperhive.swarm.hives`.
+const HIVE_NAME_OPTION: &str = "services.hyperhive.deploy.hive-controller.hiveName";
+
 /// Attrset key for a hive in `services.hyperhive.swarm.hives`, derived
 /// from its domain's first DNS label.
 ///
@@ -177,6 +180,16 @@ fn wg_pubkey(privkey: &[u8]) -> Result<String> {
     Ok(String::from_utf8_lossy(&out.stdout).trim().to_owned())
 }
 
+/// The closing comment of the `wg peer` snippet.
+fn wg_peer_key_note() -> String {
+    format!("  # the key must be that hive's {HIVE_NAME_OPTION}")
+}
+
+/// The first closing comment line of the `peer-config` snippet.
+fn peer_config_key_note() -> String {
+    format!("# the key must be this hive's {HIVE_NAME_OPTION}, and the")
+}
+
 /// `wg peer` — print the nix snippet to add a peer hive to the mesh.
 /// Pure output (no fallible work), so it returns `()`; the dispatch arm
 /// wraps it in `Ok` to match the sibling verbs.
@@ -193,7 +206,7 @@ pub(crate) fn wg_peer(domain: &str, pubkey: &str, address: &str, endpoint: Optio
         println!("    wireguardEndpoint = \"{ep}\";");
     }
     println!("  }};");
-    println!("  # the key must be that hive's services.hyperhive.hiveName");
+    println!("{}", wg_peer_key_note());
 }
 
 /// The `peer-config` step carrying the secret store's `pki` root: the
@@ -248,7 +261,7 @@ pub(crate) fn peer_config(domain: &str, wg_address: Option<&str>, wg_endpoint: O
         println!("  wireguardEndpoint = \"{ep}\";");
     }
     println!("}};");
-    println!("# the key must be this hive's services.hyperhive.hiveName, and the");
+    println!("{}", peer_config_key_note());
     println!("# same entry belongs in every hive's config — `hives` is the swarm.");
     if !self_signed {
         println!(
@@ -276,10 +289,26 @@ pub(crate) fn wg_status() -> Result<()> {
 
 #[cfg(test)]
 mod tests {
-    use super::{STORE_PKI_ROOT_PATH, store_root_step, write_key_0400};
+    use super::{
+        STORE_PKI_ROOT_PATH, peer_config_key_note, store_root_step, wg_peer_key_note,
+        write_key_0400,
+    };
 
     const PEM: &str = "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----";
 
+    /// Both snippets tell the operator to set the deploy option, never the
+    /// removed `services.hyperhive` spelling.
+    #[test]
+    fn key_notes_name_the_deploy_option() {
+        for note in [wg_peer_key_note(), peer_config_key_note()] {
+            assert!(
+                note.contains("services.hyperhive.deploy.hive-controller.hiveName"),
+                "{note}"
+            );
+            assert!(!note.contains("services.hyperhive.hiveName"), "{note}");
+        }
+    }
+
     /// The certificate is printed whole, on lines of its own, so a peer
     /// operator can copy it out of the output as a PEM file.
     #[test]