squid self-check: use a public canary, drop the swarm service names from the allow list

docs/networking/network.md

@@ -289,9 +289,12 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   restricted. Agents must not start sending credentials until every hive runs
   the `hive-c0re` that writes it, or a legacy agent loses general internet.
 
-- **Allow-list.** `services.hyperhive.squid.allowedDomains` defaults to the
-  swarm's own service names (`services.hyperhive.swarm.serviceDomains`). Each
-  entry matches that exact name. A user on the unrestricted list reaches any
+- **Allow-list.** `services.hyperhive.squid.allowedDomains` defaults to empty,
+  plus the self-check canary (`services.hyperhive.squid.selfcheck.canary`), so
+  the canary widens the restricted list by that one name. The swarm's own
+  service names aren't on it: they resolve to the bridge or a private address,
+  which the rules below refuse, and agents reach them directly. Each entry
+  matches that exact name. A user on the unrestricted list reaches any
   other name too, on ports 80 and 443. Everyone else gets a 403 for it.
 - **Unlisted names.** For a user who isn't on the unrestricted list, refused
   after the destination checks, which look the name up on the host.
@@ -307,7 +310,8 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   answer between a check and the connect gains nothing. A listed name must
   therefore resolve to a public address on the host's resolver: a split-horizon
   name that answers a LAN address gets a 403, and so does the self-check
-  canary. Only `CONNECT` to port 443 and plain HTTP to ports 80 and 443 pass.
+  canary, which is why it isn't a swarm service name. Only `CONNECT` to port
+  443 and plain HTTP to ports 80 and 443 pass.
 - **Metrics.** `squid-exporter` serves `prometheus-squid-exporter` on
   `127.0.0.1:9301`. The hive collector scrapes it as job `squid` through
   `services.hyperhive.otel.scrapeTargets`. `squid_up` and
@@ -318,7 +322,8 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   client's source address.
 - **Self-check.** `squid-selfcheck.timer` runs `squid-selfcheck.service`
   every minute from the bridge IP, logging in as `selfcheck.squid`: `CONNECT`
-  to `services.hyperhive.squid.selfcheck.canary` (default: the forge's name)
+  to `services.hyperhive.squid.selfcheck.canary` (default: `cache.nixos.org`,
+  a public name that's also on the allow-list)
   must answer 200, to `deny-canary.invalid` 403, and to the canary without a
   credential 407. It then logs in as `selfcheck-unrestricted.squid`, which has
   the same secret and is always on the unrestricted list, and a `CONNECT` to
@@ -333,8 +338,7 @@ credential=present|absent unrestricted_canary=… unrestricted_status=…` line
   written the users file, the line reads `credential=absent` or
   `allow_status=407` and `ok=false`, and nothing else breaks. The
   host's resolver looks up the canary, so a host whose resolver maps
-  that name to a loopback or bridge address (a single-host swarm with
-  `gateway.localHostsEntry`) fails the check.
+  that name to a loopback, bridge or private address fails the check.
 
 ## Container isolation