glue: the controller's authelia and otel environment moves out of the controller module

The authelia and swarm-otel co-location reads (swarm-controller.nix
autheliaEnv, otelEnv) move into glue-controller-env.nix.

nix/host-modules/swarm-controller.nix

@@ -119,24 +119,10 @@ let
       SWARM_CONTROLLER_AGENT_PKI_ROLE = deployCfg.bao.agentPkiRoleName;
     };
 
-  # What `swarmctl` needs in order to act on authelia from the host.
-  #
-  # Only set when authelia actually runs **here**: the controller can be
-  # enabled on a host that is not the swarm's SSO host, and in that case
-  # the right behaviour is for `swarmctl user add` to fail saying the
-  # value is unset. A guessed path would resolve cleanly and write a file
-  # nothing reads, which is the failure mode that costs an afternoon.
-  autheliaEnv = lib.optionalAttrs deployCfg.authelia.enable {
-    # The CONFIGURED authelia, not whatever is on PATH: the argon2
-    # parameters baked into a hash have to match the verifier's.
-    SWARMCTL_AUTHELIA_BIN = "${deployCfg.authelia.package}/bin/authelia";
-    SWARMCTL_AUTHELIA_USERS_FILE = deployCfg.authelia.hostUsersFile;
-  };
-
-  # Where `swarmctl agent create` posts to. Unconditional, unlike
-  # `autheliaEnv` above: this binary is only installed where the daemon
-  # runs, so the socket is always the one right below it — and it is the
-  # same `socketPath` the daemon binds, read once rather than restated.
+  # Where `swarmctl agent create` posts to. Unconditional: this binary is
+  # only installed where the daemon runs, so the socket is always the one
+  # right below it — and it is the same `socketPath` the daemon binds, read
+  # once rather than restated.
   controllerSocketEnv = {
     SWARM_CONTROLLER_SOCKET = deployCfg.swarm-controller.socketPath;
   };
@@ -259,47 +245,6 @@ let
     SWARM_CONTROLLER_NAME = config.services.hyperhive.swarm.name;
   };
 
-  # `vcs_metrics`/`hive_jobq_metrics` (this daemon's OTLP push exporters)
-  # read the standard `OTEL_EXPORTER_OTLP_ENDPOINT` var and are silent,
-  # graceful no-ops without it — same shape as `authBridgeEnv` above,
-  # genuinely optional and gated on the option resolving rather
-  # than assumed.
-  #
-  # By NAME through the gateway, never a loopback literal or a bare
-  # `producerPort` — mara's ruling on this exact module: "the swarm
-  # services dont have to run on the same host as the swarm controller."
-  # A controller and the swarm's collector are two independently-placed
-  # swarm services, exactly like a hive and the collector already are
-  # (`otel.nix`'s own `endpoint`), so this reaches it the same way: by
-  # its swarm-service name, resolved locally by dnsmasq on a co-located
-  # host and over the real network otherwise — no loopback-vs-remote
-  # knob to get wrong, and nothing here to gate on co-location because
-  # there is no co-location requirement left to check.
-  #
-  # No trailing slash: `opentelemetry_otlp`'s http/json exporter appends
-  # `/v1/metrics` to this base itself, and the swarm-otel gateway route
-  # (`swarm-otel.nix`'s nginx `locations."/${producerName}/"`) strips the
-  # `/${producerName}` prefix before the request reaches the receiver —
-  # so the two ends agree on exactly one path, `/v1/metrics`, arrived at
-  # from opposite directions.
-  #
-  # Gated on `deployCfg.swarm-otel.enable` alone (a swarm-wide fact, not "enabled
-  # HERE"): the collector is reachable by name wherever it runs, so a
-  # controller not co-located with it now exports over https instead of
-  # exporting nothing — the graceful-absence case left is "no swarm-otel
-  # anywhere in this swarm at all."
-  otelSwarmCfg = config.services.hyperhive.swarm.otel;
-  otelEnv = lib.optionalAttrs deployCfg.swarm-otel.enable {
-    OTEL_EXPORTER_OTLP_ENDPOINT = "https://${otelSwarmCfg.domain}/${otelSwarmCfg.producerName}";
-    # Checked by `swarm-otel.nix`'s `oidc/${producerName}` authenticator
-    # against exactly this controller's own registered audience (see the
-    # `audience = [ queueClientId ]` client entry in
-    # ./glue-controller-oidc-client.nix) — the two have
-    # to name the same value or the exporter mints a token the receiver
-    # was never told to accept.
-    SWARM_CONTROLLER_OTEL_AUDIENCE = queueClientId;
-  };
-
   # Wrapped rather than documented: every one of these values is derived
   # from an option this deployment already set, so making the operator
   # re-supply them on the command line would be asking them to repeat the
@@ -312,7 +257,7 @@ let
       wrapProgram $out/bin/swarmctl ${
         lib.concatStringsSep " " (
           lib.mapAttrsToList (name: value: "--set ${name} ${lib.escapeShellArg value}") (
-            autheliaEnv // controllerSocketEnv
+            controllerSocketEnv // deployCfg.swarm-controller.swarmctlEnvironment
           )
           ++ lib.mapAttrsToList (
             name: value: "--set-default ${name} ${lib.escapeShellArg value}"
@@ -604,6 +549,18 @@ in
       '';
     };
 
+    swarmctlEnvironment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      internal = true;
+      description = ''
+        Variables the installed `swarmctl` wrapper sets, on top of the
+        controller's socket path. Empty unless another module on this host
+        supplies some: ./glue-controller-env.nix adds the configured authelia
+        where authelia runs here.
+      '';
+    };
+
     baoClientCertFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -852,8 +809,7 @@ in
       // authBridgeEnv
       // swarmNameEnv
       // matrixHomeserverEnv
-      // baoEnv
-      // otelEnv;
+      // baoEnv;
     };
   };
 }