swarm-ui: package option moves to deploy.swarm-controller.ui.package

The swarm UI has no switch of its own since it runs wherever the
controller runs; its package option follows it under
deploy.swarm-controller.ui. deploy.swarm-ui.package and
swarm.ui.package stay as renames and warn at evaluation. The flake's
default, the vhost root and the module-eval stub use the new path.

docs/swarm/ui.md

@@ -402,6 +402,10 @@ the UI is a view onto the controller's state and reaches it over that
 daemon's socket, so the host that runs the controller is the host that
 can serve the UI. A hive that merely _uses_ a swarm has nothing to serve.
 
+The UI build is `deploy.swarm-controller.ui.package` (defaulted from this
+flake's `swarm-ui` package). The older `deploy.swarm-ui.package` and
+`swarm.ui.package` still work and warn at evaluation.
+
 The UI answers on `services.hyperhive.swarm.domain` and nothing else. It
 shares that name with the swarm-controller it fronts — one service to a
 reader and to a certificate — so there is no separate option to pin.

flake.nix

@@ -151,7 +151,7 @@
               services.hyperhive.deploy.swarm-controller.swarmctlPackage =
                 lib.mkDefault
                   self.packages.${pkgs.stdenv.hostPlatform.system}.swarmctl;
-              services.hyperhive.deploy.swarm-ui.package =
+              services.hyperhive.deploy.swarm-controller.ui.package =
                 lib.mkDefault
                   self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-ui;
               services.hyperhive.deploy.victorialogs.authPackage =

nix/host-modules/deploy.nix

@@ -467,11 +467,16 @@ in
       [ "services" "hyperhive" "swarm" "victoriametrics" "package" ]
       [ "services" "hyperhive" "deploy" "victoriametrics" "package" ]
     )
-    # With this one `services.hyperhive.swarm.ui` holds nothing at all: its
+    # With these two `services.hyperhive.swarm.ui` holds nothing at all: its
-    # `enable` is an ignored switch (declared below) and its `package` is renamed here.
+    # `enable` is an ignored switch (declared below) and its `package` is
+    # renamed here. `deploy.swarm-ui` keeps only its ignored `enable`.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "ui" "package" ]
+      [ "services" "hyperhive" "deploy" "swarm-controller" "ui" "package" ]
+    )
+    (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "deploy" "swarm-ui" "package" ]
+      [ "services" "hyperhive" "deploy" "swarm-controller" "ui" "package" ]
     )
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "nats" "authPackage" ]

nix/host-modules/swarm-ui.nix

@@ -21,11 +21,11 @@ let
   # this UI was left out of that overlay entirely (an operator with a
   # stylix-themed host saw the dashboard in their own colours but this
   # UI still on the default Catppuccin palette), because nothing here
-  # ever served a themed `colors.css` in place of `deployCfg.swarm-ui.package`'s own.
+  # ever served a themed `colors.css` in place of `deployCfg.swarm-controller.ui.package`'s own.
   # Detection + CSS-generation is shared (`./stylix-theme.nix`).
   #
   # No package-copy derivation: this vhost has exactly one location
-  # serving `deployCfg.swarm-ui.package` (unlike hive-c0re's `servedFrontend`, which
+  # serving `deployCfg.swarm-controller.ui.package` (unlike hive-c0re's `servedFrontend`, which
   # backs both the dashboard root AND every per-agent gateway route, so
   # a single swapped tree covers both) — an `= /static/colors.css`
   # exact-match location overriding just that one file, same idiom
@@ -83,10 +83,11 @@ in
     '')
   ];
 
-  # ⚠️ `services.hyperhive.swarm.ui` is not a namespace. Its `package` lives
+  # ⚠️ Neither `services.hyperhive.swarm.ui` nor `deploy.swarm-ui` is a
-  # under `deploy.swarm-ui`, and the `swarm.ui` paths survive purely as
+  # namespace for anything but the old spellings: the UI's `package` lives
+  # under `deploy.swarm-controller.ui`, and the old paths survive purely as
   # rename/removal entries in ./deploy.nix.
-  options.services.hyperhive.deploy.swarm-ui.package = lib.mkOption {
+  options.services.hyperhive.deploy.swarm-controller.ui.package = lib.mkOption {
     type = lib.types.package;
     defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-ui";
     description = ''
@@ -187,7 +188,7 @@ in
         extraConfig = gatewayCfg.lib.securityHeaders;
         locations = {
           "/" = {
-            root = "${deployCfg.swarm-ui.package}";
+            root = "${deployCfg.swarm-controller.ui.package}";
             extraConfig = ''
               ${swarmAuthRequest}
               # SPA: any path the bundle routes client-side is served the
@@ -198,7 +199,7 @@ in
         }
         // lib.optionalAttrs (stylixThemeColors != null) {
           # Stylix theming (see the `let` block above): overrides just
-          # this one file from `deployCfg.swarm-ui.package`'s own static root, rather
+          # this one file from `deployCfg.swarm-controller.ui.package`'s own static root, rather
           # than copying the whole tree to change one file inside it —
           # nginx resolves the more specific `=` exact match over the
           # `/` prefix root above, so this simply doesn't exist (falling

nix/module-eval/lib.nix

@@ -22,7 +22,7 @@
 #
 # ⚠️ **This evaluates, it does not execute** — a command line, a request or
 # a certificate needs something that *runs* it. A case needing a rendered
-# file must stub what it drags in (`deploy.swarm-ui.package = pkgs.emptyDirectory`).
+# file must stub what it drags in (`deploy.swarm-controller.ui.package = pkgs.emptyDirectory`).
 #
 # `hive`/`hiveWithController`/`agent`/`agentWith` builders, the shared cross-group helpers, and
 # the `runGroup` derivation builder live in ./lib.nix; each file below

nix/module-eval/swarm-services-switch.nix

@@ -73,7 +73,8 @@ let
   # The swarm UI on the controller's host — the control the absence arm
   # needs, since nothing else in this suite renders this vhost and an arm
   # saying "it is not there" would hold just as well if it were never there.
-  # Package stubbed per this file's header: the vhost roots at it.
+  # Package stubbed per this file's header: the vhost roots at it. Set through
+  # its old `deploy.swarm-ui.package` spelling, which must reach the vhost.
   #
   # Also sets both ignored UI switches to `false`: the vhost must render
   # regardless, and each must evaluate and warn. Neither
@@ -307,6 +308,20 @@ let
       name = "the swarm UI claims the swarm apex wherever this host runs the swarm controller";
       ok = swarmUiHere.services.nginx.virtualHosts ? "t.local";
     }
+    {
+      name = "the old swarm UI package spelling sets the controller's UI package, which the vhost serves";
+      ok =
+        let
+          uiPackage = swarmUiHere.services.hyperhive.deploy.swarm-controller.ui.package;
+        in
+        uiPackage == pkgs.emptyDirectory
+        && swarmUiHere.services.nginx.virtualHosts."t.local".locations."/".root == "${uiPackage}"
+        && lib.any (
+          w:
+          lib.hasInfix "services.hyperhive.deploy.swarm-ui.package" w
+          && lib.hasInfix "services.hyperhive.deploy.swarm-controller.ui.package" w
+        ) swarmUiHere.warnings;
+    }
     {
       # Control: `swarmServicesHere` sets neither ignored switch.
       name = "a definition of an ignored swarm UI switch evaluates and warns, naming the option and the controller";