hive-tls owns the per-host list of locally fronted service domains

nix/host-modules/swarm-bao.nix

@@ -2470,7 +2470,7 @@ in
         every gateway host, whether or not a hive runs there.
 
         Required on every self-signed gateway host that fronts a swarm-service
-        name ({option}`services.hyperhive.swarm.localServiceDomains` not
+        name ({option}`services.hyperhive.deploy.hive-controller.tls.localServiceDomains` not
         empty). Unset there, the host evaluates and `swarm-services-cert`
         fails, naming both options. A host fronting none only fetches the
         store's root, presenting

nix/host-modules/swarm.nix

@@ -90,7 +90,7 @@ let
   # Every name is listed whether or not this host runs the service: the
   # store's issuing role is built from this list on the store's host and
   # has to admit a leaf for any gateway in the swarm. What one gateway's
-  # leaf carries is `localServiceDomains`.
+  # leaf carries is `deploy.hive-controller.tls.localServiceDomains`.
   #
   # Membership is also what `gateway.lib.tlsFor` consults to pick the
   # services leaf over the hive one, so a gateway-published swarm name
@@ -278,27 +278,6 @@ in
     '';
   };
 
-  options.services.hyperhive.swarm.localServiceDomains = lib.mkOption {
-    type = lib.types.listOf lib.types.str;
-    readOnly = true;
-    internal = true;
-    description = ''
-      Read-only: the names in `serviceDomains` **this host actually
-      fronts**, which is what its services leaf may carry. The swarm-wide
-      set stays what the sub-CA is name-constrained to and what the
-      store's issuing role permits; narrowing the leaf is what stops a
-      private key on one gateway presenting a valid certificate for
-      services that host does not serve and never has.
-
-      Read off the rendered `services.nginx.virtualHosts` rather than off
-      the per-service deploy flags: those flags are what the vhosts are
-      already guarded on, so a second reading of them is a copy that
-      drifts from the thing it claims to describe. Filtering
-      `serviceDomains` rather than assembling a list beside it is that
-      option's own constraint, and it applies here for the same reason.
-    '';
-  };
-
   config = {
     # Total on a null `swarm.domain` for the reason `hives.<name>.domain`'s
     # default gives.
@@ -317,10 +296,6 @@ in
       lib.unique (lib.filter (d: d != null && d != "") serviceDomains')
     );
 
-    services.hyperhive.swarm.localServiceDomains = lib.filter (
-      d: config.services.nginx.virtualHosts ? ${d}
-    ) swarmCfg.serviceDomains;
-
     assertions = [
       {
         # An EMPTY `hives` fires this too, deliberately: since