hive-tls owns the per-host list of locally fronted service domains

docs/swarm/ca.md

@@ -146,7 +146,7 @@ same list on every host, populates the role's
 `allowed_domains`, so asking for a name nobody configured is a refusal
 from the store naming that name — not a certificate quietly issued for
 it. A host's own SANs are narrower still: it asks only for the names it
-fronts a vhost for (`swarm.localServiceDomains`), so the key on one
+fronts a vhost for (`deploy.hive-controller.tls.localServiceDomains`), so the key on one
 gateway can't serve a swarm service that runs behind another.
 
 **The root's public certificate is a file, on every self-signed gateway host:**

nix/host-modules/swarm-bao.nix

@@ -2470,7 +2470,7 @@ in
         every gateway host, whether or not a hive runs there.
 
         Required on every self-signed gateway host that fronts a swarm-service
-        name ({option}`services.hyperhive.swarm.localServiceDomains` not
+        name ({option}`services.hyperhive.deploy.hive-controller.tls.localServiceDomains` not
         empty). Unset there, the host evaluates and `swarm-services-cert`
         fails, naming both options. A host fronting none only fetches the
         store's root, presenting

nix/host-modules/swarm.nix

@@ -90,7 +90,7 @@ let
   # Every name is listed whether or not this host runs the service: the
   # store's issuing role is built from this list on the store's host and
   # has to admit a leaf for any gateway in the swarm. What one gateway's
-  # leaf carries is `localServiceDomains`.
+  # leaf carries is `deploy.hive-controller.tls.localServiceDomains`.
   #
   # Membership is also what `gateway.lib.tlsFor` consults to pick the
   # services leaf over the hive one, so a gateway-published swarm name
@@ -278,27 +278,6 @@ in
     '';
   };
 
-  options.services.hyperhive.swarm.localServiceDomains = lib.mkOption {
-    type = lib.types.listOf lib.types.str;
-    readOnly = true;
-    internal = true;
-    description = ''
-      Read-only: the names in `serviceDomains` **this host actually
-      fronts**, which is what its services leaf may carry. The swarm-wide
-      set stays what the sub-CA is name-constrained to and what the
-      store's issuing role permits; narrowing the leaf is what stops a
-      private key on one gateway presenting a valid certificate for
-      services that host does not serve and never has.
-
-      Read off the rendered `services.nginx.virtualHosts` rather than off
-      the per-service deploy flags: those flags are what the vhosts are
-      already guarded on, so a second reading of them is a copy that
-      drifts from the thing it claims to describe. Filtering
-      `serviceDomains` rather than assembling a list beside it is that
-      option's own constraint, and it applies here for the same reason.
-    '';
-  };
-
   config = {
     # Total on a null `swarm.domain` for the reason `hives.<name>.domain`'s
     # default gives.
@@ -317,10 +296,6 @@ in
       lib.unique (lib.filter (d: d != null && d != "") serviceDomains')
     );
 
-    services.hyperhive.swarm.localServiceDomains = lib.filter (
-      d: config.services.nginx.virtualHosts ? ${d}
-    ) swarmCfg.serviceDomains;
-
     assertions = [
       {
         # An EMPTY `hives` fires this too, deliberately: since

nix/module-eval/bao-basics.nix

@@ -374,7 +374,7 @@ let
             m:
             builtins.elem "hive-gateway-self-signed-cert.service" m.systemd.services.swarm-services-cert.before;
         in
-        baoPkcs11.services.hyperhive.swarm.localServiceDomains == [ "bao-ui.t.local" ]
+        baoPkcs11.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ "bao-ui.t.local" ]
         && baoPkcs11.systemd.services ? hive-gateway-self-signed-cert
         && !(waits baoPkcs11)
         && !(orders baoPkcs11)

nix/module-eval/core-toggle.nix

@@ -361,7 +361,7 @@ let
       # vhosts are the hive leaf's, which this host still signs.
       name = "a host fronting none of the swarm's service names requests no services leaf";
       ok =
-        bare.services.hyperhive.swarm.localServiceDomains == [ ]
+        bare.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
         && bare.services.hyperhive.swarm.serviceDomains != [ ]
         && lib.hasInfix "want_svc=0" bare.systemd.services.swarm-services-cert.script;
     }

nix/module-eval/hive-tls.nix

@@ -222,7 +222,7 @@ let
       # that asks the store for no leaf.
       name = "a hive fronting no swarm name puts the store's pki root in its trust bundle";
       ok =
-        noService.services.hyperhive.swarm.localServiceDomains == [ ]
+        noService.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
         && lib.hasInfix ''"$BAO_ADDR/v1/pki/ca/pem"'' noSvcFetch
         && lib.hasInfix ''mv -f "$svcroot.new" "$svcroot"'' noSvcFetch
         && lib.hasInfix ''svcroot="$d/swarm-services-root.pem"'' noService.systemd.services.hive-tls-ca.script
@@ -255,7 +255,7 @@ let
       # control is the same hive with an identity, whose branch fetches.
       name = "a hive fronting no swarm name with no store identity fails the unit, naming the hive identity's options";
       ok =
-        noIdentity.services.hyperhive.swarm.localServiceDomains == [ ]
+        noIdentity.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
         && noIdentity.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile == null
         && !(lib.hasInfix "/v1/pki/ca/pem" noIdFetch)
         && lib.hasInfix "baoHiveIdentityCertFile (unset)" (noSvcBranch noIdFetch)

nix/module-eval/nats-tls.nix

@@ -420,7 +420,7 @@ let
         &&
           queueNoStore.services.nginx.virtualHosts.${natsName}.sslCertificate
           == "/var/lib/swarm-nats-gateway-tls/cert.pem"
-        && h.swarm.localServiceDomains == [ ]
+        && h.deploy.hive-controller.tls.localServiceDomains == [ ]
         && !(lib.elem natsName h.swarm.serviceDomains)
         && !(lib.elem "hive-gateway-self-signed-cert.service" (s.swarm-services-cert.requiredBy or [ ]))
         && !(lib.hasInfix "serves swarm names only with it" s.hive-gateway-self-signed-cert.script)

nix/module-eval/swarm-services-switch.nix

@@ -500,7 +500,7 @@ let
         # The store's UI alone: its nginx carries the passthrough to the
         # store, so it starts on the fallback with the store sealed.
         &&
-          store.services.hyperhive.swarm.localServiceDomains
+          store.services.hyperhive.deploy.hive-controller.tls.localServiceDomains
           == [ store.services.hyperhive.swarm.bao.ui.domain ]
         && !(waitsForLeaf store)
         # The homeserver without a hive: no hive-domain vhost at all, and the