From 249aab6642deab659338855dd6d71ac30b8b1614 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sun, 18 Oct 2026 23:44:32 +0200
Subject: [PATCH] module-eval: the always-on hive collector put a scrape target
 and an identity demand on hives that assumed none

---
 nix/module-eval/core-toggle.nix | 11 +++++++++--
 nix/module-eval/nats-tls.nix    |  7 ++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix
index 033ac861..5e8d1db9 100644
--- a/nix/module-eval/core-toggle.nix
+++ b/nix/module-eval/core-toggle.nix
@@ -156,7 +156,12 @@ let
         let
           es = swarmServiceEnables bare;
         in
-        lib.length (lib.attrNames es) == 9 && !lib.any lib.id (lib.attrValues es);
+        # `otel` is the hive tier, which every hive runs and so `bare` does
+        # too: it is the control that the lookup finds what is there, and the
+        # other eight are the swarm's shared services.
+        lib.length (lib.attrNames es) == 9
+        && es.otel
+        && !lib.any lib.id (lib.attrValues (removeAttrs es [ "otel" ]));
     }
     {
       name = "the all-local mode turns the swarm controller on";
@@ -1003,7 +1008,9 @@ let
       # passes every arm above while handing a collector-less hive a scrape
       # target for a port nothing binds.
       name = "a hive with no collector declares no self-scrape target";
-      ok = bare.services.hyperhive.otel.scrapeTargets == { };
+      ok =
+        centralToggleOff.services.hyperhive.otel.scrapeTargets == { }
+        && bare.services.hyperhive.otel.scrapeTargets ? collector;
     }
     {
       # Absence arm, and the one that matters: claiming a name this host does
diff --git a/nix/module-eval/nats-tls.nix b/nix/module-eval/nats-tls.nix
index 2ced25bf..0da3684c 100644
--- a/nix/module-eval/nats-tls.nix
+++ b/nix/module-eval/nats-tls.nix
@@ -67,7 +67,12 @@ let
     deploy.swarm-controller.baoClientKeyFile = "/var/lib/swarm-controller/bao-client-key.pem";
   };
   remote = hiveWithController (
-    lib.recursiveUpdate remoteSecrets { deploy.swarm-controller.enable = true; }
+    lib.recursiveUpdate remoteSecrets {
+      deploy.swarm-controller.enable = true;
+      # The hive collector every hive runs demands an identity to present to
+      # the swarm; a hive with no store leaf names the secret file by hand.
+      otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
+    }
   );
 
   # The same hive given its own store leaf by hand, which is what turns