swarm snapshot store: the receiver socket binds the mesh address even when wg-hive comes up after sockets.target

The socket is wanted by sockets.target and nothing orders the wireguard
unit before it, so the mesh address can be missing at bind time
(EADDRNOTAVAIL) and the receiver never listens. FreeBind lets the bind
succeed regardless, and also covers the interface coming back after a flap.

Also assert the mesh address is not a wildcard, which the comment above the
socket already claimed, and cover the rendered socket in a module-eval case.

nix/checks.nix

@@ -150,6 +150,10 @@ in
     inherit pkgs self nixosSystem;
     inherit (pkgs) lib;
   };
+  module-eval-snapshot-store = import ./module-eval/snapshot-store.nix {
+    inherit pkgs self nixosSystem;
+    inherit (pkgs) lib;
+  };
   module-eval-agent-queue-bao = import ./module-eval/agent-queue-bao.nix {
     inherit pkgs self nixosSystem;
     inherit (pkgs) lib;

nix/host-modules/swarm-snapshot-store.nix

@@ -154,6 +154,21 @@ in
           fall back to a wildcard.
         '';
       }
+      {
+        assertion =
+          !(lib.elem meshAddress [
+            ""
+            "0.0.0.0"
+            "::"
+          ]);
+        message = ''
+          The snapshot store refuses a wildcard listen address.
+          services.hyperhive.deploy.wireguard.address is "${wgCfg.address}",
+          which would make the receiver bind "${meshAddress}" on every
+          interface. Set it to this host's address on the mesh
+          (e.g. "10.100.0.1/24").
+        '';
+      }
     ];
 
     # The store root must exist before the first connection arrives ---
@@ -185,6 +200,12 @@ in
     # into agent state, so the binding IS the access control and is
     # asserted above rather than left to a comment.
     #
+    # FreeBind lets the bind succeed before `wg-hive` has its address:
+    # sockets.target is reached before the wireguard unit, which
+    # nothing orders ahead of it, so without it the bind fails with
+    # EADDRNOTAVAIL and the receiver never listens. It also covers the
+    # interface coming back after a flap.
+    #
     # Accept=yes gives one service instance per connection and sets
     # $REMOTE_ADDR for the handler --- which is how the receiver knows
     # which peer it is talking to.
@@ -194,6 +215,7 @@ in
       socketConfig = {
         ListenStream = "${meshAddress}:${toString cfg.port}";
         Accept = "yes";
+        FreeBind = true;
       };
     };
 

nix/module-eval/snapshot-store.nix

@@ -0,0 +1,85 @@
+# `checks.module-eval-snapshot-store` — see ./lib.nix for the shared
+# rationale (why this suite exists, naming convention, "evaluates not
+# executes").
+#
+# The snapshot store's receiver socket: where it listens, that it can bind
+# before the mesh interface is up, and that it refuses a wildcard.
+{
+  pkgs,
+  lib,
+  self,
+  nixosSystem,
+}:
+let
+  inherit
+    (import ./lib.nix {
+      inherit
+        pkgs
+        lib
+        self
+        nixosSystem
+        ;
+    })
+    hive
+    runGroup
+    ;
+
+  # Bare hive: the store and the mesh it needs, nothing else.
+  store = hive {
+    deploy.wireguard.enable = true;
+    deploy.wireguard.address = "10.100.0.1/24";
+    snapshotStore.enable = true;
+    snapshotStore.port = 51822;
+  };
+
+  # The same with a wildcard where the mesh address goes.
+  storeOnWildcard = hive {
+    deploy.wireguard.enable = true;
+    deploy.wireguard.address = "0.0.0.0/24";
+    snapshotStore.enable = true;
+  };
+
+  # The IPv6 wildcard.
+  storeOnWildcardV6 = hive {
+    deploy.wireguard.enable = true;
+    deploy.wireguard.address = "::/64";
+    snapshotStore.enable = true;
+  };
+
+  socket = store.systemd.sockets.swarm-snapshot-store.socketConfig;
+
+  refusedAsWildcard =
+    m:
+    lib.any (
+      a: !a.assertion && lib.hasInfix "refuses a wildcard listen address" a.message
+    ) m.assertions;
+
+  cases = [
+    {
+      # The wg-hive address does not exist when sockets.target binds, so
+      # without FreeBind the bind fails with EADDRNOTAVAIL and the receiver
+      # never listens. The unit still renders and evaluates either way, which
+      # is why only a rendered-config check can see it.
+      name = "the receiver socket may bind before the mesh interface has its address";
+      ok = socket.FreeBind or false == true;
+    }
+    {
+      # The bare IP and the configured port: the prefix length on
+      # `deploy.wireguard.address` must not leak into the listen address.
+      name = "the receiver socket listens on the mesh address and the configured port";
+      ok = socket.ListenStream == "10.100.0.1:51822";
+    }
+    {
+      # The control for the case below: it is the wildcard that trips the
+      # assertion, not the store being on.
+      name = "a mesh address on the store raises no wildcard refusal";
+      ok = !(refusedAsWildcard store);
+    }
+    {
+      # A wildcard bind is an unauthenticated remote write into agent state.
+      name = "a wildcard mesh address, IPv4 or IPv6, is refused";
+      ok = refusedAsWildcard storeOnWildcard && refusedAsWildcard storeOnWildcardV6;
+    }
+  ];
+in
+runGroup "snapshot-store" cases