matrix: drop the per-hive appservice and its unused token

Every hive's homeserver loaded a per-hive `hyperhive` appservice
registration, and the swarm minted and delivered an as_token for it
through bao. No client presented that token: swarm-controller creates
every `@hive-<hive>` sender and every agent account with the swarm
appservice token (hive_sender.rs, agent_token.rs), and no Rust code read
the per-hive one.

Removed, with everything that existed only to serve it:
- hive-matrix.nix: the `hyperhive` registration, its activation-time
  render, the host bind mount of /var/lib/hyperhive/matrix-appservice,
  its LoadCredential entry, and the internal options
  `deploy.matrix.appserviceTokenFile` / `appserviceRegistrationScript`.
  tuwunel now loads only the swarm registration.
- glue-matrix-bao-token.nix and its `swarm-bao-matrix-token` unit.
- glue-bao-tls.nix: the matrix-token leaf and its defaults.
- swarm-bao.nix: the `swarm-matrix-token-<hive>` roles and policies
  (`swarm-bao-matrix-token-policy`), and the options
  `deploy.bao.matrixTokenClient{Cert,Key}File` and
  `matrixTokenCommonNamePrefix`, now mkRemovedOptionModule.
- swarm-secret-publisher.nix: the per-hive token mint and its state dir.
- swarm.nix: the reserved `<matrixTokenCommonNamePrefix>-<hive>` CN.
- swarm-secret-client: `matrix::appservice_token_path`.

The swarm registration (swarm-matrix-ctl, swarm-controller) is untouched.
Comments and docs that pointed at the removed glue file now point at
glue-queue-agent-credential.nix, which has the same reader shape.

Refs #4428

swarm-matrix-ctl/src/appservice.rs

@@ -38,19 +38,18 @@ const ENV_DIR: &str = "MATRIX_APPSERVICE_DIR";
 /// The registration's `sender_localpart`: the account the homeserver creates
 /// for it and the one `admin_execute` promotes.
 const ENV_SENDER: &str = "MATRIX_APPSERVICE_SENDER";
-/// The user namespace regex, rendered by nix beside the hive registration's.
+/// The user namespace regex, rendered by nix.
 const ENV_USER_REGEX: &str = "MATRIX_APPSERVICE_USER_REGEX";
 /// Role on the store's `cert` auth mount that [`publish`] logs in with.
 const ENV_CERT_ROLE: &str = "MATRIX_APPSERVICE_CERT_ROLE";
 
-/// The registration's `id`. Distinct from the hive registration's
-/// (`hyperhive`): tuwunel refuses two registrations with one id.
+/// The registration's `id`.
 const ID: &str = "swarm";
 /// File names inside [`ENV_DIR`]. `REGISTRATION` is what tuwunel loads.
 const AS_TOKEN: &str = "as-token";
 const HS_TOKEN: &str = "hs-token";
 const REGISTRATION: &str = "swarm.yaml";
-/// Random bytes per token, as the hive registration's renderer uses.
+/// Random bytes per token.
 const TOKEN_BYTES: usize = 32;
 
 /// Read a required variable.
@@ -115,11 +114,11 @@ fn write_secret(path: &Path, contents: &str) -> Result<()> {
     std::fs::rename(&tmp, path).with_context(|| format!("renaming onto {}", path.display()))
 }
 
-/// The registration, in the shape `hive-matrix.nix` renders the hive's.
+/// The registration tuwunel loads.
 ///
-/// `exclusive: false` for that file's reason: an exclusive namespace does not
-/// widen what this appservice may do, it refuses everyone else — and the hive
-/// registration covers the same names until it is retired.
+/// `exclusive: false` for the reason `hive-matrix.nix` gives at
+/// `appserviceUserRegex`: an exclusive namespace does not widen what this
+/// appservice may do, it refuses everyone else.
 fn registration_yaml(sender: &str, regex: &str, as_token: &str, hs_token: &str) -> String {
     format!(
         "id: {ID}\n\

swarm-matrix-ctl/src/registration.rs

@@ -1,14 +1,13 @@
 //! Reading the `as_token` out of the appservice registration the matrix
 //! container already has.
 //!
-//! No new credential is delivered for this. `nix/host-modules/hive-matrix.nix`
-//! binds the registration directory into the container read-only so tuwunel can
-//! load it, and the registration **is** the `as_token` — so the file this
-//! module opens is one this process could already read, and one the homeserver
-//! beside it reads too.
+//! No new credential is delivered for this. The registration **is** the
+//! `as_token`, and `appservice render` writes it into this container's own
+//! state dir — so the file this module opens is one this process could already
+//! read, and one the homeserver beside it reads too.
 //!
 //! Scanned line-by-line rather than parsed as YAML. The file has exactly one
-//! renderer (`appserviceRegistrationScript` in that same module, a `printf` of
+//! renderer (`registration_yaml` in `appservice.rs`, a `format!` of
 //! `as_token: <hex>`), so a parser would be a second, looser reading of a shape
 //! this repo writes itself — and it would pull a YAML crate into a binary whose
 //! only other input is JSON.
@@ -52,13 +51,12 @@ fn extract(text: &str) -> Result<String> {
 mod tests {
     use super::*;
 
-    /// The registration exactly as `appserviceRegistrationScript` renders it —
-    /// the quoted heredoc, then the `printf` of the two tokens. Reproduced
-    /// verbatim because that script is the other end of this agreement and
-    /// lives in a file no Rust test can reach.
-    const RENDERED: &str = "id: hyperhive\n\
+    /// The registration in the shape `registration_yaml` renders it, tokens
+    /// last. Reproduced rather than rendered so this module's tests do not
+    /// depend on the renderer's.
+    const RENDERED: &str = "id: swarm\n\
          url: null\n\
-         sender_localpart: hive\n\
+         sender_localpart: swarm\n\
          rate_limited: false\n\
          namespaces:\n  \
            users:\n    \
@@ -97,7 +95,7 @@ mod tests {
         // request carrying one with a 403 that names the account rather than
         // the credential — so failing here is the only report an operator can
         // act on.
-        for bad in ["id: hyperhive\n", "as_token:\n", "as_token:   \n"] {
+        for bad in ["id: swarm\n", "as_token:\n", "as_token:   \n"] {
             assert!(extract(bad).is_err(), "{bad:?} must not yield a token");
         }
     }