swarm-bao-pki: sign every other hive's three store leaves

The store host's `swarm-bao-pki` now also signs, for every hive in
`swarm.hives` other than its own, the reader (`<hive>`), queue-agent
(`<queueAgentCommonNamePrefix>-<hive>`) and gateway-leaf
(`<hiveLeafCommonNamePrefix>-<hive>`) leaves, into
/var/lib/swarm-bao-pki/hives/<hive>/ with the basenames the own hive's
leaves use. Same CA, same `signLeaf`, idempotent on absence like every
other leaf in the unit. `signLeaf` now takes the CA from the top of the
PKI directory rather than from the leaf's directory; every existing
caller passed that directory, so their output is unchanged.

The operator still copies the files to the other hive's host and names
them in config; only the openssl step against the CA goes away
(mara on #5016, c95685: "ok mint").

Closes #5016

docs/swarm/bao.md

@@ -103,8 +103,23 @@ certificates come from a real internal CA; the store has no opinion about
 which. A host that does **not** deploy the store names the reader's three
 itself, plus a pair for every principal it runs — see
 [per-principal identities](secrets.md#per-principal-identities) for the list.
-The operator issues those leaves out of band; they're the credentials the
-store can't hand you, being what opens it.
+They're the credentials the store can't hand you, being what opens it, so the
+store's host signs them and the operator copies them to the host that needs
+them and names them in config. The service principals' leaves are at the top of
+`/var/lib/swarm-bao-pki/`, named after the principal.
+
+For every hive in `swarm.hives` other than its own, the store's host signs
+that hive's three leaves into `/var/lib/swarm-bao-pki/hives/<hive>/`:
+
+| file                                     | subject                                          | name it in                                                                      |
+| ---------------------------------------- | ------------------------------------------------ | ------------------------------------------------------------------------------- |
+| `client.pem`, `client-key.pem`           | `<hive>`                                         | `deploy.bao.clientCertFile`, `.clientKeyFile`                                   |
+| `queue-agent.pem`, `queue-agent-key.pem` | `<deploy.bao.queueAgentCommonNamePrefix>-<hive>` | `deploy.bao.queueAgentClientCertFile`, `.queueAgentClientKeyFile`               |
+| `hive-leaf.pem`, `hive-leaf-key.pem`     | `<deploy.bao.hiveLeafCommonNamePrefix>-<hive>`   | `deploy.hive-controller.tls.baoHiveIdentityCertFile`, `.baoHiveIdentityKeyFile` |
+
+Copy `/var/lib/swarm-bao-pki/ca.pem` with them and name it in
+`deploy.bao.serverCaFile`. A hive added to `swarm.hives` gets its directory on
+the store host's next deploy; a leaf already there is never re-signed.
 
 ⚠️ Not the gateway's HTTPS certificates and not the store's `pki` root — this is **mTLS
 between services and the store**, a separate trust domain, because a store

docs/swarm/ca.md

@@ -35,8 +35,10 @@ from the store's own client CA, with the subject
 
 - On the host running the store, `swarm-bao-pki.service` mints it at
   `/var/lib/swarm-bao-pki/hive-leaf.pem` and the two options default to it.
-- On every other host, copy a leaf with that subject from the store's host
-  and set both options, before the host's next deploy.
+- On every other host, copy `hive-leaf.pem` and `hive-leaf-key.pem` from
+  `/var/lib/swarm-bao-pki/hives/<hiveName>/` on the store's host, which
+  `swarm-bao-pki.service` mints for every other hive in `swarm.hives`, and
+  set both options, before the host's next deploy.
 
 Without it, `hive-tls-resign.service` fails with a message naming both
 options, and so does `swarm-services-cert.service` on a hive fronting no

docs/swarm/secrets.md

@@ -426,8 +426,11 @@ leaf two units share: the forge's host holds one store identity for the token it
 publishes and the OIDC client secret it reads.
 
 On a host that mints its own PKI, `glue-bao-tls.nix` signs all seven and defaults
-all fourteen options, and there is nothing to do. Elsewhere you issue each leaf from
-that CA out of band and name it here — one file per principal rather than one file
+all fourteen options, and there is nothing to do. Elsewhere you copy each leaf from
+the store's host and name it here: a service principal's from the top of
+`/var/lib/swarm-bao-pki/`, another hive's queue-agent pair from
+`/var/lib/swarm-bao-pki/hives/<hive>/` ([bao.md § TLS](bao.md#tls) lists that
+directory). That's one file per principal rather than one file
 shared by seven, which is the whole of what this buys. `swarm-ci-runner.nix`
 refuses the build wherever the runner runs without its pair, as
 `swarm-review-classifier.nix` does for the classifier and `swarm-grafana.nix`