swarm-bao-pki: sign every other hive's three store leaves

The store host's `swarm-bao-pki` now also signs, for every hive in
`swarm.hives` other than its own, the reader (`<hive>`), queue-agent
(`<queueAgentCommonNamePrefix>-<hive>`) and gateway-leaf
(`<hiveLeafCommonNamePrefix>-<hive>`) leaves, into
/var/lib/swarm-bao-pki/hives/<hive>/ with the basenames the own hive's
leaves use. Same CA, same `signLeaf`, idempotent on absence like every
other leaf in the unit. `signLeaf` now takes the CA from the top of the
PKI directory rather than from the leaf's directory; every existing
caller passed that directory, so their output is unchanged.

The operator still copies the files to the other hive's host and names
them in config; only the openssl step against the CA goes away
(mara on #5016, c95685: "ok mint").

Closes #5016

nix/host-modules/glue-bao-tls.nix

@@ -49,7 +49,13 @@ let
   # thing.
   clientCn = hyperhiveCfg.hiveName;
 
+  # Every other hive in the swarm directory. This host's own hive is signed
+  # into the top of the directory, beside the leaves its units read.
+  otherHives = lib.filter (h: h != clientCn) (lib.attrNames hyperhiveCfg.swarm.hives);
+
   # $1 dir  $2 basename  $3 CN  $4 SAN or ""  $5 EKU
+  # The CA is always the one at the top of `pkiDir`, whichever dir the leaf
+  # lands in.
   signLeaf = pkgs.writeShellScript "swarm-bao-sign-leaf" ''
     set -euo pipefail
     d="$1"; base="$2"; cn="$3"; sans="$4"; eku="$5"
@@ -65,7 +71,7 @@ let
       printf 'keyUsage=critical,digitalSignature,keyEncipherment\n'
       printf 'extendedKeyUsage=%s\n' "$eku"
     } > "$ext"
-    openssl x509 -req -in "$csr" -CA "$d/ca.pem" -CAkey "$d/ca-key.pem" \
+    openssl x509 -req -in "$csr" -CA ${pkiDir}/ca.pem -CAkey ${pkiDir}/ca-key.pem \
       -CAcreateserial -days 3650 -sha256 -extfile "$ext" -out "$d/$base.pem"
     chmod 0600 "$d/$base-key.pem"
     chmod 0644 "$d/$base.pem"
@@ -162,9 +168,9 @@ in
         fi
 
         # The store's own identity, and the identity of a reader on this host.
-        # A reader elsewhere gets its leaf from this CA out of band — that is
-        # what makes the store reachable from another machine at all, and why
-        # the CA is a file rather than a service.
+        # A reader elsewhere gets its leaf from this CA too — that is what
+        # makes the store reachable from another machine at all, and why the
+        # CA is a file rather than a service.
         [ -s ${pkiDir}/server.pem ] || ${signLeaf} ${pkiDir} server \
           ${lib.escapeShellArg cfg.domain} ${lib.escapeShellArg "DNS:${cfg.domain}"} serverAuth
         [ -s ${pkiDir}/client.pem ] || ${signLeaf} ${pkiDir} client \
@@ -288,11 +294,30 @@ in
           # `pki/issue/<hiveLeafPkiRolePrefix>-<hive>` and nothing else. Its
           # subject carries this hive's name, like the queue-agent leaf
           # above, because ./swarm-bao.nix writes one role
-          # per hive. Only where a hive runs; hives on other hosts are issued
-          # theirs out of band.
+          # per hive. Only where a hive runs; the other hives' are below.
           [ -s ${pkiDir}/hive-leaf.pem ] || ${signLeaf} ${pkiDir} hive-leaf \
             ${lib.escapeShellArg "${deployCfg.bao.hiveLeafCommonNamePrefix}-${clientCn}"} "" clientAuth
         ''}
+
+        # The reader, queue-agent and gateway-leaf leaves of every other hive in
+        # the swarm directory: the files an operator copies to that hive's
+        # host. One directory per hive, with the basenames this hive's leaves
+        # use, so a hive's set is one directory to copy.
+        ${lib.concatMapStrings (
+          h:
+          let
+            d = lib.escapeShellArg "${pkiDir}/hives/${h}";
+          in
+          ''
+            install -d -m 0700 ${d}
+            [ -s ${d}/client.pem ] || ${signLeaf} ${d} client \
+              ${lib.escapeShellArg h} "" clientAuth
+            [ -s ${d}/queue-agent.pem ] || ${signLeaf} ${d} queue-agent \
+              ${lib.escapeShellArg "${deployCfg.bao.queueAgentCommonNamePrefix}-${h}"} "" clientAuth
+            [ -s ${d}/hive-leaf.pem ] || ${signLeaf} ${d} hive-leaf \
+              ${lib.escapeShellArg "${deployCfg.bao.hiveLeafCommonNamePrefix}-${h}"} "" clientAuth
+          ''
+        ) otherHives}
       '';
     };
   };

nix/host-modules/glue-queue-agent-credential.nix

@@ -147,8 +147,9 @@ in
             would evaluate, deploy and log in — and undo the split.
 
             On a hive that runs the store, glue-bao-tls.nix supplies both as
-            defaults and there is nothing to do. Elsewhere the leaf is issued
-            from that CA out of band and named here — see docs/swarm/secrets.md.
+            defaults and there is nothing to do. Elsewhere copy the pair from
+            /var/lib/swarm-bao-pki/hives/<hive>/ on the store's host and name it
+            here — see docs/swarm/bao.md.
           '';
         }
       ];