hive CA: delete ca.pem, ca-previous.pem and ca-key.pem, the bundle is the store's root

The gateway leaf comes from the store's pki mount, so a hive CA's
certificates anchor nothing and its key is a secret outside the store.

- hive-tls-ca writes trust-bundle.pem from swarm-services-root.pem alone;
  the ca.pem and ca-previous.pem slots are gone.
- Every host deletes ca.pem, ca-previous.pem and ca-key.pem in
  deploy.hive-controller.tls.stateDir with tmpfiles `r` rules that follow
  the option. The removal shim, now host-ca-removed.nix, holds these
  beside the /var/lib/swarm-ca rule and the swarm.ca.* removals.
- deploy.bao.clientCaFile, deploy.bao.serverCaFile and
  deploy.swarm-controller.hiveClientCaFile naming /var/lib/swarm-ca or one
  of the deleted hive CA files fail evaluation, naming the store's mTLS CA
  (/var/lib/swarm-bao-pki/ca.pem on the store's host) as the replacement.

module-eval hive-tls covers the single-anchor bundle, the deletion (incl.
a relocated stateDir) and the assertion on all three options.

Refs #4588

nix/host-modules/host-ca-removed.nix

@@ -0,0 +1,65 @@
+# Removal shim for the CAs a host held outside the secret store: the
+# swarm root under `/var/lib/swarm-ca` (and its `services.hyperhive.swarm.ca.*`
+# options), and a hive CA's `ca.pem`, `ca-previous.pem` and `ca-key.pem` in
+# `deploy.hive-controller.tls.stateDir`.
+#
+# The secret store's `pki` root is the only trust anchor: it issues every
+# hive's gateway leaf and the swarm's service names, and its key never leaves
+# the store. Nothing generates, reads or bundles either CA, so a definition of
+# a removed option fails evaluation with a message, a CA-file option naming
+# one of the deleted paths fails it too, and every host deletes the files.
+#
+# Self-contained and deletable, like ./swarm-peers-removed.nix: one file to
+# remove when the deprecation window closes.
+{ lib, config, ... }:
+let
+  deployCfg = config.services.hyperhive.deploy;
+
+  swarmCaDir = "/var/lib/swarm-ca";
+  hiveCaFiles = map (f: "${deployCfg.hive-controller.tls.stateDir}/${f}") [
+    "ca.pem"
+    "ca-previous.pem"
+    "ca-key.pem"
+  ];
+  deleted = p: p == swarmCaDir || lib.hasPrefix "${swarmCaDir}/" p || lib.elem p hiveCaFiles;
+
+  # Every option that names a CA the store's mTLS checks against. One
+  # pointing at a deleted file fails the unit that reads it at start.
+  caFileOptions = {
+    "services.hyperhive.deploy.bao.clientCaFile" = deployCfg.bao.clientCaFile;
+    "services.hyperhive.deploy.bao.serverCaFile" = deployCfg.bao.serverCaFile;
+    "services.hyperhive.deploy.swarm-controller.hiveClientCaFile" =
+      deployCfg.swarm-controller.hiveClientCaFile;
+  };
+
+  removed =
+    name:
+    lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "ca" name ] ''
+      The host-held swarm root CA is gone: the secret store's pki root is the
+      only trust anchor, and nothing generates or reads a root under
+      ${swarmCaDir}. Remove this definition. See docs/swarm/ca.md.
+    '';
+in
+{
+  imports = map removed [
+    "autoConfigure"
+    "stateDir"
+    "validityDays"
+  ];
+
+  assertions = lib.mapAttrsToList (option: path: {
+    assertion = path == null || !(deleted path);
+    message = ''
+      ${option} is ${toString path}, a file every host deletes along with
+      the host-held CA it belonged to. Point it at the store's mTLS CA:
+      /var/lib/swarm-bao-pki/ca.pem on the host that runs the store, the copy
+      placed by hand on any other host. See docs/swarm/ca.md.
+    '';
+  }) caFileOptions;
+
+  # Both CAs' private keys are secrets outside the store, and the
+  # certificates beside them are anchors nothing issues under. The swarm
+  # root at the option's old default path only: a relocated `stateDir` is
+  # the operator's to delete.
+  systemd.tmpfiles.rules = [ "R ${swarmCaDir}" ] ++ map (f: "r ${f}") hiveCaFiles;
+}