warn when the in-swarm cache runs under another domain

docs/swarm/builder.md

@@ -412,6 +412,9 @@ The swarm then renders no container, vhost or unit of its own cache, and
 creates no secret in the store. The store's host still mints the cache's
 leaf and writes its role, which nothing logs in to.
 
+A host that has `deploy.attic.enable` on and `swarm.attic.domain` set to another
+name gets an evaluation warning that names this fix.
+
 ## What hives do with the cache
 
 Every five minutes `swarm-controller` copies the four `swarm/services/attic/`

nix/host-modules/swarm-attic.nix

@@ -223,6 +223,23 @@ in
       }
     ];
 
+    # Not an assertion: a cache served under a name of the operator's own is a
+    # working setup, and an assertion would fail it.
+    warnings = lib.optional (atticCfg.domain != atticCfg.ownDomain) ''
+      services.hyperhive.deploy.attic.enable is on while
+      services.hyperhive.swarm.attic.domain is "${toString atticCfg.domain}", not
+      the swarm cache's own name "${atticCfg.ownDomain}". This host runs the
+      swarm's cache and its gateway serves that name, so pushes to an external
+      cache there fail the certificate check.
+
+      For an external cache, set
+      services.hyperhive.deploy.attic.enable = lib.mkForce false; where the
+      shared services are hosted ("To use an external cache, override the two
+      defaults and don't set `deploy.attic.enable` anywhere", docs/swarm/builder.md).
+      For the swarm's own cache, drop the override of
+      services.hyperhive.swarm.attic.domain.
+    '';
+
     # nspawn fails to start the container when a credential source is
     # missing, so where this host mints the leaf the container waits for it. The
     # CA ordering keeps the trust bundle's bind source there first.

nix/module-eval/builder.nix

@@ -110,6 +110,11 @@ let
     swarm.attic.domain = "cache.example.org";
     swarm.attic.cache = "grid";
   };
+  atticWarnings =
+    m:
+    lib.length (
+      lib.filter (lib.hasInfix "services.hyperhive.deploy.attic.enable is on while") m.warnings
+    );
   hasAtticHost =
     m:
     m.containers ? swarm-attic
@@ -369,6 +374,18 @@ let
         && !(atticByHand.services.hyperhive.gateway.vhosts ? "attic.t.local")
         && atticHere.services.hyperhive.gateway.vhosts ? "attic.t.local";
     }
+    {
+      # The cache running here under a name other than its own warns once, naming
+      # the fix. `atticHere` (default name) and `atticExternal` (cache off) are
+      # the controls that the same lookup finds no warning.
+      name = "the cache running under another name warns once, and the default and an external cache do not";
+      ok =
+        atticWarnings atticByHand == 1
+        && lib.any (lib.hasInfix "lib.mkForce false") atticByHand.warnings
+        && lib.any (lib.hasInfix "cache.example.org") atticByHand.warnings
+        && atticWarnings atticHere == 0
+        && atticWarnings atticExternal == 0;
+    }
     {
       # An operator's external cache on a host that hosts the shared services:
       # with the switch forced off nothing of the cache is rendered, and the