hive-tls: a store-only host without a hive starts its gateway with the store sealed

A gateway host without a hive whose only swarm name is the store's UI no
longer waits for swarm-services-cert: its nginx carries the stream
passthrough to the store and must come up while the store is sealed. Until
the services leaf lands, hive-gateway-self-signed-cert installs a throwaway
self-signed pair on the default and swarm-services paths there; on a host
without a hive it never references the hive leaf.

A host without a hive also no longer mints the hive-leaf identity or
defaults the options pointing at it, and does not render the hive-domain
vhost, whose upstream is hive-c0re.

Refs #4588

docs/networking/gateway.md

@@ -74,9 +74,9 @@ nginx obtains and renews certs via the HTTP-01 challenge on `port` (default 80);
 
 On by default, listening on `httpsPort` (default 443) beside the plain-http `port` (default 80).
 
-The issuer is the **secret store's `pki` mount**, not a bare self-signed leaf. `hive-tls-resign.service` (from `hive-tls.nix`) asks the store for a gateway **leaf** through this hive's own role, presenting the hive's own store identity (`services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile` / `baoHiveIdentityKeyFile`), and writes it under `…tls.stateDir` (default `/var/lib/hive-tls`). `hive-gateway-self-signed-cert` then imports the leaf into nginx's state dir (`/var/lib/hive-gateway/tls/{cert,key}.pem`). [`swarm/ca.md`](../swarm/ca.md) has the role, the identity and what a hive without one does.
+The issuer is the **secret store's `pki` mount**, not a bare self-signed leaf. `hive-tls-resign.service` (from `hive-tls.nix`) asks the store for a gateway **leaf** through this hive's own role, presenting the hive's own store identity (`services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile` / `baoHiveIdentityKeyFile`), and writes it under `…tls.stateDir` (default `/var/lib/hive-tls`). `hive-gateway-self-signed-cert` then imports the leaf into nginx's state dir (`/var/lib/hive-gateway/tls/{cert,key}.pem`). On a host that runs no hive the import unit installs the swarm-services leaf there instead, or a throwaway self-signed pair until that leaf lands. [`swarm/ca.md`](../swarm/ca.md) has the role, the identity and what a hive without one does.
 
-⚠️ **Keep the import unit.** It does two jobs nginx needs: it re-modes the key to `0640 root:nginx` (nginx's pre-start `nginx -t` runs as the nginx user and fails on the source's `0600 root:root` key), and it makes sure **every cert path the config names exists** — when the swarm-services leaf is missing it installs the hive leaf in its place. nginx refuses a config naming a missing cert file, so without that fallback one missing leaf takes down every vhost, not just one.
+⚠️ **Keep the import unit.** It does two jobs nginx needs: it re-modes the key to `0640 root:nginx` (nginx's pre-start `nginx -t` runs as the nginx user and fails on the source's `0600 root:root` key), and it makes sure **every cert path the config names exists** — when the swarm-services leaf is missing it installs the hive leaf in its place, or on a host that runs no hive a throwaway self-signed pair. nginx refuses a config naming a missing cert file, so without that fallback one missing leaf takes down every vhost, not just one.
 
 **Why an issuer, not a bare leaf**: a bare self-signed leaf is its own trust anchor, so every regeneration is a new anchor every consumer must re-trust, and an agent's build sets its trust store once, before any leaf exists. Agents and federation peers trust the store's root once; leaf rotation never breaks them.
 

docs/swarm/ca.md

@@ -64,10 +64,13 @@ nginx serves the leaf alone, without its issuer: the issuer is the
 self-signed root a consumer already holds in its trust bundle.
 
 **A gateway host that runs no hive** (`deploy.hive-controller.enable` off,
-such as a dedicated swarm-services host) has no hive leaf, no
-`hive-tls-resign.service` and needs no hive identity. Its gateway serves the
-swarm-services leaf as its default certificate too, and waits for
-`swarm-services-cert.service` at start.
+such as a dedicated swarm-services or secret-store host) has no hive leaf, no
+`hive-tls-resign.service`, no hive identity and no hive-domain vhost. Its
+gateway serves the swarm-services leaf as its default certificate too. Where it
+fronts other swarm names it waits for `swarm-services-cert.service` at start.
+Where the store's UI is its only swarm name it starts on a throwaway
+self-signed certificate and switches to the services leaf once the store
+issues it.
 
 ## The trust bundle
 

docs/swarm/secrets.md

@@ -447,8 +447,9 @@ credential. Anything on the store's host that can dial loopback, and any
 `admins` session through the vhost, needs only a token to use the API. Unseal
 from the host's `bao` CLI; the UI's unseal form gets a 403. On a self-signed
 gateway where the UI is the only swarm name its host fronts, that host's nginx
-doesn't wait for the store: it serves the hive certificate on the UI's name (a
-browser warning) until the unsealed store issues the services leaf, so the
+doesn't wait for the store: it serves the hive leaf, or on a host that runs no
+hive a throwaway self-signed certificate, on the UI's name (a browser warning)
+until the unsealed store issues the services leaf, so the
 stream passthrough readers use on that host comes up with the store sealed.
 
 ### OIDC login