deploy: forward swarm.forge.ci to deploy.ci-runner, say what the forwarded enable needs

swarm.forge.ci.* were per-host options that 4423da48 had already moved to deploy.forgejo.ci.*, so they rename straight to deploy.ci-runner like the forgejo.ci ones; ciRunnerRemoved goes with its last caller.

The forwarded enable now trips deploy.ci-runner's store-identity assertion on a host with no deploy.bao.enable. The assertion names both options and the default, the doc states the requirement, and a module-eval case pins the refusal.

docs/scheduler/ci.md

@@ -126,11 +126,20 @@ for example `"3h"` — a job that exceeds it's killed so a hung or runaway build
 can't hold the runner's single slot indefinitely).
 
 The old `services.hyperhive.deploy.forgejo.ci.{enable,name,concurrency,labels,package,jobTimeout}`
-are still accepted: each is a rename of the same-named option under
+and `services.hyperhive.swarm.forge.ci.{enable,name,concurrency,labels,package}`
-`deploy.ci-runner`, same type and meaning, and evaluation warns naming both
+are still accepted: each forwards to the same-named option under
-paths. Set the new name to silence the warning. The two `name` defaults
+`deploy.ci-runner`, and evaluation warns naming both paths. Set the new name to
-differ (`hive-ci` before, `swarm-ci-runner` now), so a host that never set the
+silence the warning. The two `name` defaults differ (`hive-ci` before,
-old `name` shows up under the new default.
+`swarm-ci-runner` now), so a host that never set the old `name` shows up under
+the new default.
+
+The forwarded `enable` carries the new module's requirements, not the old
+module's: a host that sets only the old `enable` is refused at evaluation
+unless `services.hyperhive.deploy.bao.ciRunnerClientCertFile` and
+`ciRunnerClientKeyFile` are both set. They default to the identity
+`glue-bao-tls.nix` mints when `services.hyperhive.deploy.bao.enable` is true;
+elsewhere place them as described under _For operators_. The runner no longer
+needs `deploy.forgejo.enable` or a hive on its host.
 
 ## Container design
 

nix/host-modules/deploy.nix

@@ -32,32 +32,6 @@
 let
   deployCfg = config.services.hyperhive.deploy;
 
-  # A removed CI-runner option. Its replacement has the same name under
-  # `deploy.ci-runner`.
-  ciRunnerRemoved =
-    from: opt:
-    lib.mkRemovedOptionModule
-      (
-        [
-          "services"
-          "hyperhive"
-        ]
-        ++ from
-        ++ [ opt ]
-      )
-      ''
-        The CI runner is the swarm service in swarm-ci-runner.nix. It runs on
-        any host, needs neither the forge nor a hive there, and registers with
-        the token swarm-controller publishes to the secret store. Set
-        services.hyperhive.deploy.ci-runner.${opt} instead.
-
-        The runner registers as a new runner on the forge, so delete the old
-        one in the forge's admin panel (Site administration, Actions, Runners).
-        A forge host that runs the swarm-controller keeps resolving
-        `uses: actions/checkout` from itself unless
-        services.hyperhive.deploy.forgejo.actionsFromSelf is false there.
-        See docs/scheduler/ci.md.
-      '';
 in
 {
   imports = [
@@ -200,13 +174,28 @@ in
       [ "services" "hyperhive" "deploy" "ci-runner" "jobTimeout" ]
     )
 
-    # The `swarm.forge.ci` spellings fail evaluation and name the option under
+    # The runner toggle sat under `swarm.forge.ci` before `deploy.forgejo.ci`.
-    # `deploy.ci-runner` to set instead.
+    # Both were per-host, so each forwards straight to its final path.
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "enable")
+    (lib.mkRenamedOptionModule
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "name")
+      [ "services" "hyperhive" "swarm" "forge" "ci" "enable" ]
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "concurrency")
+      [ "services" "hyperhive" "deploy" "ci-runner" "enable" ]
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "labels")
+    )
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "package")
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "name" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "name" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "concurrency" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "concurrency" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "labels" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "labels" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "package" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "package" ]
+    )
 
     # The queue's callout identity. What stays under `swarm.nats` is what the
     # queue IS to every hive — the ports it answers on and the client id it is

nix/host-modules/swarm-ci-runner.nix

@@ -167,9 +167,11 @@ in
           swarm-bao-ci-runner.service reads the forge's runner registration
           token with it, and the runner cannot register without that token.
 
-          On the host that runs the store, glue-bao-tls.nix supplies both as
+          Both default to the pair glue-bao-tls.nix mints when
-          defaults. Elsewhere, copy ci-runner.pem and ci-runner-key.pem from
+          services.hyperhive.deploy.bao.enable is true (the host that runs
-          the store host's /var/lib/swarm-bao-pki/ and name them here.
+          the store). Otherwise copy ci-runner.pem and ci-runner-key.pem from
+          the store host's /var/lib/swarm-bao-pki/ and name them in those two
+          options.
         '';
       }
     ];

nix/module-eval/forge-placement.nix

@@ -74,8 +74,21 @@ let
     deploy.bao.ciRunnerClientCertFile = "/etc/pki/bao-ci-runner.pem";
     deploy.bao.ciRunnerClientKeyFile = "/etc/pki/bao-ci-runner-key.pem";
   };
+  # The old name alone, with no store identity placed and none defaulted.
+  ciUnderForgeNoIdentity = hive {
+    deploy.hive-controller.enable = false;
+    deploy.forgejo.ci.enable = true;
+  };
   # The older spelling, under the swarm-level forge options.
-  ciUnderSwarmForge = hive { swarm.forge.ci.enable = true; };
+  ciUnderSwarmForge = hive {
+    swarm.forge.ci.enable = true;
+    swarm.forge.ci.name = "older-runner";
+    swarm.forge.ci.concurrency = 2;
+    swarm.forge.ci.labels = [ "nix:host" ];
+    swarm.forge.ci.package = pkgs.hello;
+    deploy.bao.ciRunnerClientCertFile = "/etc/pki/bao-ci-runner.pem";
+    deploy.bao.ciRunnerClientKeyFile = "/etc/pki/bao-ci-runner-key.pem";
+  };
 
   runsForge = m: m.services.hyperhive.deploy.forgejo.enable && m.containers ? hive-forge;
 
@@ -241,9 +254,30 @@ let
         && !(lib.any (a: !a.assertion) ciUnderForge.assertions);
     }
     {
-      # A removed option evaluates to an assertion naming the replacement.
+      # The control is the container: it only exists if `enable` arrived.
-      name = "a CI option under swarm.forge names its replacement under deploy.ci-runner";
+      name = "a CI option under swarm.forge sets the same option under deploy.ci-runner";
-      ok = refusedOver ciUnderSwarmForge "services.hyperhive.deploy.ci-runner.enable instead";
+      ok =
+        let
+          r = ciUnderSwarmForge.services.hyperhive.deploy.ci-runner;
+        in
+        r.enable
+        && r.name == "older-runner"
+        && r.concurrency == 2
+        && r.labels == [ "nix:host" ]
+        && r.package == pkgs.hello
+        && ciUnderSwarmForge.containers ? swarm-ci-runner
+        && lib.any (lib.hasInfix "services.hyperhive.swarm.forge.ci.enable") ciUnderSwarmForge.warnings
+        && !(lib.any (a: !a.assertion) ciUnderSwarmForge.assertions);
+    }
+    {
+      # The rename carries `enable` but not the identity: an old config with
+      # only the old name is refused, and the message says what to set. The
+      # control is the placed pair in `ciUnderForge` above.
+      name = "an old CI enable without a store identity is refused naming the options to set";
+      ok =
+        refusedOver ciUnderForgeNoIdentity "services.hyperhive.deploy.bao.ciRunnerClientCertFile"
+        && refusedOver ciUnderForgeNoIdentity "services.hyperhive.deploy.bao.ciRunnerClientKeyFile"
+        && refusedOver ciUnderForgeNoIdentity "services.hyperhive.deploy.bao.enable";
     }
     {
       # Nothing writes the delivery path away from the forge, and a