hive-tls: the root fetch presents the hive identity, as on main

On a hive fronting no swarm name, swarm-services-cert's token-less
GET pki/ca/pem presents baoHiveIdentity{Cert,Key}File again. The fetch
never logs in and grants nothing; the client certificate only completes
the store listener's mTLS. A hive host without the store therefore needs
no copy of the services-issuer pair.

The issue path, which logs in to pki/issue/swarm-services, still presents
only deploy.bao.servicesIssuerClient{Cert,Key}File.

module-eval-hive-tls: the root-fetch cases pin the hive identity and the
absence of the services-issuer pair (a fixture holding both, and one
holding only the hive identity); the issue-path case pins the pair on a
hive host and on a host without a hive; a gateway without the pair
evaluates and its issue path names both options.

Root-fetch identity: option (a), mara on PR #5002 (comment 92591).

Refs #4921

nix/host-modules/hive-tls.nix

@@ -116,7 +116,9 @@ let
 
   # The hive's own store identity: its subject is
   # `<hiveLeafCommonNamePrefix>-<hiveName>`, and its policy may issue from
-  # `hiveLeafRole` alone. Every hive must hold one.
+  # `hiveLeafRole` alone. It also carries the root fetch's handshake. Every
+  # hive must hold one.
+  haveHiveIdentity = cfg.baoHiveIdentityCertFile != null && cfg.baoHiveIdentityKeyFile != null;
   requireHiveIdentity = requireIdentity {
     holder = "this hive";
     what = "store identity";
@@ -126,13 +128,12 @@ let
     keyOption = "services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityKeyFile";
   };
 
-  # The swarm-wide services-issuer identity `swarm-services-cert` presents,
-  # whether or not a hive runs here. Its subject is
-  # `servicesIssuerCommonName`, and its policy may issue from
+  # The swarm-wide services-issuer identity `swarm-services-cert` logs in
+  # with to issue the services leaf, whether or not a hive runs here. Its
+  # subject is `servicesIssuerCommonName`, and its policy may issue from
   # `pki/issue/swarm-services` alone.
   servicesIssuerCert = baoDeploy.servicesIssuerClientCertFile;
   servicesIssuerKey = baoDeploy.servicesIssuerClientKeyFile;
-  haveServicesIssuer = servicesIssuerCert != null && servicesIssuerKey != null;
   requireServicesIssuer = requireIdentity {
     holder = "this host";
     what = "services-issuer identity";
@@ -244,8 +245,9 @@ let
     BAO_CACERT = baoDeploy.serverCaFile;
   };
 
-  # The root-only fetch: the same store, server CA and services-issuer pair
-  # as `servicesCertEnvironment`, handed to curl.
+  # The root-only fetch. Same store and server CA as `servicesCertEnvironment`,
+  # but the hive's own identity: a host fronting no swarm name holds no
+  # services-issuer pair.
   storeRootCurlTls = lib.escapeShellArgs (
     lib.optionals (baoDeploy.serverCaFile != null) [
       "--cacert"
@@ -253,9 +255,9 @@ let
     ]
     ++ [
       "--cert"
-      servicesIssuerCert
+      cfg.baoHiveIdentityCertFile
       "--key"
-      servicesIssuerKey
+      cfg.baoHiveIdentityKeyFile
     ]
   );
 
@@ -303,15 +305,17 @@ in
       example = "/var/lib/swarm-bao-pki/hive-leaf.pem";
       description = ''
         This hive's own store identity. `hive-tls-resign` presents it to ask
-        the secret store for the gateway leaf.
+        the secret store for the gateway leaf, and `swarm-services-cert` on a
+        hive fronting no swarm name presents it for the handshake of the root
+        fetch.
 
         Its subject has to be
         `<services.hyperhive.deploy.bao.hiveLeafCommonNamePrefix>-<hiveName>`;
         that cert-auth role's policy may issue from this hive's gateway-leaf
         role and nothing else.
 
-        Every hive with a self-signed gateway needs it: without it that unit
-        fails, naming this option and
+        Every hive with a self-signed gateway needs it: without it both units
+        fail, naming this option and
         {option}`services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityKeyFile`.
         On the host that runs the store a glue module supplies the leaf as a
         `mkDefault`; on every other host an operator places it.
@@ -637,12 +641,13 @@ in
         # bundle: every other hive's swarm-service names chain to it.
         # `ca/pem` takes no token; the TLS client certificate is the
         # store's listener's demand, not bao's, so this presents the
-        # services-issuer pair and never logs in with it. Without a
-        # readable pair the unit fails here, naming the options.
+        # hive's own identity and never logs in with it.
+        # A hive without a readable identity fails here, naming the
+        # options: every hive must hold one.
         if [ "$want_svc" = 0 ]; then
         ${
-          if haveServicesIssuer then
-            requireServicesIssuer "fetch the store's ${baoServicesPkiMount} root"
+          if haveHiveIdentity then
+            requireHiveIdentity "fetch the store's ${baoServicesPkiMount} root"
             + ''
               echo "no swarm service domains configured — fetching only the store's pki root"
               err="$(mktemp)"
@@ -676,7 +681,7 @@ in
               fi
               exit 0''
           else
-            requireServicesIssuer "fetch the store's ${baoServicesPkiMount} root"
+            requireHiveIdentity "fetch the store's ${baoServicesPkiMount} root"
         }
         fi