send agent traffic through squid once its hive announces it

nix/module-eval/hive-otel.nix

@@ -622,6 +622,68 @@ let
         builtins.elem 3128 fw.interfaces.${hiveOtel.services.hyperhive.network.bridgeName}.allowedTCPPorts
         && !(builtins.elem 3128 fw.allowedTCPPorts);
     }
+    {
+      # The facts that tell an agent this host's squid checks its credential and
+      # applies its flag. Presence arm: a hive holding a store identity writes
+      # both, and the direct hosts carry the names the brief's destinations
+      # resolve under. Absence arm: a hive with no identity renders no users
+      # file, so it announces no proxy.
+      name = "hive-c0re hands agents the squid address and the hosts that skip it, only with a store identity";
+      ok =
+        let
+          e = hiveOtelAllLocal.systemd.services.hive-c0re.environment;
+          s = hiveOtelAllLocal.services.hyperhive;
+          hosts = lib.splitString "," e.HIVE_EGRESS_NO_PROXY;
+        in
+        e.HIVE_SQUID_PROXY == "${s.network.bridgeIp}:3128"
+        && e.HIVE_SQUID_PROXY == s.squid.listen
+        && lib.all (h: lib.elem h hosts) (
+          [
+            s.network.bridgeIp
+            s.swarm.domain
+            s.swarm.bao.domain
+            s.swarm.nats.domain
+            s.swarm.attic.domain
+            s.swarm.forge.domain
+            s.swarm.matrix.gatewayHost
+            s.swarm.victorialogs.domain
+            s.swarm.victoriametrics.domain
+            s.swarm.otel.domain
+            s.otel.collector.host
+            s.domain
+          ]
+          ++ s.gateway.localNames
+        )
+        && !(lib.elem "example.com" hosts)
+        && lib.length hosts == lib.length (lib.unique hosts)
+        && !(hiveOtelBare.systemd.services.hive-c0re.environment ? HIVE_SQUID_PROXY)
+        && !(hiveOtelBare.systemd.services.hive-c0re.environment ? HIVE_EGRESS_NO_PROXY);
+    }
+    {
+      # The store and the queue are in no list the gateway builds, so a hive whose
+      # store is elsewhere gets them from their own options. Control: this
+      # fixture runs no store, so the gateway does not name it.
+      name = "a hive without a local store still lists the store and the queue as direct hosts";
+      ok =
+        let
+          s = hiveOtelLeaf.services.hyperhive;
+          hosts = lib.splitString "," hiveOtelLeaf.systemd.services.hive-c0re.environment.HIVE_EGRESS_NO_PROXY;
+        in
+        !(lib.elem s.swarm.bao.domain s.gateway.localNames)
+        && lib.elem s.swarm.bao.domain hosts
+        && lib.elem s.swarm.nats.domain hosts;
+    }
+    {
+      # Squid's listener and the fact are one value.
+      name = "the squid fact is the address squid binds";
+      ok =
+        let
+          s = hiveOtelAllLocal.services.hyperhive;
+        in
+        lib.elem "http_port ${s.squid.listen}" (
+          lib.splitString "\n" hiveOtelAllLocal.services.squid.configText
+        );
+    }
   ];
 in
 runGroup "hive-otel" cases