From d0fa1f98a19735f22b4184579010667c1ef4df85 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Thu, 15 Oct 2026 07:57:52 +0200
Subject: [PATCH] module-eval: three duplicate nixosSystem fixtures come from
 shared.nix

builder.nix's bare, servicesHere and natsHere were exact copies of
shared.bareWithController, swarm-services-switch's swarmServicesHere and
nats-authelia's natsOldPath. The last two move into shared.nix; each file
rebinds them under its local name, so no case changes.
---
 nix/checks.nix                            |  1 +
 nix/module-eval/builder.nix               | 11 ++++-------
 nix/module-eval/nats-authelia.nix         | 10 +++-------
 nix/module-eval/shared.nix                | 11 +++++++++++
 nix/module-eval/swarm-services-switch.nix |  2 +-
 5 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/nix/checks.nix b/nix/checks.nix
index 34fff7ad..45d6fe3e 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -47,6 +47,7 @@ in
   module-eval-builder = import ./module-eval/builder.nix {
     inherit pkgs self nixosSystem;
     inherit (pkgs) lib;
+    shared = moduleEvalShared;
   };
   module-eval-nats-authelia = import ./module-eval/nats-authelia.nix {
     inherit pkgs self nixosSystem;
diff --git a/nix/module-eval/builder.nix b/nix/module-eval/builder.nix
index c552bc0b..0f8a3042 100644
--- a/nix/module-eval/builder.nix
+++ b/nix/module-eval/builder.nix
@@ -7,6 +7,7 @@
   lib,
   self,
   nixosSystem,
+  shared,
 }:
 let
   inherit
@@ -19,11 +20,10 @@ let
         ;
     })
     hive
-    hiveWithController
     runGroup
     ;
 
-  bare = hiveWithController { };
+  bare = shared.bareWithController;
 
   # On the store's host, which mints the builder's store identity.
   withBuilder = hive {
@@ -31,16 +31,13 @@ let
     deploy.builder.enable = true;
   };
 
-  servicesHere = hiveWithController { deploy.allSwarmServices = true; };
+  servicesHere = shared.swarmServicesWithController;
   # Short-circuits on `assertion`, so only a failing one has its message read.
   refusedWithoutIdentity =
     m:
     lib.any (a: !a.assertion && lib.hasInfix "deploy.builder.enable requires" a.message) m.assertions;
 
-  natsHere = hive {
-    swarm.nats.enable = true;
-    swarm.nats.authPackage = pkgs.emptyDirectory;
-  };
+  natsHere = shared.natsOldPath;
 
   autheliaHere = hive {
     deploy.bao.enable = true;
diff --git a/nix/module-eval/nats-authelia.nix b/nix/module-eval/nats-authelia.nix
index deade9ee..9cb4b81b 100644
--- a/nix/module-eval/nats-authelia.nix
+++ b/nix/module-eval/nats-authelia.nix
@@ -22,13 +22,9 @@ let
     runGroup
     ;
 
-  # The queue's two old `swarm.nats` paths that still rename, `enable` and
-  # `authPackage`, so dropping either shim fails the eval. No store identity,
-  # which the first case below relies on.
-  natsOldPath = hive {
-    swarm.nats.enable = true;
-    swarm.nats.authPackage = pkgs.emptyDirectory;
-  };
+  # The queue's two old `swarm.nats` paths that still rename; dropping either
+  # shim fails the eval. No store identity, which the first case below relies on.
+  natsOldPath = shared.natsOldPath;
 
   # Seventh split slice, plus slice 10's two authelia packages. Of slice 7's
   # movers only `usersFile` has a rename entry — the other two are `readOnly`,
diff --git a/nix/module-eval/shared.nix b/nix/module-eval/shared.nix
index 428b92c0..5ddf6fb3 100644
--- a/nix/module-eval/shared.nix
+++ b/nix/module-eval/shared.nix
@@ -51,6 +51,17 @@ in
 
   servicesHere = hive { deploy.allSwarmServices = true; };
 
+  # The all-swarm-services switch on the controller's host, the services box
+  # shape that hives elsewhere join.
+  swarmServicesWithController = hiveWithController { deploy.allSwarmServices = true; };
+
+  # The queue's two old `swarm.nats` paths that still rename, `enable` and
+  # `authPackage`, with no store identity.
+  natsOldPath = hive {
+    swarm.nats.enable = true;
+    swarm.nats.authPackage = pkgs.emptyDirectory;
+  };
+
   controllerAlone = hive { deploy.swarm-controller.enable = true; };
 
   matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
diff --git a/nix/module-eval/swarm-services-switch.nix b/nix/module-eval/swarm-services-switch.nix
index fb7b38c4..2d101347 100644
--- a/nix/module-eval/swarm-services-switch.nix
+++ b/nix/module-eval/swarm-services-switch.nix
@@ -88,7 +88,7 @@ let
   # The swarm's shared services hosted HERE without the all-local mode — a
   # services box with hives elsewhere, the shape ./host-modules/
   # swarm-required-services.nix documents the switch for.
-  swarmServicesHere = hiveWithController { deploy.allSwarmServices = true; };
+  swarmServicesHere = shared.swarmServicesWithController;
 
   # Same, with the operator opting out of the classifier and the builder,
   # which the switch defaults on and everything else it owns stays on.