swarm builder: the all-swarm-services switch turns it on, like every other swarm service

deploy.builder.enable defaults on under deploy.allSwarmServices (mkDefault),
where the host has the builder's store identity pair, as for the review
classifier. An explicit false still wins.

nix/host-modules/deploy.nix

@@ -694,13 +694,13 @@ in
         this host's nix daemon, and swarm-controller writes the result as a
         `swarm-builder` commit status on the PR.
 
-        Not derived from
-        {option}`services.hyperhive.deploy.allSwarmServices`: the builder
-        evaluates and builds unreviewed config PRs on this host's nix daemon,
-        so running one is a decision of its own, as for the CI runner. It needs
-        the builder's store identity
-        ({option}`services.hyperhive.deploy.bao.builderClientCertFile` and
-        `builderClientKeyFile`), which the store's host mints.
+        On by default where
+        {option}`services.hyperhive.deploy.allSwarmServices` is set and this
+        host has the builder's store identity (the pair
+        {option}`services.hyperhive.deploy.bao.builderClientCertFile` and
+        `builderClientKeyFile`, minted on the store's host). It evaluates
+        unreviewed config PRs and builds them through this host's nix daemon,
+        from a container with its own network namespace.
       '';
     };
 

nix/host-modules/swarm-builder.nix

@@ -1,5 +1,6 @@
 # The swarm builder, in a `swarm-builder` container on the host that sets
-# `deploy.builder.enable`, which nothing turns on for the operator: it runs
+# `deploy.builder.enable`, which `deploy.allSwarmServices` defaults on where the
+# host has the builder's store identity (./swarm-required-services.nix). It runs
 # unreviewed config PRs through the host's nix daemon. It builds agent configs
 # for swarm-controller: the controller sends a config PR's head over the
 # queue, and the daemon builds that config on this host's agent base and

nix/host-modules/swarm-required-services.nix

@@ -117,4 +117,13 @@ in
     && deployCfg.bao.reviewClassifierClientCertFile != null
     && deployCfg.bao.reviewClassifierClientKeyFile != null
   );
+
+  # The builder, by the same rule and for the same reason: its module asserts
+  # the builder's store identity. It evaluates unreviewed config PRs, which is
+  # why ./swarm-builder.nix gives it a container with its own netns.
+  config.services.hyperhive.deploy.builder.enable = lib.mkDefault (
+    deployCfg.allSwarmServices
+    && deployCfg.bao.builderClientCertFile != null
+    && deployCfg.bao.builderClientKeyFile != null
+  );
 }