swarm: drop the -agent client suffix refusal from authelia and the queue responder

authelia.agentClientSuffix is removed (tombstoned) and the responder
takes no --agent-client-suffix: hive-<name>-agent is parsed as hive
<name>-agent like any other id. The reserved word agent still keeps a
hive from being named *-agent.

nix/host-modules/deploy.nix

@@ -95,6 +95,10 @@ in
       swarm-authelia-bridge listens on a unix socket the gateway proxies to, so
       it binds no port. Remove this definition.
     '')
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "authelia" "agentClientSuffix" ] ''
+      No client is minted per agent and the queue refuses no client id by
+      suffix, so there is no suffix to name. Remove this definition.
+    '')
     (lib.mkRemovedOptionModule [
       "services"
       "hyperhive"

nix/host-modules/swarm-authelia-service.nix

@@ -341,22 +341,6 @@ in
       '';
     };
 
-    agentClientSuffix = lib.mkOption {
-      type = lib.types.str;
-      readOnly = true;
-      default = "-agent";
-      description = ''
-        Suffix the queue's auth-callout responder refuses on a hive's client
-        id: `${config.services.hyperhive.swarm.authelia.hiveClientPrefix}alpha${config.services.hyperhive.swarm.authelia.agentClientSuffix}`
-        is denied, never read as hive `alpha-agent`. No client is minted with
-        it; an agent authenticates to the queue with its own secret.
-
-        Read-only for the same reason as `hiveClientPrefix`. A hive named with
-        this suffix is refused at evaluation, since the queue would refuse its
-        own client id.
-      '';
-    };
-
     machine = lib.mkOption {
       type = lib.types.str;
       readOnly = true;

nix/host-modules/swarm-authelia.nix

@@ -682,30 +682,6 @@ in
             + "services.hyperhive.swarm.hives; rename the hive or the "
             + "colliding client.";
         }
-        {
-          # A hive whose name ENDS with the agent suffix mints an id the
-          # queue's responder reads as a hive's agent client, which it refuses:
-          # `hive-foo-agent` parses as *the agents of hive foo* before it
-          # parses as *the hive foo-agent*, because the agent rule is the
-          # more specific one and therefore runs first. A NATS denial arrives
-          # as a timeout, so the symptom names nothing.
-          #
-          # Checkable here and nowhere downstream: the responder runs in a
-          # container with no view of the roster (`policy.rs`'s `hive_name`
-          # says why that is deliberate), so this is the last place that knows
-          # both the naming scheme and the set of names.
-          assertion =
-            !cfg.oidc.hiveIdentities
-            || !lib.any (h: lib.hasSuffix cfg.agentClientSuffix h) (lib.attrNames hyperhiveCfg.swarm.hives);
-          message =
-            "services.hyperhive.swarm.hives contains "
-            + lib.concatMapStringsSep ", " (h: "'${h}'") (
-              lib.filter (h: lib.hasSuffix cfg.agentClientSuffix h) (lib.attrNames hyperhiveCfg.swarm.hives)
-            )
-            + " — names ending with '${cfg.agentClientSuffix}', the suffix the "
-            + "queue refuses as a hive's agent client. Such a hive's own client "
-            + "id reads as one, and the queue refuses it. Rename the hive.";
-        }
         # The two obligations `authelia.bearer.authz` carries. Authelia
         # enforces both itself — but in its `preStart` validator, so a
         # violation produces a green `nixos-rebuild switch` and an authelia

nix/host-modules/swarm-nats.nix

@@ -858,7 +858,6 @@ in
                 # so a drift here is silent at the point of change and
                 # misattributed at the point of failure.
                 "--hive-client-prefix ${lib.escapeShellArg autheliaCfg.hiveClientPrefix}"
-                "--agent-client-suffix ${lib.escapeShellArg autheliaCfg.agentClientSuffix}"
                 "--reader-client ${lib.escapeShellArg controllerCfg.queueClientId}"
                 # Hears try-outs and answers each by reply, and nothing else.
                 "--review-classifier-client ${lib.escapeShellArg config.services.hyperhive.swarm.review-classifier.clientId}"

nix/host-modules/swarm.nix

@@ -360,12 +360,11 @@ in
         fragments = reservedFragments;
         why = ''
           Hive-scoped identifiers are composed from a hive name —
-          `hive-<name>`, and that id with a suffix the queue's responder
-          refuses — so a name containing one of these produces an identifier
-          that is also somebody else's, or one the responder refuses. The
-          failure is a wrong grant rather than an error: the client
-          authenticates and receives another principal's permissions, and a
-          NATS denial arrives as a timeout. Rename the hive.
+          `hive-<name>` — so a name containing one of these produces an
+          identifier that is also somebody else's. The failure is a wrong
+          grant rather than an error: the client authenticates and receives
+          another principal's permissions, and a NATS denial arrives as a
+          timeout. Rename the hive.
         '';
       })
     ];