hive-tls: move the controllers' CA env settings into glue

nix/host-modules/glue-hive-tls-controllers.nix

@@ -0,0 +1,55 @@
+# Glue: hand the hive's trust bundle to the daemons that dial the swarm over TLS.
+#
+# ONE PAIRING PER FILE — hive-c0re and the swarm controller ← the trust bundle
+# ./hive-tls.nix assembles. Deleting this leaves daemons that trust only the
+# platform roots: hive-c0re's lifecycle cannot hand agents the bundle, and the
+# swarm-queue clients die at `invalid peer certificate: UnknownIssuer` against
+# an authelia signed by the swarm CA.
+#
+# `HIVE_TLS_CA_PATH` signals the hive-c0re lifecycle that a trust bundle exists:
+# it bind-mounts the file (read-only, public certs ONLY — never a key) into each
+# agent container, and the meta flake wires the per-agent trust bundle.
+# `*_OIDC_CA_FILE` names the same anchor for the swarm-queue clients that mint a
+# token from authelia over TLS. `swarm-queue-client` builds a bare
+# `reqwest::Client`, so it trusts only the platform roots without it. Where the
+# gateway is not self-signed ./hive-tls.nix contributes no bundle and nothing is
+# set here, which is correct for a swarm fronted by a public certificate.
+#
+# ⚠️ One gate per daemon, each ANDed with the bundle existing: the gateway also
+# runs on hosts with no hive and no controller, and defining an environment key
+# on a unit that does not exist CREATES a unit fragment for it — inert (no
+# `ExecStart`, empty `wantedBy`, never activated), and it evaluates and builds
+# clean.
+#
+# ⚠️ Files like this are the only place a `deploy.<foo>` value may derive from
+# a `deploy.<bar>.enable`. Everywhere else that is forbidden.
+{
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  deployCfg = hyperhiveCfg.deploy;
+  gatewayCfg = hyperhiveCfg.gateway;
+
+  # ./hive-tls.nix writes the bundle only where the gateway serves its own
+  # self-signed cert.
+  haveBundle = gatewayCfg.enable && gatewayCfg.useSelfSigned;
+  trustBundle = "${deployCfg.hive-controller.tls.stateDir}/trust-bundle.pem";
+in
+{
+  config = lib.mkIf haveBundle (
+    lib.mkMerge [
+      (lib.mkIf deployCfg.hive-controller.enable {
+        systemd.services.hive-c0re.environment = {
+          HIVE_TLS_CA_PATH = trustBundle;
+          HIVE_C0RE_OIDC_CA_FILE = trustBundle;
+        };
+      })
+      (lib.mkIf deployCfg.swarm-controller.enable {
+        systemd.services.swarm-controller.environment.SWARM_CONTROLLER_OIDC_CA_FILE = trustBundle;
+      })
+    ]
+  );
+}