From f09a942395d4b0cfab40bc31fa0ab21a8e501ad5 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Sun, 13 Sep 2026 18:30:40 +0200
Subject: [PATCH 1/2] nix: point three modules' tlsCfg alias at the current
 hive-controller path

---
 nix/host-modules/swarm-authelia.nix | 2 +-
 nix/host-modules/swarm-grafana.nix  | 2 +-
 nix/host-modules/swarm-otel.nix     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 38aac164..027d9667 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -99,7 +99,7 @@ let
   unitName = "authelia-${instance}";
   stateDir = "/var/lib/${unitName}";
 
-  tlsCfg = hyperhiveCfg.tls;
+  tlsCfg = deployCfg.hive-controller.tls;
   caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
   # `swarm-authelia-bridge` verifies the gateway when it introspects by name.
   # Nothing in this container trusted the swarm CA, which is a runtime file no
diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix
index 81ec4374..df6f45f6 100644
--- a/nix/host-modules/swarm-grafana.nix
+++ b/nix/host-modules/swarm-grafana.nix
@@ -20,7 +20,7 @@ let
   networkCfg = config.services.hyperhive.network;
   hyperhiveCfg = config.services.hyperhive;
   gatewayCfg = hyperhiveCfg.gateway;
-  tlsCfg = hyperhiveCfg.tls;
+  tlsCfg = deployCfg.hive-controller.tls;
   autheliaCfg = hyperhiveCfg.swarm.authelia;
   vmCfg = hyperhiveCfg.swarm.victoriametrics;
   vlCfg = hyperhiveCfg.swarm.victorialogs;
diff --git a/nix/host-modules/swarm-otel.nix b/nix/host-modules/swarm-otel.nix
index 5856b39f..01ed5c58 100644
--- a/nix/host-modules/swarm-otel.nix
+++ b/nix/host-modules/swarm-otel.nix
@@ -163,7 +163,7 @@ let
   # `security.pki.certificateFiles`.
   caTrust = import ./lib/hive-ca-trust.nix {
     inherit lib;
-    tlsCfg = hyperhiveCfg.tls;
+    tlsCfg = deployCfg.hive-controller.tls;
     inherit gatewayCfg;
   };
 

From 6271d5db1340238c9876bc9517249b657f1323d1 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Sun, 13 Sep 2026 18:51:43 +0200
Subject: [PATCH 2/2] nix: inline the tls alias instead of a local let-binding

---
 nix/host-modules/swarm-authelia.nix | 6 ++++--
 nix/host-modules/swarm-grafana.nix  | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 027d9667..41eb3722 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -99,8 +99,10 @@ let
   unitName = "authelia-${instance}";
   stateDir = "/var/lib/${unitName}";
 
-  tlsCfg = deployCfg.hive-controller.tls;
-  caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
+  caTrust = import ./lib/hive-ca-trust.nix {
+    inherit lib gatewayCfg;
+    tlsCfg = deployCfg.hive-controller.tls;
+  };
   # `swarm-authelia-bridge` verifies the gateway when it introspects by name.
   # Nothing in this container trusted the swarm CA, which is a runtime file no
   # build-time option can name — so an https call out of here could only ever
diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix
index df6f45f6..6c6d37f4 100644
--- a/nix/host-modules/swarm-grafana.nix
+++ b/nix/host-modules/swarm-grafana.nix
@@ -20,13 +20,15 @@ let
   networkCfg = config.services.hyperhive.network;
   hyperhiveCfg = config.services.hyperhive;
   gatewayCfg = hyperhiveCfg.gateway;
-  tlsCfg = deployCfg.hive-controller.tls;
   autheliaCfg = hyperhiveCfg.swarm.authelia;
   vmCfg = hyperhiveCfg.swarm.victoriametrics;
   vlCfg = hyperhiveCfg.swarm.victorialogs;
   swarmDomain = hyperhiveCfg.swarm.domain;
 
-  caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
+  caTrust = import ./lib/hive-ca-trust.nix {
+    inherit lib gatewayCfg;
+    tlsCfg = deployCfg.hive-controller.tls;
+  };
 
   # Spelled ONCE. The provisioned datasource declares it and every panel in the
   # provisioned dashboards references it; a second literal would be free to