nix: inline the tls alias instead of a local let-binding

nix/host-modules/swarm-authelia.nix

@@ -99,8 +99,10 @@ let
   unitName = "authelia-${instance}";
   stateDir = "/var/lib/${unitName}";
 
-  tlsCfg = hyperhiveCfg.tls;
-  caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
+  caTrust = import ./lib/hive-ca-trust.nix {
+    inherit lib gatewayCfg;
+    tlsCfg = deployCfg.hive-controller.tls;
+  };
   # `swarm-authelia-bridge` verifies the gateway when it introspects by name.
   # Nothing in this container trusted the swarm CA, which is a runtime file no
   # build-time option can name — so an https call out of here could only ever

nix/host-modules/swarm-grafana.nix

@@ -20,13 +20,15 @@ let
   networkCfg = config.services.hyperhive.network;
   hyperhiveCfg = config.services.hyperhive;
   gatewayCfg = hyperhiveCfg.gateway;
-  tlsCfg = hyperhiveCfg.tls;
   autheliaCfg = hyperhiveCfg.swarm.authelia;
   vmCfg = hyperhiveCfg.swarm.victoriametrics;
   vlCfg = hyperhiveCfg.swarm.victorialogs;
   swarmDomain = hyperhiveCfg.swarm.domain;
 
-  caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
+  caTrust = import ./lib/hive-ca-trust.nix {
+    inherit lib gatewayCfg;
+    tlsCfg = deployCfg.hive-controller.tls;
+  };
 
   # Spelled ONCE. The provisioned datasource declares it and every panel in the
   # provisioned dashboards references it; a second literal would be free to

nix/host-modules/swarm-otel.nix

@@ -163,7 +163,7 @@ let
   # `security.pki.certificateFiles`.
   caTrust = import ./lib/hive-ca-trust.nix {
     inherit lib;
-    tlsCfg = hyperhiveCfg.tls;
+    tlsCfg = deployCfg.hive-controller.tls;
     inherit gatewayCfg;
   };