Follow the macOS install layout for config, ACL, and identity paths

The macOS packaging installs config under /usr/local/etc/fips, wired through
the launchd plist and build-pkg.sh, but the default-path constants and the
config search path were hardcoded to /etc/fips for all Unix. On macOS the
daemon and fipsctl therefore looked in a directory that does not exist: the
ACL and host-map loaders hit their NotFound no-op arm and returned empty
state, so a populated peers.deny reported effective_mode "default_open" with
enforcement inactive, and host-file aliases went unloaded, with no error.

The peers.allow, peers.deny and hosts defaults now follow the platform's
packaging, and fipsctl keygen writes its identity there too. The config
search path keeps probing /etc/fips first and adds /usr/local/etc/fips after
it, so an existing install keeps working across the upgrade and the packaged
file still wins over a stale leftover. Both the macOS search-path entry and
the keygen output directory read one SYSTEM_CONFIG_DIR constant, so they
cannot drift apart. At startup the daemon warns once about hosts, peers.allow
or peers.deny stranded at the old location; the config file is deliberately
excluded, since both directories stay on the search path and a config left
behind is still read.

The control-socket snapshot tests repoint the ACL reloader at non-existent
paths under the temp dir, so the snapshot no longer reflects whatever ACL
files happen to exist on the machine running the tests.

Platform-gated unit tests pin both layouts, so a future refactor cannot
silently drift either one. Linux and Windows behavior is unchanged.

Adding a second system config directory moves the directory the daemon
derives the identity key path from, since that comes from whichever config
file loaded last. A host carrying fips.yaml at both locations would have
resolved fips.key to the new directory, found none, and under persistent
generated a fresh identity, silently changing its npub, routing address and
mesh IPv6 with no migration path. The daemon now adopts a key stranded at the
legacy path and warns to move it rather than generating one. The fallback is
confined to keys resolved from the system config directory, so a run using
./fips.yaml or a user config is never redirected to a system key.

Co-authored-by: Johnathan Corgan <johnathan@corganlabs.com>

src/node/acl.rs

@@ -23,11 +23,52 @@ use std::time::SystemTime;
 use tracing::{debug, info, warn};
 
 /// Default path for the peer allow list.
+///
+/// On macOS the install layout (see `packaging/macos/`) ships config under
+/// `/usr/local/etc/fips/` rather than `/etc/fips/`; the default follows the
+/// platform's packaging so the daemon reads the file the operator was told
+/// to edit. Linux and other Unix keep the historic `/etc/fips/` location.
+#[cfg(target_os = "macos")]
+pub const DEFAULT_PEERS_ALLOW_PATH: &str = "/usr/local/etc/fips/peers.allow";
+#[cfg(not(target_os = "macos"))]
 pub const DEFAULT_PEERS_ALLOW_PATH: &str = "/etc/fips/peers.allow";
 
 /// Default path for the peer deny list.
+///
+/// See [`DEFAULT_PEERS_ALLOW_PATH`] for the macOS `/usr/local/etc/fips/`
+/// rationale.
+#[cfg(target_os = "macos")]
+pub const DEFAULT_PEERS_DENY_PATH: &str = "/usr/local/etc/fips/peers.deny";
+#[cfg(not(target_os = "macos"))]
 pub const DEFAULT_PEERS_DENY_PATH: &str = "/etc/fips/peers.deny";
 
+/// Warn about config files stranded at the pre-move default location.
+///
+/// The macOS defaults for `hosts`, `peers.allow` and `peers.deny` moved
+/// from `/etc/fips` to `/usr/local/etc/fips`, the directory the macOS
+/// packaging actually populates. The old location is no longer read by
+/// the default path constants, and a `peers.deny` silently left behind
+/// there would fail open (a missing deny list is not an error), so surface
+/// the situation loudly once at startup.
+#[cfg(target_os = "macos")]
+pub fn warn_on_legacy_config_paths() {
+    for (current, name) in [
+        (crate::upper::hosts::DEFAULT_HOSTS_PATH, "hosts"),
+        (DEFAULT_PEERS_ALLOW_PATH, "peers.allow"),
+        (DEFAULT_PEERS_DENY_PATH, "peers.deny"),
+    ] {
+        let legacy = format!("/etc/fips/{name}");
+        if std::path::Path::new(&legacy).exists() && !std::path::Path::new(current).exists() {
+            warn!(
+                legacy = %legacy,
+                current = %current,
+                "Config file found at legacy path but not at the current default; \
+                 it is no longer read — move it to the current path"
+            );
+        }
+    }
+}
+
 /// Result of evaluating a peer against the ACL.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PeerAclDecision {
@@ -451,6 +492,16 @@ impl Node {
             decision
         )))
     }
+
+    /// Test-only: replace the peer-ACL reloader with one that reads from
+    /// the given paths, isolating the node from the host's real
+    /// `peers.allow` / `peers.deny` files. Used by snapshot tests
+    /// that must be deterministic regardless of whether an operator has
+    /// edited the system ACL files on the dev/CI machine.
+    #[cfg(test)]
+    pub(crate) fn isolate_peer_acl_for_test(&mut self, allow: PathBuf, deny: PathBuf) {
+        self.peer_acl = PeerAclReloader::with_paths(allow, deny);
+    }
 }
 
 #[cfg(test)]
@@ -487,6 +538,27 @@ mod tests {
         acl
     }
 
+    // Guard against the macOS path regression: the install layout
+    // (`packaging/macos/`) ships config under `/usr/local/etc/fips/`, so the
+    // default ACL paths must follow it, or `peers.allow`/`peers.deny` are
+    // silently unread on macOS (see the `NotFound` no-op in `load_file`).
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn test_default_acl_paths_follow_macos_packaging_layout() {
+        assert_eq!(DEFAULT_PEERS_ALLOW_PATH, "/usr/local/etc/fips/peers.allow");
+        assert_eq!(DEFAULT_PEERS_DENY_PATH, "/usr/local/etc/fips/peers.deny");
+    }
+
+    // Non-macOS Unix/Linux keeps the historic `/etc/fips/` location; this
+    // runs on the Linux CI matrix and pins the value so a future refactor
+    // can't silently drift it.
+    #[cfg(all(unix, not(target_os = "macos")))]
+    #[test]
+    fn test_default_acl_paths_keep_etc_fips_layout() {
+        assert_eq!(DEFAULT_PEERS_ALLOW_PATH, "/etc/fips/peers.allow");
+        assert_eq!(DEFAULT_PEERS_DENY_PATH, "/etc/fips/peers.deny");
+    }
+
     #[test]
     fn test_acl_decision_allowed_and_display() {
         assert!(PeerAclDecision::AllowList.allowed());