From 6695355b9dfb8165babcbdd916beb8ac4c4e5285 Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 10 Nov 2026 21:35:08 +0100 Subject: [PATCH] docs: code comments point at the moved SSO and matrix sections --- nix/host-modules/hive-matrix.nix | 2 +- nix/host-modules/swarm-authelia.nix | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/nix/host-modules/hive-matrix.nix b/nix/host-modules/hive-matrix.nix index 55e703e05..1b288340e 100644 --- a/nix/host-modules/hive-matrix.nix +++ b/nix/host-modules/hive-matrix.nix @@ -760,7 +760,7 @@ in # Activation-time token generation — without this the bind-mount # would hand tuwunel an empty file on first boot and break every # registration until restart. Idempotent; - # docs/2-handbook/swarm/matrix.md::Provisioning flow. + # docs/4-implementation/swarm/matrix-provisioning.md::Provisioning flow (appservice). # Tell an operator whose homeserver already exists that `serverName` is # unpinned, at the one moment they are looking: the rebuild. # diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix index 4dab96b67..032b63132 100644 --- a/nix/host-modules/swarm-authelia.nix +++ b/nix/host-modules/swarm-authelia.nix @@ -281,7 +281,7 @@ let # One machine client per hive in the roster. The model — why identity is # per hive rather than per service, why `audience` is the client id, and # why these tokens are signed rather than opaque — is in - # `docs/2-handbook/swarm/sso.md`, § Machine clients. + # `docs/4-implementation/swarm/sso.md`, § Machine clients. # # Fed to the option as a DEFINITION in the config block below, rather # than appended to the declared list downstream. That is what puts it @@ -986,7 +986,7 @@ in # ⚠️ THIS IS A SECURITY BOUNDARY, not a tidy-up. Do not fold it back # into `/`: the friendly error page answers **200**, and # `auth_request` reads any 2xx as ACCESS GRANTED. Full consequence - # list in `docs/2-handbook/swarm/sso.md`, § Machine callers must fail closed. + # list in `docs/4-implementation/swarm/sso.md`, § Machine callers must fail closed. # # The split is by AUDIENCE, not by path list — including the login # page's own XHR. Enumerating individual endpoints would leave the