hive-gateway: no hive-domain vhost on a host without a hive

The hive-domain vhost renders only where a hive runs. On a host without
one the only certificate is the swarm-services leaf, which does not name
the hive domain, so a homeserver host without a hive serves matrix on the
homeserver's own name only; apex matrix discovery is #4878.

Comments and test names describe the code's current behaviour.

Refs #4588

nix/module-eval/hive-tls.nix

@@ -231,10 +231,10 @@ let
         && lib.hasInfix "root-key.pem" rootScript;
     }
     {
-      # Left for PR 3, beside dropping `ca.pem`, so a rollback finds the old
-      # key and does not mint a new anchor. The control is the bundle reading
-      # `ca.pem` in the same script.
-      name = "a retired hive CA key is left in place, and its public certificate stays in the trust bundle";
+      # Nothing reads or removes a `ca-key.pem`, so a rollback finds the
+      # key and does not mint a new anchor. The control is the bundle
+      # reading `ca.pem` in the same script.
+      name = "a hive CA key is neither read nor removed, and its public certificate stays in the trust bundle";
       ok =
         !(lib.hasInfix "ca-key.pem" caUnit.script)
         && !(lib.hasInfix "ca-key.pem" leafUnit.script)
@@ -281,8 +281,6 @@ let
         && !(lib.hasInfix "(unset)" ok');
     }
     {
-      # A leaf the retired hive CA signed is re-issued from the store on the
-      # first run that reaches it; one that renews in time never is.
       # A cert from one issuance beside the key of another, left by an
       # interrupted pair of renames, is re-issued rather than left for
       # `nginx -t` to refuse. Checked on the decision side of the exit.

nix/module-eval/swarm-services-switch.nix

@@ -45,8 +45,7 @@ let
     deploy.bao.enable = true;
   };
 
-  # The homeserver on a host without a hive: its hive-domain vhost serves
-  # matrix discovery and nothing of the hive's.
+  # The homeserver on a host without a hive.
   matrixNoHive = hive {
     deploy.hive-controller.enable = false;
     deploy.matrix.enable = true;
@@ -240,24 +239,27 @@ let
             !(lib.any (t: lib.any (r: lib.hasInfix r t) hiveLeafRefs) texts)
             && m.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile == null
             && noHiveSurface m;
-          # The hive-domain vhost, where it renders at all, carries nothing
-          # that proxies to hive-c0re.
+          # No hive-domain vhost, and no vhost on the host carrying the
+          # hive's locations: c0re's `/health/`, the agent routes, swagger,
+          # or the hive domain's matrix discovery and `/matrix/` redirect.
           noHiveSurface =
             m:
             let
               vh = m.services.nginx.virtualHosts;
-              v = vh."h1.t.local";
             in
             !(vh ? "h1.t.local")
-            || (
-              !(lib.any (l: v.locations ? ${l}) [
-                "/"
-                "/api/"
+            && !(lib.any (
+              v:
+              lib.any (l: (v.locations or { }) ? ${l}) [
+                "/health/"
                 "/agent/"
                 "/api/docs/"
-              ])
-              && !(lib.hasInfix "agents.conf" (v.extraConfig or ""))
-            );
+                "/matrix/"
+                "= /.well-known/matrix/client"
+                "= /.well-known/matrix/server"
+              ]
+              || lib.hasInfix "agents.conf" (v.extraConfig or "")
+            ) (lib.attrValues vh));
           noHive =
             m:
             let
@@ -302,14 +304,15 @@ let
           store.services.hyperhive.swarm.localServiceDomains
           == [ store.services.hyperhive.swarm.bao.ui.domain ]
         && !(waitsForLeaf store)
-        # The homeserver without a hive: the hive-domain vhost serves matrix
-        # discovery and the redirect, and no hive surface.
+        # The homeserver without a hive: no hive-domain vhost at all, and the
+        # homeserver's own vhost still proxies `/_matrix/`.
         && noHive matrixNoHive
         && (
           let
-            l = matrixNoHive.services.nginx.virtualHosts."h1.t.local".locations;
+            gh = matrixNoHive.services.hyperhive.swarm.matrix.gatewayHost;
+            vh = matrixNoHive.services.nginx.virtualHosts;
           in
-          l ? "= /.well-known/matrix/client" && l ? "= /.well-known/matrix/server"
+          gh != null && vh ? ${gh} && lib.any (lib.hasPrefix "/_matrix") (lib.attrNames vh.${gh}.locations)
         )
         && !(store.services.nginx.virtualHosts ? "h1.t.local")
         && lib.hasInfix "want_svc=1" store.systemd.services.swarm-services-cert.script
@@ -318,7 +321,12 @@ let
         && hs ? hive-tls-resign
         && lib.hasInfix "install -m 0644 /var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" hs.hive-gateway-self-signed-cert.script
         && swarmServicesHere.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile != null
-        && swarmServicesHere.services.nginx.virtualHosts."h1.t.local".locations ? "/api/"
+        && (
+          let
+            l = swarmServicesHere.services.nginx.virtualHosts."h1.t.local".locations;
+          in
+          l ? "/api/" && l ? "/health/" && l ? "= /.well-known/matrix/client"
+        )
         && !(noHiveLeafAnywhere swarmServicesHere);
     }
     {