vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nix(forge): derive ROOT_URL scheme from gateway TLS, not always http

Browse source 
Fixes #1724. The forgejo ROOT_URL was hardcoded `http://` even when the
gateway terminates TLS, producing broken clone links and mixed-content
redirects for a TLS deployment.

Derive the scheme + port from gateway state: `https` (on httpsPort) when
the gateway terminates TLS (`gateway.selfSignedTls` or `gateway.tls.certDir`
set), `http` (on gateway.port) otherwise — dropping the port suffix on the
canonical port for the scheme (80 / 443). The per-agent in-cluster
HIVE_FORGE_URL is unaffected (it stays http on the gateway's :80 path);
this only changes the public ROOT_URL forgejo advertises.

Refreshes the `rootUrl` option description (the TLS scheme is auto-derived
now, so the manual-override-for-TLS note is gone).

Eval-proven: gateway.selfSignedTls = true → ROOT_URL =
https://forge.<domain>/; false → http://forge.<domain>/.
This commit is contained in:
atlas 2026-06-17 18:22:35 +02:00 • committed by mara
commit 147fb46cdc
1 changed files with 26 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

41
nix/modules/hive-forge.nix
View file

@ -12,18 +12,26 @@ let
# ROOT_URL forgejo advertises in clone links + outbound URLs. When
# served behind the gateway, `cfg.domain` doubles as both the
# forgejo `DOMAIN` setting AND the gateway vhost server-name, so
# ROOT_URL just uses it directly (drops the port suffix when the
# gateway is on the canonical port 80). When direct (gateway off
# or `behindGateway = false`), keep the host:port shape so direct
# browser access on `:httpPort` still produces correct links.
# Operators can override via `cfg.rootUrl` for TLS / non-default
# gateway ports / bespoke shapes.
# ROOT_URL just uses it directly (dropping the port suffix on the
# canonical port for the scheme — 80 for http, 443 for https). The
# scheme + port follow what the gateway actually serves: `https` when
# the gateway terminates TLS (a self-signed cert or an external
# `tls.certDir`), `http` otherwise (#1724) — advertising `http://` for
# a TLS gateway produces broken clone links + mixed-content redirects.
# When direct (gateway off or `behindGateway = false`), keep the
# host:httpPort shape so direct browser access still produces correct
# links. Operators can still override via `cfg.rootUrl` for bespoke
# shapes.
gatewayTls = gatewayCfg.selfSignedTls || gatewayCfg.tls.certDir != null;
defaultRootUrl =
if cfg.behindGateway then
let
portSuffix = if gatewayCfg.port == 80 then "" else ":${toString gatewayCfg.port}";
scheme = if gatewayTls then "https" else "http";
port = if gatewayTls then gatewayCfg.httpsPort else gatewayCfg.port;
canonicalPort = if gatewayTls then 443 else 80;
portSuffix = if port == canonicalPort then "" else ":${toString port}";
in
"http://${cfg.domain}${portSuffix}/"
"${scheme}://${cfg.domain}${portSuffix}/"
else
"http://${cfg.domain}:${toString cfg.httpPort}/";
effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;
@ -147,16 +155,19 @@ in
description = ''
Override the auto-derived forgejo `ROOT_URL`. When `null`
(default), `ROOT_URL` is derived from `cfg.domain` + gateway
state:
state, including the scheme:
- `behindGateway = true` → `http://''${cfg.domain}/` (uses
`services.hyperhive.gateway.port` when non-80)
- `behindGateway = true` → `https://''${cfg.domain}/` when the
gateway terminates TLS (`gateway.selfSignedTls = true` or
`gateway.tls.certDir` set), otherwise `http://''${cfg.domain}/`.
A non-canonical gateway port (`gateway.port` for http,
`gateway.httpsPort` for https) is appended as `:<port>`.
- `behindGateway = false` → `http://''${cfg.domain}:''${cfg.httpPort}/`
Set this to a fully-qualified URL when running behind TLS
termination (`https://...`), a non-default gateway port, or
a bespoke shape. Must end with `/` per forgejo's `ROOT_URL`
contract.
The TLS scheme is derived automatically now, so you only need to
set this for a genuinely bespoke shape (e.g. an external reverse
proxy on a different host/path). Must end with `/` per forgejo's
`ROOT_URL` contract.
'';
};