From 181a82e5a61eeeb6445ad5a1b11d9f2de5a00787 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 2 Sep 2026 07:14:19 +0200 Subject: [PATCH] gateway: $connection_upgrade does not come from recommendedProxySettings The doc comment on PROXY_HEADER_BLOCK attributed the variable to `recommendedProxySettings = true`. It does not: nixpkgs' nginx module emits `map $http_upgrade $connection_upgrade` into commonHttpConfig outside that conditional, after four other independently-gated blocks. The distinction is load-bearing rather than pedantic, because several hyperhive vhosts set `recommendedProxySettings = false` per location (hive-forge's auth_request endpoint, swarm-ui, swarm-victorialogs, swarm-victoriametrics). Under the old comment, moving the per-agent include near any of them reads as breaking the websocket headers, and the fix someone would reach for is a second, redundant map in our own http config. Verified against the nixpkgs module rather than inferred: the recommendedProxySettings block opens and closes ten lines before the map, and `git grep connection_upgrade -- nix/` returns nothing, so nothing on our side defines it either. --- hive-c0re/src/gateway_nginx.rs | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/hive-c0re/src/gateway_nginx.rs b/hive-c0re/src/gateway_nginx.rs index ba54f8f5..b759dd07 100644 --- a/hive-c0re/src/gateway_nginx.rs +++ b/hive-c0re/src/gateway_nginx.rs @@ -42,11 +42,13 @@ fn health() -> &'static Mutex { } /// Nginx proxy headers present in every per-agent location block. -/// `$connection_upgrade` is defined in the http context by the NixOS -/// nginx module when `recommendedProxySettings = true` (which the -/// gateway always sets). `X-Forwarded-Prefix` is per-location (set -/// below in the render loop). Kept as a standalone const so it's -/// visible to tests without repeating the text. +/// `$connection_upgrade` is an http-context variable the NixOS nginx +/// module emits unconditionally (`map $http_upgrade $connection_upgrade` +/// in `commonHttpConfig`); it does not depend on +/// `recommendedProxySettings`, which several hyperhive vhosts turn off +/// per location. `X-Forwarded-Prefix` is per-location (set below in the +/// render loop). Kept as a standalone const so it's visible to tests +/// without repeating the text. const PROXY_HEADER_BLOCK: &str = " proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade;