service urls carry no gateway port, httpsPort is listen-only

nix/host-modules/hive-forge/service.nix

@@ -8,7 +8,6 @@
 }:
 let
   cfg = config.services.hyperhive.swarm.forge;
-  gatewayCfg = config.services.hyperhive.gateway;
   swarmDomain = config.services.hyperhive.swarm.domain;
 
   # Forgejo's name for the login source. Duplicated in ./default.nix, which
@@ -22,11 +21,7 @@ let
 
   # Forgejo's `ROOT_URL`, duplicated from ./default.nix, which documents its
   # shape.
-  defaultRootUrl =
-    let
-      portSuffix = if gatewayCfg.httpsPort == 443 then "" else ":${toString gatewayCfg.httpsPort}";
-    in
-    "https://${cfg.domain}${portSuffix}/";
+  defaultRootUrl = "https://${cfg.domain}/";
   effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;
 in
 {
@@ -117,8 +112,8 @@ in
         (default), `ROOT_URL` is `https://''${cfg.domain}/`. The gateway
         always terminates TLS (self-signed is the implicit floor when no
         `gateway.tls.certDir` / ACME is set), so the forge is always
-        advertised over https. A non-canonical `gateway.httpsPort` is
-        appended as `:<port>`.
+        advertised over https, on the default port. A gateway that listens
+        on another `gateway.httpsPort` does not change this URL.
 
         Set this only for a genuinely bespoke shape (e.g. an external
         reverse proxy on a different host/path). Must end with `/` per
@@ -159,12 +154,6 @@ in
           than a knob. The glue that registers this client wherever
           authelia runs reads it from here instead of restating the
           format.
-
-          ⚠️ With {option}`services.hyperhive.swarm.forge.rootUrl` unset,
-          `ROOT_URL` follows the gateway's `httpsPort`, which is
-          per-host. An authelia host that is not the forge's host renders
-          the forge's callback only if the two agree on it; set `rootUrl`
-          if they do not.
         '';
       };
       # The secret half is fetched from the swarm secret store on the host