vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

serve matrix discovery at the swarm apex, keep the pinned hive case

Browse source
This commit is contained in:
atlas 2026-10-25 11:13:22 +01:00 • committed by mara
commit 2e7d49bb88
10 changed files with 187 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

29
nix/host-modules/swarm-ui.nix
View file

@ -64,6 +64,16 @@ let
# rather than a coercion error from here — same idiom as
# `swarm-otel-service.nix`'s `domainBase`.
apex = if swarmCfg.domain == null then "swarm.invalid" else swarmCfg.domain;
# Matrix discovery is answered at the server name, so the apex serves it when
# that is the swarm domain (the default). A homeserver pinned to a hive
# domain is answered by that hive's vhost (./glue-matrix-hive-discovery.nix).
# Built from `gatewayHost` alone, so it does not matter which host runs the
# homeserver. The URLs carry no port: `gateway.httpsPort` only sets what the
# gateway listens on.
matrixCfg = swarmCfg.matrix;
serverName = if matrixCfg.serverName != null then matrixCfg.serverName else apex;
servesMatrixDiscovery = matrixCfg.gatewayHost != null && serverName == apex;
in
{
# No `enable` of its own: the UI is on wherever
@ -196,6 +206,25 @@ in
extraConfig = swarmAuthRequest;
};
}
// lib.optionalAttrs servesMatrixDiscovery {
# Same JSON, headers and `:443` as the hive-domain copy in
# ./glue-matrix-hive-discovery.nix (see there for why `m.server` names
# the port). No `auth_request`: peers and clients fetch these unauthenticated.
"= /.well-known/matrix/client" = {
extraConfig = ''
default_type application/json;
${gatewayCfg.lib.securityHeaders}
add_header Access-Control-Allow-Origin *;
return 200 '{"m.homeserver":{"base_url":"https://${matrixCfg.gatewayHost}"}}';
'';
};
"= /.well-known/matrix/server" = {
extraConfig = ''
default_type application/json;
return 200 '{"m.server":"${matrixCfg.gatewayHost}:443"}';
'';
};
}
// {
# swarm-controller's whole HTTP surface, including the live
# `/api/openapi.json` spec — proxied untouched (no URI segment