vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

serve matrix discovery at the swarm apex, keep the pinned hive case

Browse source
This commit is contained in:
atlas 2026-10-25 11:13:22 +01:00 • committed by mara
commit 2e7d49bb88
10 changed files with 187 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/module-eval/core-toggle.nix
View file

@ -662,9 +662,15 @@ let
];
}
{
name = "a hive with matrix off serves no matrix discovery endpoint";
# The hive domain answers discovery only for a server name pinned to it,
# which `bare` does not do. Its vhost exists (the redirect is there), so
# the absence arms cannot pass on a misspelled name.
name = "an unpinned hive serves no matrix discovery on its domain";
ok =
!(builtins.hasAttr "= /.well-known/matrix/client" bare.services.nginx.virtualHosts."_".locations);
let
l = bare.services.nginx.virtualHosts."h1.t.local".locations;
in
l ? "/" && !(l ? "= /.well-known/matrix/client") && !(l ? "= /.well-known/matrix/server");
}
{
# main got eval-borked twice by this exact class of bug (once on the

64
nix/module-eval/matrix-core.nix
View file

@ -19,6 +19,7 @@ let
;
})
hive
hiveWithController
runGroup
;
@ -36,6 +37,16 @@ let
# A hive host that does not run the homeserver: its hive-c0re reaches the
# homeserver across the network.
matrixElsewhere = shared.bareWithController;
# A homeserver whose server name was pinned to the hive domain, on the
# controller's host, with no homeserver of its own: the discovery answer
# sits on the hive domain and needs neither the homeserver nor the apex.
matrixPinned = hiveWithController {
swarm.matrix.serverName = "h1.t.local";
deploy.swarm-controller.enable = true;
deploy.swarm-ui.package = pkgs.emptyDirectory;
};
cases = [
{
# Two limits governed a matrix upload and nothing kept them in agreement,
@ -129,32 +140,55 @@ let
== "https://chat.t.local";
}
{
# The discovery locations reach the hive domain's vhost from a glue
# module, merged into the vhost hive-c0re declares. The matrix-elsewhere
# arm reads the same vhost, which still exists there with its redirect,
# so its absence of discovery cannot pass on a misspelled name. The
# fixture's gateway is on a non-default TLS port, which none of the URLs
# carry.
name = "matrix discovery sits on the hive domain's vhost only where the homeserver runs";
# The legacy redirect reaches the hive domain's vhost from a glue
# module, merged into the vhost hive-c0re declares, and only where the
# homeserver runs. The matrix-elsewhere arm reads the same vhost, which
# still exists there with its redirect, so its absence of the redirect
# cannot pass on a misspelled name. Under the default server name (the
# swarm domain) the hive domain answers no discovery on either host.
# The fixture's gateway is on a non-default TLS port, which none of the
# URLs carry.
name = "an unpinned hive domain's vhost carries the matrix redirect where the homeserver runs, and no discovery";
ok =
let
here = matrixNoBaoIdentity.services.nginx.virtualHosts."h1.t.local".locations;
elsewhere = matrixElsewhere.services.nginx.virtualHosts."h1.t.local".locations;
in
matrixNoBaoIdentity.services.hyperhive.gateway.httpsPort == 8443
&& lib.hasInfix ''{"m.homeserver":{"base_url":"https://chat.t.local"}}'' (
here."= /.well-known/matrix/client".extraConfig or ""
)
&& lib.hasInfix ''{"m.server":"chat.t.local:443"}'' (
here."= /.well-known/matrix/server".extraConfig or ""
)
&& lib.hasInfix "rewrite ^/matrix/(.*)$ https://chat.t.local/$1 permanent;" (
here."/matrix/".extraConfig or ""
)
&& lib.hasInfix "return 301 https://h1.hives.t.local$request_uri;" here."/".extraConfig
&& !(here ? "= /.well-known/matrix/client")
&& !(here ? "= /.well-known/matrix/server")
&& elsewhere ? "/"
&& !(elsewhere ? "= /.well-known/matrix/client")
&& !(elsewhere ? "/matrix/");
&& !(elsewhere ? "/matrix/")
&& !(elsewhere ? "= /.well-known/matrix/client");
}
{
# A homeserver pinned to the hive domain keeps its discovery on that
# vhost, even though the host runs no homeserver, and not on the apex, which is a
# different server name. The apex arm is read on a vhost that
# exists (its `/` and `/api/` are there), so it cannot pass on a
# misspelled name.
name = "a server name pinned to the hive domain is answered on the hive domain's vhost and not on the apex";
ok =
let
onHive = matrixPinned.services.nginx.virtualHosts."h1.t.local".locations;
apex = matrixPinned.services.nginx.virtualHosts."t.local".locations;
in
!matrixPinned.services.hyperhive.deploy.matrix.enable
&& lib.hasInfix ''{"m.homeserver":{"base_url":"https://chat.t.local"}}'' (
onHive."= /.well-known/matrix/client".extraConfig or ""
)
&& lib.hasInfix ''{"m.server":"chat.t.local:443"}'' (
onHive."= /.well-known/matrix/server".extraConfig or ""
)
&& onHive ? "/"
&& apex ? "/"
&& apex ? "/api/"
&& !(apex ? "= /.well-known/matrix/client")
&& !(apex ? "= /.well-known/matrix/server");
}
];
in

23
nix/module-eval/swarm-services-switch.nix
View file

@ -366,6 +366,27 @@ let
name = "a named exposeHostPorts opens its bridge port on the host's own say-so";
ok = builtins.elem 5432 (bridgePortsOrNone exposedPortsNoHive);
}
{
# The default server name is the swarm domain, so the apex answers
# discovery from `gatewayHost` alone: this fixture runs no homeserver and
# no hive. The URLs carry no port, and `m.server` names 443 because the
# spec reads a bare host as 8448. The `/` arm is the presence control on
# the vhost; the pinned counterpart is in ./matrix-core.nix.
name = "the swarm apex serves both matrix discovery routes under the default server name";
ok =
let
l = swarmUiHere.services.nginx.virtualHosts."t.local".locations;
in
l ? "/"
&& lib.hasInfix ''{"m.homeserver":{"base_url":"https://chat.t.local"}}'' (
l."= /.well-known/matrix/client".extraConfig or ""
)
&& lib.hasInfix ''{"m.server":"chat.t.local:443"}'' (
l."= /.well-known/matrix/server".extraConfig or ""
)
&& !(lib.hasInfix "auth_request" l."= /.well-known/matrix/client".extraConfig)
&& !(lib.hasInfix "auth_request" l."= /.well-known/matrix/server".extraConfig);
}
{
name = "the old swarm UI package spelling sets the controller's UI package, which the vhost serves";
ok =
@ -547,7 +568,7 @@ let
vh = swarmServicesHere.services.nginx.virtualHosts;
l = vh."h1.hives.t.local".locations;
in
l ? "/api/" && l ? "/health/" && vh."h1.t.local".locations ? "= /.well-known/matrix/client"
l ? "/api/" && l ? "/health/" && vh."h1.t.local".locations ? "/"
)
&& !(noHiveLeafAnywhere swarmServicesHere);
}