vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

serve matrix discovery at the swarm apex, keep the pinned hive case

Browse source
This commit is contained in:
atlas 2026-10-25 11:13:22 +01:00 • committed by mara
commit 2e7d49bb88
10 changed files with 187 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

64
nix/module-eval/matrix-core.nix
View file

@ -19,6 +19,7 @@ let
;
})
hive
hiveWithController
runGroup
;
@ -36,6 +37,16 @@ let
# A hive host that does not run the homeserver: its hive-c0re reaches the
# homeserver across the network.
matrixElsewhere = shared.bareWithController;
# A homeserver whose server name was pinned to the hive domain, on the
# controller's host, with no homeserver of its own: the discovery answer
# sits on the hive domain and needs neither the homeserver nor the apex.
matrixPinned = hiveWithController {
swarm.matrix.serverName = "h1.t.local";
deploy.swarm-controller.enable = true;
deploy.swarm-ui.package = pkgs.emptyDirectory;
};
cases = [
{
# Two limits governed a matrix upload and nothing kept them in agreement,
@ -129,32 +140,55 @@ let
== "https://chat.t.local";
}
{
# The discovery locations reach the hive domain's vhost from a glue
# module, merged into the vhost hive-c0re declares. The matrix-elsewhere
# arm reads the same vhost, which still exists there with its redirect,
# so its absence of discovery cannot pass on a misspelled name. The
# fixture's gateway is on a non-default TLS port, which none of the URLs
# carry.
name = "matrix discovery sits on the hive domain's vhost only where the homeserver runs";
# The legacy redirect reaches the hive domain's vhost from a glue
# module, merged into the vhost hive-c0re declares, and only where the
# homeserver runs. The matrix-elsewhere arm reads the same vhost, which
# still exists there with its redirect, so its absence of the redirect
# cannot pass on a misspelled name. Under the default server name (the
# swarm domain) the hive domain answers no discovery on either host.
# The fixture's gateway is on a non-default TLS port, which none of the
# URLs carry.
name = "an unpinned hive domain's vhost carries the matrix redirect where the homeserver runs, and no discovery";
ok =
let
here = matrixNoBaoIdentity.services.nginx.virtualHosts."h1.t.local".locations;
elsewhere = matrixElsewhere.services.nginx.virtualHosts."h1.t.local".locations;
in
matrixNoBaoIdentity.services.hyperhive.gateway.httpsPort == 8443
&& lib.hasInfix ''{"m.homeserver":{"base_url":"https://chat.t.local"}}'' (
here."= /.well-known/matrix/client".extraConfig or ""
)
&& lib.hasInfix ''{"m.server":"chat.t.local:443"}'' (
here."= /.well-known/matrix/server".extraConfig or ""
)
&& lib.hasInfix "rewrite ^/matrix/(.*)$ https://chat.t.local/$1 permanent;" (
here."/matrix/".extraConfig or ""
)
&& lib.hasInfix "return 301 https://h1.hives.t.local$request_uri;" here."/".extraConfig
&& !(here ? "= /.well-known/matrix/client")
&& !(here ? "= /.well-known/matrix/server")
&& elsewhere ? "/"
&& !(elsewhere ? "= /.well-known/matrix/client")
&& !(elsewhere ? "/matrix/");
&& !(elsewhere ? "/matrix/")
&& !(elsewhere ? "= /.well-known/matrix/client");
}
{
# A homeserver pinned to the hive domain keeps its discovery on that
# vhost, even though the host runs no homeserver, and not on the apex, which is a
# different server name. The apex arm is read on a vhost that
# exists (its `/` and `/api/` are there), so it cannot pass on a
# misspelled name.
name = "a server name pinned to the hive domain is answered on the hive domain's vhost and not on the apex";
ok =
let
onHive = matrixPinned.services.nginx.virtualHosts."h1.t.local".locations;
apex = matrixPinned.services.nginx.virtualHosts."t.local".locations;
in
!matrixPinned.services.hyperhive.deploy.matrix.enable
&& lib.hasInfix ''{"m.homeserver":{"base_url":"https://chat.t.local"}}'' (
onHive."= /.well-known/matrix/client".extraConfig or ""
)
&& lib.hasInfix ''{"m.server":"chat.t.local:443"}'' (
onHive."= /.well-known/matrix/server".extraConfig or ""
)
&& onHive ? "/"
&& apex ? "/"
&& apex ? "/api/"
&& !(apex ? "= /.well-known/matrix/client")
&& !(apex ? "= /.well-known/matrix/server");
}
];
in