vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: drop dead http-only TLS branches (gateway is always https)

Browse source
This commit is contained in:
müde 2026-07-13 21:54:30 +02:00
commit 43bbd64f82
2 changed files with 24 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/modules/hive-forge.nix
View file

@ -12,25 +12,21 @@ let
# ROOT_URL forgejo advertises in clone links + outbound URLs. When
# served behind the gateway, `cfg.domain` doubles as both the
# forgejo `DOMAIN` setting AND the gateway vhost server-name, so
# ROOT_URL just uses it directly (dropping the port suffix on the
# canonical port for the scheme — 80 for http, 443 for https). The
# gateway always terminates TLS now — self-signed is the implicit floor
# when neither `tls.certDir` nor ACME is configured — so behind the
# gateway the forge is always advertised over `https` on `httpsPort`.
# When direct (gateway off or `behindGateway = false`), keep the
# ROOT_URL just uses it directly. The gateway always terminates TLS
# (self-signed is the implicit floor when neither `tls.certDir` nor
# ACME is configured), so behind the gateway the forge is always
# advertised over `https` on `httpsPort` — the canonical 443 elides
# the port suffix. When direct (`behindGateway = false`), keep the
# host:httpPort shape so direct browser access still produces correct
# links. Operators can still override via `cfg.rootUrl` for bespoke
# shapes.
gatewayTls = true;
defaultRootUrl =
if cfg.behindGateway then
let
scheme = if gatewayTls then "https" else "http";
port = if gatewayTls then gatewayCfg.httpsPort else gatewayCfg.port;
canonicalPort = if gatewayTls then 443 else 80;
portSuffix = if port == canonicalPort then "" else ":${toString port}";
portSuffix =
if gatewayCfg.httpsPort == 443 then "" else ":${toString gatewayCfg.httpsPort}";
in
"${scheme}://${cfg.domain}${portSuffix}/"
"https://${cfg.domain}${portSuffix}/"
else
"http://${cfg.domain}:${toString cfg.httpPort}/";
effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;

38
nix/modules/hive-gateway/vhosts.nix
View file

@ -18,23 +18,20 @@
let
# The gateway always terminates TLS: self-signed is the implicit
# floor when neither `tls.certDir` nor ACME is set, so there is no
# http-only mode. Kept as a named binding for the vhost listen/ssl
# wiring below.
hasTls = true;
# Listen addresses every vhost shares. Plain http on `cfg.port`
# always; `cfg.httpsPort` with TLS sits beside it when TLS is
# active (any mode). See `docs/gateway.md` ("TLS modes").
# http-only mode. Listen addresses every vhost shares — plain http
# on `cfg.port` plus TLS on `cfg.httpsPort`. See `docs/gateway.md`
# ("TLS modes").
vhostListen = [
{
addr = "0.0.0.0";
port = cfg.port;
}
]
++ lib.optional hasTls {
addr = "0.0.0.0";
port = cfg.httpsPort;
ssl = true;
};
{
addr = "0.0.0.0";
port = cfg.httpsPort;
ssl = true;
}
];
# nixos `services.nginx.virtualHosts.<name>` ssl attrs merged
# into each vhost. For ACME mode: `enableACME` + `addSSL` —
# NixOS's ACME integration manages the cert lifecycle and sets
@ -47,7 +44,7 @@ let
enableACME = true;
}
else
lib.optionalAttrs hasTls {
{
addSSL = true;
sslCertificate = tlsCert;
sslCertificateKey = tlsKey;
@ -55,15 +52,12 @@ let
# Public-facing scheme + port-suffix for URLs the gateway
# mints into responses (well-known JSON, the deprecated
# `<hive>/matrix/*` 301 redirect, future absolute-URL needs).
# When TLS is active (self-signed OR operator cert), prefer
# `https://<host>` (matrix-spec compliance) — 443 elides the
# port. Otherwise fall back to the plain-http listen with the
# bare port. See `docs/gateway.md` ("Self-signed TLS").
publicScheme = if hasTls then "https" else "http";
publicPort = if hasTls then cfg.httpsPort else cfg.port;
publicPortDefault = if hasTls then 443 else 80;
publicPortSuffix = if publicPort == publicPortDefault then "" else ":${toString publicPort}";
# `<hive>/matrix/*` 301 redirect, future absolute-URL needs):
# always `https://<host>` (matrix-spec compliance) — the canonical
# 443 elides the port. See `docs/gateway.md` ("Self-signed TLS").
publicScheme = "https";
publicPort = cfg.httpsPort;
publicPortSuffix = if publicPort == 443 then "" else ":${toString publicPort}";
# Security headers added at the server scope on every vhost.
# nginx's add_header inheritance rule: a location that defines its