From 43bbd64f8271862ef66c0484df499dbd2e5c16d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Mon, 13 Jul 2026 21:54:30 +0200
Subject: [PATCH] refactor: drop dead http-only TLS branches (gateway is always
 https)

---
 nix/modules/hive-forge.nix          | 20 ++++++---------
 nix/modules/hive-gateway/vhosts.nix | 38 ++++++++++++-----------------
 2 files changed, 24 insertions(+), 34 deletions(-)

diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix
index 8178e196..90378b25 100644
--- a/nix/modules/hive-forge.nix
+++ b/nix/modules/hive-forge.nix
@@ -12,25 +12,21 @@ let
   # ROOT_URL forgejo advertises in clone links + outbound URLs. When
   # served behind the gateway, `cfg.domain` doubles as both the
   # forgejo `DOMAIN` setting AND the gateway vhost server-name, so
-  # ROOT_URL just uses it directly (dropping the port suffix on the
-  # canonical port for the scheme — 80 for http, 443 for https). The
-  # gateway always terminates TLS now — self-signed is the implicit floor
-  # when neither `tls.certDir` nor ACME is configured — so behind the
-  # gateway the forge is always advertised over `https` on `httpsPort`.
-  # When direct (gateway off or `behindGateway = false`), keep the
+  # ROOT_URL just uses it directly. The gateway always terminates TLS
+  # (self-signed is the implicit floor when neither `tls.certDir` nor
+  # ACME is configured), so behind the gateway the forge is always
+  # advertised over `https` on `httpsPort` — the canonical 443 elides
+  # the port suffix. When direct (`behindGateway = false`), keep the
   # host:httpPort shape so direct browser access still produces correct
   # links. Operators can still override via `cfg.rootUrl` for bespoke
   # shapes.
-  gatewayTls = true;
   defaultRootUrl =
     if cfg.behindGateway then
       let
-        scheme = if gatewayTls then "https" else "http";
-        port = if gatewayTls then gatewayCfg.httpsPort else gatewayCfg.port;
-        canonicalPort = if gatewayTls then 443 else 80;
-        portSuffix = if port == canonicalPort then "" else ":${toString port}";
+        portSuffix =
+          if gatewayCfg.httpsPort == 443 then "" else ":${toString gatewayCfg.httpsPort}";
       in
-      "${scheme}://${cfg.domain}${portSuffix}/"
+      "https://${cfg.domain}${portSuffix}/"
     else
       "http://${cfg.domain}:${toString cfg.httpPort}/";
   effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;
diff --git a/nix/modules/hive-gateway/vhosts.nix b/nix/modules/hive-gateway/vhosts.nix
index 4647db04..ee5531aa 100644
--- a/nix/modules/hive-gateway/vhosts.nix
+++ b/nix/modules/hive-gateway/vhosts.nix
@@ -18,23 +18,20 @@
 let
   # The gateway always terminates TLS: self-signed is the implicit
   # floor when neither `tls.certDir` nor ACME is set, so there is no
-  # http-only mode. Kept as a named binding for the vhost listen/ssl
-  # wiring below.
-  hasTls = true;
-  # Listen addresses every vhost shares. Plain http on `cfg.port`
-  # always; `cfg.httpsPort` with TLS sits beside it when TLS is
-  # active (any mode). See `docs/gateway.md` ("TLS modes").
+  # http-only mode. Listen addresses every vhost shares — plain http
+  # on `cfg.port` plus TLS on `cfg.httpsPort`. See `docs/gateway.md`
+  # ("TLS modes").
   vhostListen = [
     {
       addr = "0.0.0.0";
       port = cfg.port;
     }
-  ]
-  ++ lib.optional hasTls {
-    addr = "0.0.0.0";
-    port = cfg.httpsPort;
-    ssl = true;
-  };
+    {
+      addr = "0.0.0.0";
+      port = cfg.httpsPort;
+      ssl = true;
+    }
+  ];
   # nixos `services.nginx.virtualHosts.<name>` ssl attrs merged
   # into each vhost. For ACME mode: `enableACME` + `addSSL` —
   # NixOS's ACME integration manages the cert lifecycle and sets
@@ -47,7 +44,7 @@ let
         enableACME = true;
       }
     else
-      lib.optionalAttrs hasTls {
+      {
         addSSL = true;
         sslCertificate = tlsCert;
         sslCertificateKey = tlsKey;
@@ -55,15 +52,12 @@ let
 
   # Public-facing scheme + port-suffix for URLs the gateway
   # mints into responses (well-known JSON, the deprecated
-  # `<hive>/matrix/*` 301 redirect, future absolute-URL needs).
-  # When TLS is active (self-signed OR operator cert), prefer
-  # `https://<host>` (matrix-spec compliance) — 443 elides the
-  # port. Otherwise fall back to the plain-http listen with the
-  # bare port. See `docs/gateway.md` ("Self-signed TLS").
-  publicScheme = if hasTls then "https" else "http";
-  publicPort = if hasTls then cfg.httpsPort else cfg.port;
-  publicPortDefault = if hasTls then 443 else 80;
-  publicPortSuffix = if publicPort == publicPortDefault then "" else ":${toString publicPort}";
+  # `<hive>/matrix/*` 301 redirect, future absolute-URL needs):
+  # always `https://<host>` (matrix-spec compliance) — the canonical
+  # 443 elides the port. See `docs/gateway.md` ("Self-signed TLS").
+  publicScheme = "https";
+  publicPort = cfg.httpsPort;
+  publicPortSuffix = if publicPort == 443 then "" else ":${toString publicPort}";
 
   # Security headers added at the server scope on every vhost.
   # nginx's add_header inheritance rule: a location that defines its