vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: drop dead http-only TLS branches (gateway is always https)

Browse source
This commit is contained in:
müde 2026-07-13 21:54:30 +02:00
commit 43bbd64f82
2 changed files with 24 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/modules/hive-forge.nix
View file

@ -12,25 +12,21 @@ let
# ROOT_URL forgejo advertises in clone links + outbound URLs. When
# served behind the gateway, `cfg.domain` doubles as both the
# forgejo `DOMAIN` setting AND the gateway vhost server-name, so
# ROOT_URL just uses it directly (dropping the port suffix on the
# canonical port for the scheme — 80 for http, 443 for https). The
# gateway always terminates TLS now — self-signed is the implicit floor
# when neither `tls.certDir` nor ACME is configured — so behind the
# gateway the forge is always advertised over `https` on `httpsPort`.
# When direct (gateway off or `behindGateway = false`), keep the
# ROOT_URL just uses it directly. The gateway always terminates TLS
# (self-signed is the implicit floor when neither `tls.certDir` nor
# ACME is configured), so behind the gateway the forge is always
# advertised over `https` on `httpsPort` — the canonical 443 elides
# the port suffix. When direct (`behindGateway = false`), keep the
# host:httpPort shape so direct browser access still produces correct
# links. Operators can still override via `cfg.rootUrl` for bespoke
# shapes.
gatewayTls = true;
defaultRootUrl =
if cfg.behindGateway then
let
scheme = if gatewayTls then "https" else "http";
port = if gatewayTls then gatewayCfg.httpsPort else gatewayCfg.port;
canonicalPort = if gatewayTls then 443 else 80;
portSuffix = if port == canonicalPort then "" else ":${toString port}";
portSuffix =
if gatewayCfg.httpsPort == 443 then "" else ":${toString gatewayCfg.httpsPort}";
in
"${scheme}://${cfg.domain}${portSuffix}/"
"https://${cfg.domain}${portSuffix}/"
else
"http://${cfg.domain}:${toString cfg.httpPort}/";
effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;