refactor: drop dead http-only TLS branches (gateway is always https)

nix/modules/hive-forge.nix

@@ -12,25 +12,21 @@ let
   # ROOT_URL forgejo advertises in clone links + outbound URLs. When
   # served behind the gateway, `cfg.domain` doubles as both the
   # forgejo `DOMAIN` setting AND the gateway vhost server-name, so
-  # ROOT_URL just uses it directly (dropping the port suffix on the
+  # ROOT_URL just uses it directly. The gateway always terminates TLS
-  # canonical port for the scheme — 80 for http, 443 for https). The
+  # (self-signed is the implicit floor when neither `tls.certDir` nor
-  # gateway always terminates TLS now — self-signed is the implicit floor
+  # ACME is configured), so behind the gateway the forge is always
-  # when neither `tls.certDir` nor ACME is configured — so behind the
+  # advertised over `https` on `httpsPort` — the canonical 443 elides
-  # gateway the forge is always advertised over `https` on `httpsPort`.
+  # the port suffix. When direct (`behindGateway = false`), keep the
-  # When direct (gateway off or `behindGateway = false`), keep the
   # host:httpPort shape so direct browser access still produces correct
   # links. Operators can still override via `cfg.rootUrl` for bespoke
   # shapes.
-  gatewayTls = true;
   defaultRootUrl =
     if cfg.behindGateway then
       let
-        scheme = if gatewayTls then "https" else "http";
+        portSuffix =
-        port = if gatewayTls then gatewayCfg.httpsPort else gatewayCfg.port;
+          if gatewayCfg.httpsPort == 443 then "" else ":${toString gatewayCfg.httpsPort}";
-        canonicalPort = if gatewayTls then 443 else 80;
-        portSuffix = if port == canonicalPort then "" else ":${toString port}";
       in
-      "${scheme}://${cfg.domain}${portSuffix}/"
+      "https://${cfg.domain}${portSuffix}/"
     else
       "http://${cfg.domain}:${toString cfg.httpPort}/";
   effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;

nix/modules/hive-gateway/vhosts.nix

@@ -18,23 +18,20 @@
 let
   # The gateway always terminates TLS: self-signed is the implicit
   # floor when neither `tls.certDir` nor ACME is set, so there is no
-  # http-only mode. Kept as a named binding for the vhost listen/ssl
+  # http-only mode. Listen addresses every vhost shares — plain http
-  # wiring below.
+  # on `cfg.port` plus TLS on `cfg.httpsPort`. See `docs/gateway.md`
-  hasTls = true;
+  # ("TLS modes").
-  # Listen addresses every vhost shares. Plain http on `cfg.port`
-  # always; `cfg.httpsPort` with TLS sits beside it when TLS is
-  # active (any mode). See `docs/gateway.md` ("TLS modes").
   vhostListen = [
     {
       addr = "0.0.0.0";
       port = cfg.port;
     }
-  ]
+    {
-  ++ lib.optional hasTls {
+      addr = "0.0.0.0";
-    addr = "0.0.0.0";
+      port = cfg.httpsPort;
-    port = cfg.httpsPort;
+      ssl = true;
-    ssl = true;
+    }
-  };
+  ];
   # nixos `services.nginx.virtualHosts.<name>` ssl attrs merged
   # into each vhost. For ACME mode: `enableACME` + `addSSL` —
   # NixOS's ACME integration manages the cert lifecycle and sets
@@ -47,7 +44,7 @@ let
         enableACME = true;
       }
     else
-      lib.optionalAttrs hasTls {
+      {
         addSSL = true;
         sslCertificate = tlsCert;
         sslCertificateKey = tlsKey;
@@ -55,15 +52,12 @@ let
 
   # Public-facing scheme + port-suffix for URLs the gateway
   # mints into responses (well-known JSON, the deprecated
-  # `<hive>/matrix/*` 301 redirect, future absolute-URL needs).
+  # `<hive>/matrix/*` 301 redirect, future absolute-URL needs):
-  # When TLS is active (self-signed OR operator cert), prefer
+  # always `https://<host>` (matrix-spec compliance) — the canonical
-  # `https://<host>` (matrix-spec compliance) — 443 elides the
+  # 443 elides the port. See `docs/gateway.md` ("Self-signed TLS").
-  # port. Otherwise fall back to the plain-http listen with the
+  publicScheme = "https";
-  # bare port. See `docs/gateway.md` ("Self-signed TLS").
+  publicPort = cfg.httpsPort;
-  publicScheme = if hasTls then "https" else "http";
+  publicPortSuffix = if publicPort == 443 then "" else ":${toString publicPort}";
-  publicPort = if hasTls then cfg.httpsPort else cfg.port;
-  publicPortDefault = if hasTls then 443 else 80;
-  publicPortSuffix = if publicPort == publicPortDefault then "" else ":${toString publicPort}";
 
   # Security headers added at the server scope on every vhost.
   # nginx's add_header inheritance rule: a location that defines its