From 48b7c2426567ccdbf90ae4181cdeafa552b234fc Mon Sep 17 00:00:00 2001
From: atlas <atlas@pr1ma.darkest.space>
Date: Sat, 6 Jun 2026 00:15:32 +0200
Subject: [PATCH] fix(nix): emit explicit port in .well-known/matrix/server
 delegation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The matrix server-server spec resolves a portless m.server delegated
host to the federation default port 8448 (not 443 — the URL convention
that https implies 443 does not apply to the m.server field). The
gateway reused publicPortSuffix, which intentionally drops :443 for the
client base_url, so .well-known/matrix/server advertised the bare
gateway host. Peers then federated to <gatewayHost>:8448, which nothing
listens on, while the federation endpoint actually lives on the gateway
443 vhost (/_matrix/ proxied to tuwunel). Always emit the explicit port
in the federation delegation so peers reach the live 443 endpoint.
---
 nix/modules/hive-gateway.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 16af376a..2a0e1531 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -718,9 +718,21 @@ in
                             "${publicScheme}://${matrixCfg.gatewayHost}${publicPortSuffix}"
                           else
                             "${publicScheme}://${hyperhiveDomain}:${toString matrixCfg.httpPort}";
+                        # `m.server` is NOT a URL: per the matrix
+                        # server-server spec (Resolving Server Names) a
+                        # delegated host with NO port resolves to the
+                        # federation default 8448 (after the SRV check) —
+                        # the https-implies-443 rule does NOT apply here.
+                        # So the port must be explicit even when it's the
+                        # HTTPS default; `publicPortSuffix` (which drops
+                        # :443) is right for the client base_url above but
+                        # wrong for federation delegation. Without this,
+                        # peers federate to <gatewayHost>:8448 (closed) while
+                        # the endpoint actually lives on the gateway's 443
+                        # vhost. See docs/gateway.md discovery flow.
                         serverHostPort =
                           if matrixCfg.gatewayHost != null then
-                            "${matrixCfg.gatewayHost}${publicPortSuffix}"
+                            "${matrixCfg.gatewayHost}:${toString publicPort}"
                           else
                             "${hyperhiveDomain}:${toString matrixCfg.httpPort}";
                       in