From 5a4eb3e053933b310e9cfb50ca04b098955c7d05 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive>
Date: Fri, 29 May 2026 01:28:46 +0200
Subject: [PATCH] hive-matrix: stateVersion 26.05 + drop premature
 federationPort firewall (argus nits #552)

---
 nix/modules/hive-matrix.nix | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix
index 9457f851..25da87a9 100644
--- a/nix/modules/hive-matrix.nix
+++ b/nix/modules/hive-matrix.nix
@@ -102,25 +102,23 @@ in
       '';
     };
 
-    federationPort = lib.mkOption {
-      type = lib.types.port;
-      default = 8448;
-      description = ''
-        TCP port tuwunel serves the matrix server-server (federation)
-        API on. Default 8448 is the matrix-spec well-known port.
-        Open in the host firewall when `openFirewall = true`; needed
-        for multi-hive swarms to talk to each other.
-      '';
-    };
-
     openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = true;
       description = ''
-        Open `httpPort` + `federationPort` in the host firewall. Off
-        when the homeserver should only be reachable from inside the
-        host (e.g. while bringing the integration up before
-        announcing it to other hives).
+        Open `httpPort` in the host firewall. Off when the
+        homeserver should only be reachable from inside the host
+        (e.g. while bringing the integration up before announcing
+        it to other hives).
+
+        Note: federation (the matrix-spec well-known port 8448) is
+        intentionally not opened here. tuwunel serves the federation
+        API on the same `httpPort` as the client-server API by
+        default; reaching it on 8448 requires either binding tuwunel
+        to that port explicitly OR a reverse-proxy + `.well-known/
+        matrix/server` delegation, neither of which lives in this
+        module. Add that proxy config alongside whatever serves your
+        dashboard or forge on 443.
       '';
     };
 
@@ -184,7 +182,7 @@ in
       config =
         { ... }:
         {
-          system.stateVersion = "25.11";
+          system.stateVersion = "26.05";
           services.matrix-tuwunel = {
             enable = true;
             package = cfg.package;
@@ -215,7 +213,6 @@ in
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [
         cfg.httpPort
-        cfg.federationPort
       ];
     };
   };