vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the hive's vhosts and matrix discovery out of the gateway

Browse source 
The dashboard vhost, the hive domain vhost and the dashboard's local
name move to hive-c0re/vhosts.nix; the matrix .well-known discovery and
the legacy /matrix/ redirect move to glue-matrix-hive-discovery.nix,
which adds them to the hive domain vhost. Both declare through
gateway.vhosts. hive-gateway/vhosts.nix keeps the catch-all only, and
the gateway no longer reads deploy.matrix or c0re.servedFrontend, nor
deploy.hive-controller.enable for its vhosts.

Part of #3742.
This commit is contained in:
atlas 2026-10-17 13:44:20 +02:00 • committed by mara
commit b4c5954491
17 changed files with 391 additions and 378 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/hive-gateway/vhost-lib.nix
View file

@ -2,9 +2,8 @@
# attrs, and the security headers every vhost in front of this gateway
# needs.
#
# Split out of ./vhosts.nix so it has one home and several consumers.
# ./vhosts.nix and ./declared-vhosts.nix (which renders the vhosts service
# modules declare under `gateway.vhosts`) read it through
# One home, several consumers: ./declared-vhosts.nix (which renders the
# vhosts service modules declare under `gateway.vhosts`) reads it through
# `services.hyperhive.gateway.lib` (see ./options.nix) rather than calling
# this file directly — one source, not a copy that agrees by inspection. A
# service module reads `verifiedProxyTo`, `errorPages` and `securityHeaders`
@ -111,9 +110,9 @@ in
# own add_header does NOT inherit the server-level ones. Any
# location with its own add_header (e.g. CORS on /.well-known or
# /_matrix/) must repeat the security headers explicitly — see those
# locations in ./vhosts.nix. HTML-serving and proxy locations that
# carry no add_header of their own pick these up from the server
# scope automatically.
# locations in ../glue-matrix-hive-discovery.nix and ../hive-matrix.nix.
# HTML-serving and proxy locations that carry no add_header of their own
# pick these up from the server scope automatically.
securityHeaders = ''
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;