From b50f1823960bfac8deb31f369c681518deb6c68e Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive>
Date: Sun, 31 May 2026 16:53:59 +0200
Subject: [PATCH] =?UTF-8?q?hive-gateway:=20note=20common-case=20dnsmasq=20?=
 =?UTF-8?q?address=20redundancy=20(argus=20=F0=9F=9F=A1=20on=20#845)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

forge/matrix subdomain address rules are redundant when those are
sub-domains of hyperhive.domain (dnsmasq's /<domain>/ matches
sub-domains). Keep explicit for the cross-domain case (e.g.
forge.domain = "git.example.com") + add a comment explaining
the trade-off.
---
 nix/modules/hive-gateway.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index 1614f5c5..df43b867 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -587,6 +587,17 @@ in
               # (where nginx is reachable from container netns once
               # #14 lands; today it's the host loopback alias and
               # works in either shape).
+              #
+              # The forge / matrix entries are redundant in the
+              # common case where `forge.domain` /
+              # `matrix.gatewayHost` are sub-domains of
+              # `hyperhive.domain` — dnsmasq's `/<domain>/` rule
+              # already matches sub-domains (argus 🟡 on #845).
+              # Kept explicit because operators can override either
+              # to a cross-domain hostname (e.g.
+              # `forge.domain = "git.example.com"`); listing them
+              # explicitly keeps that case routed without needing
+              # an extra config block.
               address = [
                 "/${hyperhiveDomain}/${networkCfg.bridgeIp}"
               ]