From d03549c40f4dd40c4ba2a8b26ca9ce07afadf287 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 12 Aug 2026 20:11:33 +0200
Subject: [PATCH] fix(3213): the swarm UI vhost forces https
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

authelia refuses to authorize a non-https target: the auth subrequest for
`X-Original-URL: http://…` answers 400, and nginx's auth_request only
understands 2xx/401/403, so a plain-http visit died as "auth request
unexpected status: 400" — a bare 400 in the browser with no hint that a
login exists.

The shared vhostListen binds :80 as well as :443 and every vhost used
addSSL, so the door was open on a port the lock cannot work on. That is
harmless for forge and matrix, where http is merely insecure rather than
broken, so the asymmetry stays local to the one vhost whose correctness
depends on the scheme.

removeAttrs because nixos asserts on a vhost declaring both addSSL and
forceSSL.

Measured against the pinned binary rather than reasoned about:
  X-Original-URL: http://constellation…/   -> 400 Bad Request
  X-Original-URL: https://constellation…/  -> 401 + Location: auth…?rd=…
---
 nix/host-modules/hive-gateway/vhosts.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/nix/host-modules/hive-gateway/vhosts.nix b/nix/host-modules/hive-gateway/vhosts.nix
index cf4ecb4f..f872abb7 100644
--- a/nix/host-modules/hive-gateway/vhosts.nix
+++ b/nix/host-modules/hive-gateway/vhosts.nix
@@ -186,8 +186,19 @@ let
   # that wrongly denies takes the whole UI away. That is the reason the
   # redirect target and the header set below are copied from a measured
   # source rather than from an example.
+  # ⚠️ `forceSSL`, not `addSSL` like every other vhost — not a hardening
+  # preference, the only way this page works at all. authelia answers the
+  # auth subrequest for an `http://` target with **400**, and nginx's
+  # `auth_request` only understands 2xx/401/403, so a plain-http visit
+  # dies as "auth request unexpected status: 400" with no hint a login
+  # exists. `vhostListen` binds :80, so without this the door is open on
+  # a port the lock cannot work on. Serving forge or matrix over http is
+  # merely insecure rather than broken, so they keep `addSSL` and the
+  # asymmetry stays local to the vhost whose correctness depends on the
+  # scheme. `removeAttrs` because nixos asserts on a vhost declaring both.
   swarmUiVhost = lib.optionalAttrs uiCfg.enable {
-    "${uiCfg.domain}" = (vhostTlsFor uiCfg.domain) // {
+    "${uiCfg.domain}" = (builtins.removeAttrs (vhostTlsFor uiCfg.domain) [ "addSSL" ]) // {
+      forceSSL = true;
       listen = vhostListen;
       extraConfig = securityHeaders;
       locations = {