refactor(gateway): extract the _ vhost matrix location groups into named bindings
Step 2 of the hive-gateway.nix vhost cleanup (follows the sub-domain
vhost extraction). Lift the two deepest-nested location groups of the
default _ server — the /matrix/ 301 redirect and the
.well-known/matrix/{client,server} discovery JSON, each carrying its own
let block — out of the inline //-chain into matrixRedirectLocations /
wellKnownLocations bindings. The _ vhost locations now open with
matrixRedirectLocations // wellKnownLocations // ... instead of two ~60-line
nested literals. agent/dashboard/auth groups stay inline (a later step).
Pure readability refactor, eval-identical: the generated
services.nginx.virtualHosts toJSON is byte-identical before/after (8888
bytes, diff empty) on a host with matrix+forge+gui+auth+tls enabled.
This commit is contained in:
atlas
mara
parent
a03aafb004
commit
d7e4028a16
1 changed files with 68 additions and 66 deletions
|
|
@ -641,6 +641,72 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
# `_` (default) server location groups, lifted out of the inline
|
||||||
|
# `//`-chain so the two matrix groups (each with its own `let`)
|
||||||
|
# read on their own. Composed into the `_` vhost's `locations`
|
||||||
|
# below alongside the still-inline agent/dashboard/auth groups.
|
||||||
|
|
||||||
|
# `<hive>/matrix/*` → 301 → `matrix.<hive>/$1` (legacy deep-link
|
||||||
|
# shim during the fluffychat sub-domain move). See `docs/gateway.md`.
|
||||||
|
matrixRedirectLocations =
|
||||||
|
lib.optionalAttrs (matrixCfg.enable && matrixCfg.gui.enable && matrixCfg.gatewayHost != null)
|
||||||
|
(
|
||||||
|
let
|
||||||
|
target = "${publicScheme}://${matrixCfg.gatewayHost}${publicPortSuffix}";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
"/matrix/" = {
|
||||||
|
extraConfig = ''
|
||||||
|
rewrite ^/matrix/(.*)$ ${target}/$1 permanent;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
||||||
|
);
|
||||||
|
|
||||||
|
# `.well-known/matrix/{client,server}` discovery JSON. Points
|
||||||
|
# clients at `matrixCfg.gatewayHost` when set; falls back to direct
|
||||||
|
# `<hive>:<httpPort>`. CORS `*` per matrix spec. The `m.server`
|
||||||
|
# port-8448 carve-out is documented inline. See `docs/gateway.md`.
|
||||||
|
wellKnownLocations = lib.optionalAttrs (matrixCfg.enable && hyperhiveDomain != null) (
|
||||||
|
let
|
||||||
|
clientBaseUrl =
|
||||||
|
if matrixCfg.gatewayHost != null then
|
||||||
|
"${publicScheme}://${matrixCfg.gatewayHost}${publicPortSuffix}"
|
||||||
|
else
|
||||||
|
"${publicScheme}://${hyperhiveDomain}:${toString matrixCfg.httpPort}";
|
||||||
|
# `m.server` is NOT a URL: per the matrix server-server spec
|
||||||
|
# (Resolving Server Names) a delegated host with NO port resolves
|
||||||
|
# to the federation default 8448 (after the SRV check) — the
|
||||||
|
# https-implies-443 rule does NOT apply here. So the port must be
|
||||||
|
# explicit even when it's the HTTPS default; `publicPortSuffix`
|
||||||
|
# (which drops :443) is right for the client base_url above but
|
||||||
|
# wrong for federation delegation. Without this, peers federate to
|
||||||
|
# <gatewayHost>:8448 (closed) while the endpoint actually lives on
|
||||||
|
# the gateway's 443 vhost. See docs/gateway.md discovery flow.
|
||||||
|
serverHostPort =
|
||||||
|
if matrixCfg.gatewayHost != null then
|
||||||
|
"${matrixCfg.gatewayHost}:${toString publicPort}"
|
||||||
|
else
|
||||||
|
"${hyperhiveDomain}:${toString matrixCfg.httpPort}";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
"= /.well-known/matrix/client" = {
|
||||||
|
extraConfig = ''
|
||||||
|
default_type application/json;
|
||||||
|
${securityHeaders}
|
||||||
|
add_header Access-Control-Allow-Origin *;
|
||||||
|
return 200 '{"m.homeserver":{"base_url":"${clientBaseUrl}"}}';
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"= /.well-known/matrix/server" = {
|
||||||
|
extraConfig = ''
|
||||||
|
default_type application/json;
|
||||||
|
return 200 '{"m.server":"${serverHostPort}"}';
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
||||||
|
);
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
system.stateVersion = "26.05";
|
system.stateVersion = "26.05";
|
||||||
|
|
@ -762,72 +828,8 @@ in
|
||||||
"_" = vhostTls // {
|
"_" = vhostTls // {
|
||||||
listen = vhostListen;
|
listen = vhostListen;
|
||||||
locations =
|
locations =
|
||||||
# `<hive>/matrix/*` → 301 → `matrix.<hive>/$1`
|
matrixRedirectLocations
|
||||||
# (fluffychat moved to sub-domain root; this
|
// wellKnownLocations
|
||||||
# keeps bookmarks + deep-links working during the
|
|
||||||
# transition). See `docs/gateway.md` for the vhost
|
|
||||||
# map.
|
|
||||||
lib.optionalAttrs (matrixCfg.enable && matrixCfg.gui.enable && matrixCfg.gatewayHost != null) (
|
|
||||||
let
|
|
||||||
target = "${publicScheme}://${matrixCfg.gatewayHost}${publicPortSuffix}";
|
|
||||||
in
|
|
||||||
{
|
|
||||||
"/matrix/" = {
|
|
||||||
extraConfig = ''
|
|
||||||
rewrite ^/matrix/(.*)$ ${target}/$1 permanent;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
||||||
)
|
|
||||||
//
|
|
||||||
# `.well-known/matrix/{client,server}` discovery JSON.
|
|
||||||
# Points clients at `matrixCfg.gatewayHost` (sub-domain
|
|
||||||
# vhost) when set; falls back to direct `<hive>:<httpPort>`
|
|
||||||
# when no gateway target. CORS `*` per matrix spec.
|
|
||||||
# See `docs/gateway.md` "Discovery flow" for the full
|
|
||||||
# client-bootstrap sequence.
|
|
||||||
lib.optionalAttrs (matrixCfg.enable && hyperhiveDomain != null) (
|
|
||||||
let
|
|
||||||
clientBaseUrl =
|
|
||||||
if matrixCfg.gatewayHost != null then
|
|
||||||
"${publicScheme}://${matrixCfg.gatewayHost}${publicPortSuffix}"
|
|
||||||
else
|
|
||||||
"${publicScheme}://${hyperhiveDomain}:${toString matrixCfg.httpPort}";
|
|
||||||
# `m.server` is NOT a URL: per the matrix
|
|
||||||
# server-server spec (Resolving Server Names) a
|
|
||||||
# delegated host with NO port resolves to the
|
|
||||||
# federation default 8448 (after the SRV check) —
|
|
||||||
# the https-implies-443 rule does NOT apply here.
|
|
||||||
# So the port must be explicit even when it's the
|
|
||||||
# HTTPS default; `publicPortSuffix` (which drops
|
|
||||||
# :443) is right for the client base_url above but
|
|
||||||
# wrong for federation delegation. Without this,
|
|
||||||
# peers federate to <gatewayHost>:8448 (closed) while
|
|
||||||
# the endpoint actually lives on the gateway's 443
|
|
||||||
# vhost. See docs/gateway.md discovery flow.
|
|
||||||
serverHostPort =
|
|
||||||
if matrixCfg.gatewayHost != null then
|
|
||||||
"${matrixCfg.gatewayHost}:${toString publicPort}"
|
|
||||||
else
|
|
||||||
"${hyperhiveDomain}:${toString matrixCfg.httpPort}";
|
|
||||||
in
|
|
||||||
{
|
|
||||||
"= /.well-known/matrix/client" = {
|
|
||||||
extraConfig = ''
|
|
||||||
default_type application/json;
|
|
||||||
${securityHeaders}
|
|
||||||
add_header Access-Control-Allow-Origin *;
|
|
||||||
return 200 '{"m.homeserver":{"base_url":"${clientBaseUrl}"}}';
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
"= /.well-known/matrix/server" = {
|
|
||||||
extraConfig = ''
|
|
||||||
default_type application/json;
|
|
||||||
return 200 '{"m.server":"${serverHostPort}"}';
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
||||||
)
|
|
||||||
//
|
//
|
||||||
# `/agent/` catch-all: hits when an operator
|
# `/agent/` catch-all: hits when an operator
|
||||||
# requests `/agent/<unknown>/...`. Without this the
|
# requests `/agent/<unknown>/...`. Without this the
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue