From e8c2ef087cb5316b0b3da5bfd5203241ef107b5d Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 17 Jun 2026 16:56:26 +0200
Subject: [PATCH] nix(c0re): set HIVE_FORGE_URL to the gateway URL directly,
 drop dead if/else
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per mara's review of #1718: this env block only exists when hyperhive is
enabled (it lives inside `config = mkIf cfg.enable`), so the
`if hyperhive.enable then gateway else loopback` branch was dead — the
loopback fallback could never be reached. Set HIVE_FORGE_URL to the
gateway vhost directly.

HIVE_MATRIX_URL drops the same redundant `hyperhive.enable` term but
keeps the gatewayHost null-guard — that one is a real fallback for a
domain-less config, not the dead enable branch.
---
 nix/modules/hive-c0re.nix | 42 ++++++++++++++-------------------------
 1 file changed, 15 insertions(+), 27 deletions(-)

diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 5c782bcb..c141f771 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -750,38 +750,26 @@ in
         HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName;
       }
       // lib.optionalAttrs config.services.hyperhive.forge.enable {
-        # In-cluster forge URL.
-        # - Isolated (private netns): containers resolve `forge.<domain>` via
-        #   the bridge dnsmasq and reach nginx on port 80. No raw forge port
-        #   needed — nginx proxies to forgejo as it does for the operator.
-        # - Shared netns: host loopback is reachable, use direct port.
+        # In-cluster forge URL. Network isolation is unconditional (the
+        # shared-netns mode was removed), so agents always resolve
+        # `forge.<domain>` via the bridge dnsmasq and reach nginx on port 80
+        # (nginx proxies to forgejo as it does for the operator) — there is
+        # no host-loopback path. This env is only set when hyperhive is
+        # enabled, so the gateway URL is unconditionally correct here.
         # See `docs/gateway.md::HIVE_FORGE_URL`.
-        # Network isolation is now unconditional (the shared-netns mode was
-        # removed), so agents always reach the forge through the gateway
-        # vhost rather than host loopback. Guard on the top-level
-        # `hyperhive.enable` (not the deprecated `network.enable`): the
-        # network is always on with hyperhive, so the deprecated toggle has
-        # no effect here either — the loopback branch only covers a config
-        # with hyperhive itself disabled (no agents to serve).
-        HIVE_FORGE_URL =
-          if config.services.hyperhive.enable then
-            "http://${config.services.hyperhive.forge.domain}"
-          else
-            "http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
+        HIVE_FORGE_URL = "http://${config.services.hyperhive.forge.domain}";
       }
       // lib.optionalAttrs config.services.hyperhive.matrix.enable {
         # In-cluster matrix homeserver URL for each agent's
-        # hive-matrix-daemon. Same shape + rationale as HIVE_FORGE_URL:
-        # network isolation is now unconditional, so agents reach tuwunel
-        # via the gateway vhost (`matrix.<domain>`) on plain http:80 rather
-        # than host loopback. Guard on the top-level `hyperhive.enable` (the
-        # deprecated `network.enable` has no effect); the gatewayHost
-        # null-guard falls back to loopback so a domain-less config still
-        # evals. Forwarded to agents by meta.rs alongside HIVE_FORGE_URL;
-        # shares the same env-forwarding ordering caveat (value baked at
-        # config-generation time).
+        # hive-matrix-daemon — the gateway vhost (`matrix.<domain>`) on plain
+        # http:80. Network isolation is unconditional, so there is no
+        # host-loopback path; the only remaining conditional is the
+        # gatewayHost null-guard, which falls back to loopback so a
+        # domain-less config still evals. Forwarded to agents by meta.rs
+        # alongside HIVE_FORGE_URL; shares the same env-forwarding ordering
+        # caveat (value baked at config-generation time).
         HIVE_MATRIX_URL =
-          if config.services.hyperhive.enable && config.services.hyperhive.matrix.gatewayHost != null then
+          if config.services.hyperhive.matrix.gatewayHost != null then
             "http://${config.services.hyperhive.matrix.gatewayHost}"
           else
             "http://127.0.0.1:${toString config.services.hyperhive.matrix.httpPort}";