# Glue: serve the swarm homeserver's discovery on the hive domain's vhost
# wherever both run.
#
# ONE PAIRING PER FILE — matrix → hive domain vhost, and nothing else.
# Deleting this leaves federation and clients with no `.well-known/matrix/*`
# answer at the server name, and the legacy `<hive>/matrix/*` links 404.
#
# The locations sit on the hive domain because the matrix spec reads
# delegation off the *server name*: it is the hive answering "where is my
# homeserver", not the homeserver answering for itself (./hive-matrix.nix's
# vhost on `gatewayHost` carries the rest).
#
# ⚠️ The condition repeats the one ./hive-c0re/vhosts.nix declares the hive
# domain vhost under. With it looser, this file alone would declare that
# vhost, with discovery and no `/` redirect.
{
  lib,
  config,
  ...
}:
let
  hyperhiveCfg = config.services.hyperhive;
  gatewayCfg = hyperhiveCfg.gateway;
  matrixCfg = hyperhiveCfg.swarm.matrix;

  publicPort = gatewayCfg.httpsPort;
  # The canonical 443 elides the port; see `docs/networking/gateway.md`
  # ("Self-signed TLS").
  homeserverUrl = "https://${matrixCfg.gatewayHost}${
    lib.optionalString (publicPort != 443) ":${toString publicPort}"
  }";
in
{
  config =
    lib.mkIf
      (
        hyperhiveCfg.deploy.matrix.enable
        && matrixCfg.gatewayHost != null
        && hyperhiveCfg.deploy.hive-controller.enable
        && gatewayCfg.enable
        && hyperhiveCfg.swarm.dashboardDomain != null
      )
      {
        services.hyperhive.gateway.vhosts.${hyperhiveCfg.domain}.locations = {
          # `<hive>/matrix/*` → 301 → `gatewayHost`'s vhost/$1 (`chat.<swarm-domain>`
          # by default; legacy deep-link shim for the fluffychat sub-domain).
          # See `docs/networking/gateway.md`.
          "/matrix/" = {
            extraConfig = ''
              rewrite ^/matrix/(.*)$ ${homeserverUrl}/$1 permanent;
            '';
          };

          # `.well-known/matrix/{client,server}` discovery JSON, pointing
          # clients and peers at `gatewayHost`: the homeserver has no other
          # address. CORS `*` per matrix spec. See `docs/networking/gateway.md`.
          "= /.well-known/matrix/client" = {
            extraConfig = ''
              default_type application/json;
              ${gatewayCfg.lib.securityHeaders}
              add_header Access-Control-Allow-Origin *;
              return 200 '{"m.homeserver":{"base_url":"${homeserverUrl}"}}';
            '';
          };
          # `m.server` is NOT a URL: per the matrix server-server spec
          # (Resolving Server Names) a delegated host with NO port resolves
          # to the federation default 8448 (after the SRV check) — the
          # https-implies-443 rule does NOT apply here. So the port must be
          # explicit even when it's the HTTPS default, unlike the client
          # base_url above. Without it, peers federate to <gatewayHost>:8448
          # (closed) while the endpoint actually lives on the gateway's 443
          # vhost. See docs/networking/gateway.md discovery flow.
          "= /.well-known/matrix/server" = {
            extraConfig = ''
              default_type application/json;
              return 200 '{"m.server":"${matrixCfg.gatewayHost}:${toString publicPort}"}';
            '';
          };
        };
      };
}