# The gateway's own vhost, as a `services.hyperhive.gateway.vhosts`
# declaration (rendered by ./declared-vhosts.nix): the `_` default server,
# which answers unmatched `Host` with a bare 444.
#
# Scope: a service declares its own vhost and dns name in its own module,
# the same way — the hive's dashboard and hive domain in
# ../hive-c0re/vhosts.nix, matrix discovery in
# ../glue-matrix-hive-discovery.nix. That keeps a service's gateway surface
# next to the service, and keeps this file to what the gateway itself
# serves.
{
  # The catch-all, and now *only* a catch-all: anything whose `Host`
  # matches no vhost gets an immediate 444 (close without a response)
  # rather than being served the hive's dashboard.
  #
  # `_` is the idiomatic spelling because it is not a legal hostname,
  # so it can never match a request by name — it serves traffic solely
  # by being `default_server`.
  #
  # ⚠️ It still gets TLS attrs from the gateway. It listens on the https port, so a
  # client connecting by IP completes a TLS handshake *before* nginx
  # can look at `Host` and reject it; with no cert the vhost fails to
  # load. The certificate will not match what such a client asked for
  # — that is unavoidable and correct: nothing can present a valid
  # cert for a name the operator never issued one for.
  #
  # The gateway renders `default` at `mkDefault` priority: an operator with their own
  # `default = true` vhost must be able to win without fighting
  # priorities. The assertion in ./default.nix catches the case where
  # they add one *without* turning this off, which nginx would
  # otherwise only report at runtime as a failed config test.
  "_" = {
    default = true;
    # A response to attach headers to is exactly what this vhost refuses.
    securityHeaders = false;
    extraConfig = ''
      return 444;
    '';
  };
}