b4c5954491
The dashboard vhost, the hive domain vhost and the dashboard's local name move to hive-c0re/vhosts.nix; the matrix .well-known discovery and the legacy /matrix/ redirect move to glue-matrix-hive-discovery.nix, which adds them to the hive domain vhost. Both declare through gateway.vhosts. hive-gateway/vhosts.nix keeps the catch-all only, and the gateway no longer reads deploy.matrix or c0re.servedFrontend, nor deploy.hive-controller.enable for its vhosts. Part of #3742.
81 lines
3.3 KiB
Nix
81 lines
3.3 KiB
Nix
# Glue: serve the swarm homeserver's discovery on the hive domain's vhost
|
|
# wherever both run.
|
|
#
|
|
# ONE PAIRING PER FILE — matrix → hive domain vhost, and nothing else.
|
|
# Deleting this leaves federation and clients with no `.well-known/matrix/*`
|
|
# answer at the server name, and the legacy `<hive>/matrix/*` links 404.
|
|
#
|
|
# The locations sit on the hive domain because the matrix spec reads
|
|
# delegation off the *server name*: it is the hive answering "where is my
|
|
# homeserver", not the homeserver answering for itself (./hive-matrix.nix's
|
|
# vhost on `gatewayHost` carries the rest).
|
|
#
|
|
# ⚠️ The condition repeats the one ./hive-c0re/vhosts.nix declares the hive
|
|
# domain vhost under. With it looser, this file alone would declare that
|
|
# vhost, with discovery and no `/` redirect.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
gatewayCfg = hyperhiveCfg.gateway;
|
|
matrixCfg = hyperhiveCfg.swarm.matrix;
|
|
|
|
publicPort = gatewayCfg.httpsPort;
|
|
# The canonical 443 elides the port; see `docs/networking/gateway.md`
|
|
# ("Self-signed TLS").
|
|
homeserverUrl = "https://${matrixCfg.gatewayHost}${
|
|
lib.optionalString (publicPort != 443) ":${toString publicPort}"
|
|
}";
|
|
in
|
|
{
|
|
config =
|
|
lib.mkIf
|
|
(
|
|
hyperhiveCfg.deploy.matrix.enable
|
|
&& matrixCfg.gatewayHost != null
|
|
&& hyperhiveCfg.deploy.hive-controller.enable
|
|
&& gatewayCfg.enable
|
|
&& hyperhiveCfg.swarm.dashboardDomain != null
|
|
)
|
|
{
|
|
services.hyperhive.gateway.vhosts.${hyperhiveCfg.domain}.locations = {
|
|
# `<hive>/matrix/*` → 301 → `gatewayHost`'s vhost/$1 (`chat.<swarm-domain>`
|
|
# by default; legacy deep-link shim for the fluffychat sub-domain).
|
|
# See `docs/networking/gateway.md`.
|
|
"/matrix/" = {
|
|
extraConfig = ''
|
|
rewrite ^/matrix/(.*)$ ${homeserverUrl}/$1 permanent;
|
|
'';
|
|
};
|
|
|
|
# `.well-known/matrix/{client,server}` discovery JSON, pointing
|
|
# clients and peers at `gatewayHost`: the homeserver has no other
|
|
# address. CORS `*` per matrix spec. See `docs/networking/gateway.md`.
|
|
"= /.well-known/matrix/client" = {
|
|
extraConfig = ''
|
|
default_type application/json;
|
|
${gatewayCfg.lib.securityHeaders}
|
|
add_header Access-Control-Allow-Origin *;
|
|
return 200 '{"m.homeserver":{"base_url":"${homeserverUrl}"}}';
|
|
'';
|
|
};
|
|
# `m.server` is NOT a URL: per the matrix server-server spec
|
|
# (Resolving Server Names) a delegated host with NO port resolves
|
|
# to the federation default 8448 (after the SRV check) — the
|
|
# https-implies-443 rule does NOT apply here. So the port must be
|
|
# explicit even when it's the HTTPS default, unlike the client
|
|
# base_url above. Without it, peers federate to <gatewayHost>:8448
|
|
# (closed) while the endpoint actually lives on the gateway's 443
|
|
# vhost. See docs/networking/gateway.md discovery flow.
|
|
"= /.well-known/matrix/server" = {
|
|
extraConfig = ''
|
|
default_type application/json;
|
|
return 200 '{"m.server":"${matrixCfg.gatewayHost}:${toString publicPort}"}';
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|