b4c5954491
The dashboard vhost, the hive domain vhost and the dashboard's local name move to hive-c0re/vhosts.nix; the matrix .well-known discovery and the legacy /matrix/ redirect move to glue-matrix-hive-discovery.nix, which adds them to the hive domain vhost. Both declare through gateway.vhosts. hive-gateway/vhosts.nix keeps the catch-all only, and the gateway no longer reads deploy.matrix or c0re.servedFrontend, nor deploy.hive-controller.enable for its vhosts. Part of #3742.
40 lines
1.8 KiB
Nix
40 lines
1.8 KiB
Nix
# The gateway's own vhost, as a `services.hyperhive.gateway.vhosts`
|
|
# declaration (rendered by ./declared-vhosts.nix): the `_` default server,
|
|
# which answers unmatched `Host` with a bare 444.
|
|
#
|
|
# Scope: a service declares its own vhost and dns name in its own module,
|
|
# the same way — the hive's dashboard and hive domain in
|
|
# ../hive-c0re/vhosts.nix, matrix discovery in
|
|
# ../glue-matrix-hive-discovery.nix. That keeps a service's gateway surface
|
|
# next to the service, and keeps this file to what the gateway itself
|
|
# serves.
|
|
{
|
|
# The catch-all, and now *only* a catch-all: anything whose `Host`
|
|
# matches no vhost gets an immediate 444 (close without a response)
|
|
# rather than being served the hive's dashboard.
|
|
#
|
|
# `_` is the idiomatic spelling because it is not a legal hostname,
|
|
# so it can never match a request by name — it serves traffic solely
|
|
# by being `default_server`.
|
|
#
|
|
# ⚠️ It still gets TLS attrs from the gateway. It listens on the https port, so a
|
|
# client connecting by IP completes a TLS handshake *before* nginx
|
|
# can look at `Host` and reject it; with no cert the vhost fails to
|
|
# load. The certificate will not match what such a client asked for
|
|
# — that is unavoidable and correct: nothing can present a valid
|
|
# cert for a name the operator never issued one for.
|
|
#
|
|
# The gateway renders `default` at `mkDefault` priority: an operator with their own
|
|
# `default = true` vhost must be able to win without fighting
|
|
# priorities. The assertion in ./default.nix catches the case where
|
|
# they add one *without* turning this off, which nginx would
|
|
# otherwise only report at runtime as a failed config test.
|
|
"_" = {
|
|
default = true;
|
|
# A response to attach headers to is exactly what this vhost refuses.
|
|
securityHeaders = false;
|
|
extraConfig = ''
|
|
return 444;
|
|
'';
|
|
};
|
|
}
|