From 0547a22e86d5dca633975214bdfcb69e6a74cdeb Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Tue, 6 Jan 2026 08:59:39 -0800
Subject: [PATCH] Forgejo attachment redirects: set up for prod

This tweaks the Forgejo redirect-to-pagure-for-attachments stuff
to work for prod as well as staging, since we proved it out in
staging and we do want it to actually work for prod migrations.

Signed-off-by: Adam Williamson <awilliam@redhat.com>
---
 .../templates/reversepassproxy.forge.conf          | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.forge.conf b/roles/httpd/reverseproxy/templates/reversepassproxy.forge.conf
index 420d551dd9..1e8902fee3 100644
--- a/roles/httpd/reverseproxy/templates/reversepassproxy.forge.conf
+++ b/roles/httpd/reverseproxy/templates/reversepassproxy.forge.conf
@@ -1,13 +1,12 @@
 # Redirect links from Fedora Forge for Pagure attachments
-# Currently only enabled in staging for testing
-{% if env == "staging" %}
-<Proxy "https://stg.pagure.io">
+<Proxy "https://{{ env_prefix }}pagure.io">
 SSLProxyEngine On
 SSLProxyVerify require
 SSLProxyVerifyDepth 2
 SSLProxyCACertificateFile "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
 </Proxy>
-# Have to define this too so we can special-case some proxies to prod Pagure
+{% if env == "staging" %}
+# We also define prod pagure on staging as we special-case some proxies to prod pagure
 <Proxy "https://pagure.io">
 SSLProxyEngine On
 SSLProxyVerify require
@@ -15,8 +14,9 @@ SSLProxyVerifyDepth 2
 SSLProxyCACertificateFile "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
 </Proxy>
 
-# Special case for testdays-web to proxy to prod
+# Special case for stg forgejo testdays-web to proxy to prod pagure
 ProxyPassMatch ^.*?/fedora-qa/testdays-web/issue/raw/files/(.*)$ https://pagure.io/fedora-qa/testdays-web/issue/raw/files/$1
+{% endif %}
 
 # Forgejo can't decide whether to render root-relative links as relative
 # to the server root or the repo root, and currently behaves differently
@@ -27,12 +27,12 @@ ProxyPassMatch ^.*?/fedora-qa/testdays-web/issue/raw/files/(.*)$ https://pagure.
 # to repo. As all repos must have an org in Forgejo, if there are more
 # than two directories before /issue, this must be repo-relative; the
 # third match will be either pagurerepo or pagureorg/pagurerepo
-ProxyPassMatch ^/(.+?)/(.+?)/(.+?)/issue/raw/files/(.*)$ https://stg.pagure.io/$3/issue/raw/files/$4
+ProxyPassMatch ^/(.+?)/(.+?)/(.+?)/issue/raw/files/(.*)$ https://{{ env_prefix }}pagure.io/$3/issue/raw/files/$4
 
 # This match handles cases where the link is rendered relative to the
 # server root; if we didn't hit the first match, the first match here
 # will be pagurerepo or pagureorg/pagurerepo
-ProxyPassMatch ^/(.+?)/issue/raw/files/(.*)$ https://stg.pagure.io/$1/issue/raw/files/$2
+ProxyPassMatch ^/(.+?)/issue/raw/files/(.*)$ https://{{ env_prefix }}pagure.io/$1/issue/raw/files/$2
 {% endif %}
 
 {% include 'reversepassproxy.conf' %}