diff --git a/modules/ocf_www/manifests/site/www.pp b/modules/ocf_www/manifests/site/www.pp
index a381620e2..e3efa269a 100644
--- a/modules/ocf_www/manifests/site/www.pp
+++ b/modules/ocf_www/manifests/site/www.pp
@@ -84,13 +84,6 @@
     ],
 
     directories         => [
-      {
-        path            => '/.well-known/matrix/server',
-        provider        => 'location',
-        custom_fragment => '
-            Header set Access-Control-Allow-Origin "*"
-        ',
-      },
       {
         path            => '/.well-known/matrix/client',
         provider        => 'location',
@@ -169,7 +162,8 @@
       port                 => 80,
       docroot              => '/var/www/html',
       redirectmatch_status => 301,
-      redirectmatch_regexp => '^(.*)',
+      # ugly exceptions
+      redirectmatch_regexp => '^((?!\/\.well-known\/matrix\/(client|server)).*)',
       redirectmatch_dest   => $canonical_url;
 
     # redirect weird HTTPS -> canonical HTTPS
@@ -180,6 +174,15 @@
         'secure.ocf.berkeley.edu',
         $::fqdn,
       ],
+      directories          => [
+        {
+          path            => '/.well-known/matrix/client',
+          provider        => 'location',
+          custom_fragment => '
+              Header set Access-Control-Allow-Origin "*"
+          ',
+        },
+      ],
       port                 => 443,
       docroot              => '/var/www/html',
       redirectmatch_status => 301,