feat(nixos): add UDP route ingress

configs/nixos/modules/services/reverse-proxy.nix

@@ -30,7 +30,9 @@ let
   generatedVirtualHostList = lib.concatLists (
     lib.mapAttrsToList (
       host: routes:
-      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry) routes
+      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry) (
+        lib.filterAttrs (_entry: route: route.port != null) routes
+      )
     ) registry.route
   );
 
@@ -59,6 +61,55 @@ let
       throw (builtins.head duplicateDomainMessages)
     else
       lib.listToAttrs generatedVirtualHostList;
+
+  mkUdpStream = host: entry: port:
+    let
+      compositeEntry = registry.join host entry;
+      address = compositeEntry.address or (throw "no matching entry in registry.address for ${mkRegistryPath "route" host entry}");
+    in
+    {
+      inherit host entry port address;
+    };
+
+  generatedUdpStreams = lib.concatLists (
+    lib.mapAttrsToList (
+      host: routes:
+      lib.concatLists (
+        lib.mapAttrsToList (entry: route: map (mkUdpStream host entry) route.udp.ports) routes
+      )
+    ) registry.route
+  );
+
+  udpStreamsByPort = lib.foldl' (
+    acc: stream:
+    acc
+    // {
+      ${toString stream.port} = (acc.${toString stream.port} or [ ]) ++ [ stream ];
+    }
+  ) { } generatedUdpStreams;
+
+  duplicateUdpPortMessages = lib.concatLists (
+    lib.mapAttrsToList (
+      port: streams:
+      if lib.length streams > 1 then
+        [
+          "duplicate UDP route port ${port} in ${lib.concatMapStringsSep " and " (stream: mkRegistryPath "route" stream.host stream.entry) streams}"
+        ]
+      else
+        [ ]
+    ) udpStreamsByPort
+  );
+
+  generatedStreamConfig =
+    if duplicateUdpPortMessages != [ ] then
+      throw (builtins.head duplicateUdpPortMessages)
+    else
+      lib.concatMapStringsSep "\n" (stream: ''
+        server {
+          listen ${toString stream.port} udp;
+          proxy_pass ${stream.address}:${toString stream.port};
+        }
+      '') generatedUdpStreams;
 in
 {
   options.modules.services.reverse-proxy = {
@@ -70,6 +121,7 @@ in
       80
       443
     ];
+    networking.firewall.allowedUDPPorts = map (stream: stream.port) generatedUdpStreams;
 
     security.acme = {
       acceptTerms = true;
@@ -89,6 +141,7 @@ in
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
+      streamConfig = lib.mkIf (generatedUdpStreams != [ ]) generatedStreamConfig;
       virtualHosts = generatedVirtualHosts;
     };
   };