feat(nixos): add UDP route ingress

configs/nixos/modules/services/reverse-proxy.nix

@@ -30,7 +30,9 @@ let
   generatedVirtualHostList = lib.concatLists (
     lib.mapAttrsToList (
       host: routes:
-      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry) routes
+      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry) (
+        lib.filterAttrs (_entry: route: route.port != null) routes
+      )
     ) registry.route
   );
 
@@ -59,6 +61,31 @@ let
       throw (builtins.head duplicateDomainMessages)
     else
       lib.listToAttrs generatedVirtualHostList;
+
+  mkUdpStream = host: entry: port:
+    let
+      compositeEntry = registry.join host entry;
+      address = compositeEntry.address or (throw "no matching entry in registry.address for ${mkRegistryPath "route" host entry}");
+    in
+    {
+      inherit host entry port address;
+    };
+
+  generatedUdpStreams = lib.concatLists (
+    lib.mapAttrsToList (
+      host: routes:
+      lib.concatLists (
+        lib.mapAttrsToList (entry: route: map (mkUdpStream host entry) route.udp.ports) routes
+      )
+    ) registry.route
+  );
+
+  generatedStreamConfig = lib.concatMapStringsSep "\n" (stream: ''
+    server {
+      listen ${toString stream.port} udp;
+      proxy_pass ${stream.address}:${toString stream.port};
+    }
+  '') generatedUdpStreams;
 in
 {
   options.modules.services.reverse-proxy = {
@@ -70,6 +97,7 @@ in
       80
       443
     ];
+    networking.firewall.allowedUDPPorts = map (stream: stream.port) generatedUdpStreams;
 
     security.acme = {
       acceptTerms = true;
@@ -89,6 +117,7 @@ in
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
+      streamConfig = lib.mkIf (generatedUdpStreams != [ ]) generatedStreamConfig;
       virtualHosts = generatedVirtualHosts;
     };
   };