alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(nixos): model local routes as HTTP routes

Browse Source
This commit is contained in:
alexion
2026-09-15 19:37:27 -04:00
parent 4f6ade4ed5
commit 7f11154ceb
4 changed files with 36 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
configs/nixos/hosts/pikachu/default.nix
View File

@@ -148,11 +148,13 @@
enable = true;
vlan = 20;
address = "10.23.20.110";
};
registry.local-route.${config.networking.hostName}.homepage = {
domain = "home";
port = 8082;
reverseProxy = {
enable = true;
route = {
domain = "home";
http.port = 8082;
};
};
};
guests.copyparty = {

45
configs/nixos/modules/services/reverse-proxy.nix
View File

@@ -9,59 +9,46 @@ let
mkRegistryPath = registryName: host: entry: "registry.${registryName}.${host}.${entry}";
mkBackend = address: route: "http://${address}:${toString route.port}";
mkBackend = address: port: "http://${address}:${toString port}";
mkPublicVirtualHost = host: entry:
mkVirtualHost = host: entry: mode:
let
compositeEntry = registry.join host entry;
route = compositeEntry.route;
address = compositeEntry.address or (throw "no matching entry in registry.address for ${mkRegistryPath "route" host entry}");
isHttp = mode == "http";
port = if isHttp then route.http.port else route.port;
in
{
inherit host entry;
registryName = "route";
name = route.domain;
value = {
forceSSL = true;
enableACME = true;
locations."/".proxyPass = mkBackend address route;
forceSSL = !isHttp;
enableACME = !isHttp;
locations."/".proxyPass = mkBackend address port;
};
};
mkLocalVirtualHost = host: entry:
let
compositeEntry = registry.join host entry;
route = compositeEntry.local-route;
address = compositeEntry.address or (throw "no matching entry in registry.address for ${mkRegistryPath "local-route" host entry}");
in
{
inherit host entry;
registryName = "local-route";
name = route.domain;
value = {
forceSSL = false;
enableACME = false;
locations."/".proxyPass = mkBackend address route;
};
};
generatedPublicVirtualHostList = lib.concatLists (
generatedHttpsVirtualHostList = lib.concatLists (
lib.mapAttrsToList (
host: routes:
lib.mapAttrsToList (entry: _route: mkPublicVirtualHost host entry) (
lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "https") (
lib.filterAttrs (_entry: route: route.port != null) routes
)
) registry.route
);
generatedLocalVirtualHostList = lib.concatLists (
generatedHttpVirtualHostList = lib.concatLists (
lib.mapAttrsToList (
host: routes:
lib.mapAttrsToList (entry: _route: mkLocalVirtualHost host entry) routes
) registry.local-route
lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "http") (
lib.filterAttrs (_entry: route: route.http.port != null) routes
)
) registry.route
);
generatedVirtualHostList = generatedPublicVirtualHostList ++ generatedLocalVirtualHostList;
generatedVirtualHostList = generatedHttpsVirtualHostList ++ generatedHttpVirtualHostList;
virtualHostsByDomain = lib.foldl' (
acc: virtualHost:
@@ -76,7 +63,7 @@ let
domain: virtualHosts:
if lib.length virtualHosts > 1 then
[
"duplicate reverse-proxy domain ${domain} in ${lib.concatMapStringsSep " and " (virtualHost: mkRegistryPath virtualHost.registryName virtualHost.host virtualHost.entry) virtualHosts}"
"duplicate route domain ${domain} in ${lib.concatMapStringsSep " and " (virtualHost: mkRegistryPath virtualHost.registryName virtualHost.host virtualHost.entry) virtualHosts}"
]
else
[ ]

25
configs/nixos/registry/local-route.nix
View File

@@ -1,25 +0,0 @@
{ lib, ... }:
{
checks = [
{
assertion = lib.registry.predicates.uniqueValue (entry: entry.value.domain);
message = "Local route domains must be unique.";
}
];
type = lib.types.submodule {
options = {
domain = lib.mkOption {
type = lib.types.str;
example = "home";
description = "Local HTTP domain served by this route entry.";
};
port = lib.mkOption {
type = lib.types.port;
example = 8082;
description = "Backend TCP port served by the matching address registry entry.";
};
};
};
}

15
configs/nixos/registry/route.nix
View File

@@ -12,6 +12,10 @@
);
message = "Route UDP ports must be unique.";
}
{
assertion = entries: lib.all (entry: entry.value.port == null || entry.value.http.port == null) entries;
message = "Route entries must not set both port and http.port.";
}
];
type = lib.types.submodule {
@@ -19,14 +23,21 @@
domain = lib.mkOption {
type = lib.types.str;
example = "files.alexion.dev";
description = "Public domain served by this route entry.";
description = "Domain served by this route entry.";
};
port = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = null;
example = 3923;
description = "Backend TCP port served by the matching address registry entry.";
description = "HTTPS backend TCP port served by the matching address registry entry.";
};
http.port = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = null;
example = 8082;
description = "HTTP backend TCP port served by the matching address registry entry.";
};
udp.ports = lib.mkOption {