From 7f11154ceb6406568b9f35e47d19a336ef771078 Mon Sep 17 00:00:00 2001 From: alexion Date: Tue, 15 Sep 2026 19:37:27 -0400 Subject: [PATCH] refactor(nixos): model local routes as HTTP routes --- configs/nixos/hosts/pikachu/default.nix | 12 ++--- .../nixos/modules/services/reverse-proxy.nix | 45 +++++++------------ configs/nixos/registry/local-route.nix | 25 ----------- configs/nixos/registry/route.nix | 15 ++++++- 4 files changed, 36 insertions(+), 61 deletions(-) delete mode 100644 configs/nixos/registry/local-route.nix diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix index 5101337..47ff374 100644 --- a/configs/nixos/hosts/pikachu/default.nix +++ b/configs/nixos/hosts/pikachu/default.nix @@ -148,11 +148,13 @@ enable = true; vlan = 20; address = "10.23.20.110"; - }; - - registry.local-route.${config.networking.hostName}.homepage = { - domain = "home"; - port = 8082; + reverseProxy = { + enable = true; + route = { + domain = "home"; + http.port = 8082; + }; + }; }; guests.copyparty = { diff --git a/configs/nixos/modules/services/reverse-proxy.nix b/configs/nixos/modules/services/reverse-proxy.nix index 75140b8..3ca985a 100644 --- a/configs/nixos/modules/services/reverse-proxy.nix +++ b/configs/nixos/modules/services/reverse-proxy.nix @@ -9,59 +9,46 @@ let mkRegistryPath = registryName: host: entry: "registry.${registryName}.${host}.${entry}"; - mkBackend = address: route: "http://${address}:${toString route.port}"; + mkBackend = address: port: "http://${address}:${toString port}"; - mkPublicVirtualHost = host: entry: + mkVirtualHost = host: entry: mode: let compositeEntry = registry.join host entry; route = compositeEntry.route; address = compositeEntry.address or (throw "no matching entry in registry.address for ${mkRegistryPath "route" host entry}"); + isHttp = mode == "http"; + port = if isHttp then route.http.port else route.port; in { inherit host entry; registryName = "route"; name = route.domain; value = { - forceSSL = true; - enableACME = true; - locations."/".proxyPass = mkBackend address route; + forceSSL = !isHttp; + enableACME = !isHttp; + locations."/".proxyPass = mkBackend address port; }; }; - mkLocalVirtualHost = host: entry: - let - compositeEntry = registry.join host entry; - route = compositeEntry.local-route; - address = compositeEntry.address or (throw "no matching entry in registry.address for ${mkRegistryPath "local-route" host entry}"); - in - { - inherit host entry; - registryName = "local-route"; - name = route.domain; - value = { - forceSSL = false; - enableACME = false; - locations."/".proxyPass = mkBackend address route; - }; - }; - - generatedPublicVirtualHostList = lib.concatLists ( + generatedHttpsVirtualHostList = lib.concatLists ( lib.mapAttrsToList ( host: routes: - lib.mapAttrsToList (entry: _route: mkPublicVirtualHost host entry) ( + lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "https") ( lib.filterAttrs (_entry: route: route.port != null) routes ) ) registry.route ); - generatedLocalVirtualHostList = lib.concatLists ( + generatedHttpVirtualHostList = lib.concatLists ( lib.mapAttrsToList ( host: routes: - lib.mapAttrsToList (entry: _route: mkLocalVirtualHost host entry) routes - ) registry.local-route + lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "http") ( + lib.filterAttrs (_entry: route: route.http.port != null) routes + ) + ) registry.route ); - generatedVirtualHostList = generatedPublicVirtualHostList ++ generatedLocalVirtualHostList; + generatedVirtualHostList = generatedHttpsVirtualHostList ++ generatedHttpVirtualHostList; virtualHostsByDomain = lib.foldl' ( acc: virtualHost: @@ -76,7 +63,7 @@ let domain: virtualHosts: if lib.length virtualHosts > 1 then [ - "duplicate reverse-proxy domain ${domain} in ${lib.concatMapStringsSep " and " (virtualHost: mkRegistryPath virtualHost.registryName virtualHost.host virtualHost.entry) virtualHosts}" + "duplicate route domain ${domain} in ${lib.concatMapStringsSep " and " (virtualHost: mkRegistryPath virtualHost.registryName virtualHost.host virtualHost.entry) virtualHosts}" ] else [ ] diff --git a/configs/nixos/registry/local-route.nix b/configs/nixos/registry/local-route.nix deleted file mode 100644 index 5235c5e..0000000 --- a/configs/nixos/registry/local-route.nix +++ /dev/null @@ -1,25 +0,0 @@ -{ lib, ... }: -{ - checks = [ - { - assertion = lib.registry.predicates.uniqueValue (entry: entry.value.domain); - message = "Local route domains must be unique."; - } - ]; - - type = lib.types.submodule { - options = { - domain = lib.mkOption { - type = lib.types.str; - example = "home"; - description = "Local HTTP domain served by this route entry."; - }; - - port = lib.mkOption { - type = lib.types.port; - example = 8082; - description = "Backend TCP port served by the matching address registry entry."; - }; - }; - }; -} diff --git a/configs/nixos/registry/route.nix b/configs/nixos/registry/route.nix index b4ff6dc..50d728c 100644 --- a/configs/nixos/registry/route.nix +++ b/configs/nixos/registry/route.nix @@ -12,6 +12,10 @@ ); message = "Route UDP ports must be unique."; } + { + assertion = entries: lib.all (entry: entry.value.port == null || entry.value.http.port == null) entries; + message = "Route entries must not set both port and http.port."; + } ]; type = lib.types.submodule { @@ -19,14 +23,21 @@ domain = lib.mkOption { type = lib.types.str; example = "files.alexion.dev"; - description = "Public domain served by this route entry."; + description = "Domain served by this route entry."; }; port = lib.mkOption { type = lib.types.nullOr lib.types.port; default = null; example = 3923; - description = "Backend TCP port served by the matching address registry entry."; + description = "HTTPS backend TCP port served by the matching address registry entry."; + }; + + http.port = lib.mkOption { + type = lib.types.nullOr lib.types.port; + default = null; + example = 8082; + description = "HTTP backend TCP port served by the matching address registry entry."; }; udp.ports = lib.mkOption {