refactor(nixos): validate UDP routes in registry

configs/nixos/modules/services/reverse-proxy.nix

@@ -80,36 +80,12 @@ let
     ) registry.route
   );
 
-  udpStreamsByPort = lib.foldl' (
-    acc: stream:
-    acc
-    // {
-      ${toString stream.port} = (acc.${toString stream.port} or [ ]) ++ [ stream ];
+  generatedStreamConfig = lib.concatMapStringsSep "\n" (stream: ''
+    server {
+      listen ${toString stream.port} udp;
+      proxy_pass ${stream.address}:${toString stream.port};
     }
-  ) { } generatedUdpStreams;
-
-  duplicateUdpPortMessages = lib.concatLists (
-    lib.mapAttrsToList (
-      port: streams:
-      if lib.length streams > 1 then
-        [
-          "duplicate UDP route port ${port} in ${lib.concatMapStringsSep " and " (stream: mkRegistryPath "route" stream.host stream.entry) streams}"
-        ]
-      else
-        [ ]
-    ) udpStreamsByPort
-  );
-
-  generatedStreamConfig =
-    if duplicateUdpPortMessages != [ ] then
-      throw (builtins.head duplicateUdpPortMessages)
-    else
-      lib.concatMapStringsSep "\n" (stream: ''
-        server {
-          listen ${toString stream.port} udp;
-          proxy_pass ${stream.address}:${toString stream.port};
-        }
-      '') generatedUdpStreams;
+  '') generatedUdpStreams;
 in
 {
   options.modules.services.reverse-proxy = {

configs/nixos/registry/route.nix

@@ -5,6 +5,14 @@
       assertion = lib.registry.predicates.uniqueValue (entry: entry.value.domain);
       message = "Route domains must be unique.";
     }
+    {
+      assertion = entries:
+        let
+          ports = lib.concatMap (entry: entry.value.udp.ports) entries;
+        in
+        builtins.length (lib.unique ports) == builtins.length ports;
+      message = "Route UDP ports must be unique.";
+    }
   ];
 
   type = lib.types.submodule {