From ef52dbc5b64365b642061530a792e20a6076047b Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Thu, 10 Sep 2026 08:52:23 -0400
Subject: [PATCH] refactor(nixos): validate UDP routes in registry

---
 .../nixos/modules/services/reverse-proxy.nix  | 34 +++----------------
 configs/nixos/registry/route.nix              |  8 +++++
 2 files changed, 13 insertions(+), 29 deletions(-)

diff --git a/configs/nixos/modules/services/reverse-proxy.nix b/configs/nixos/modules/services/reverse-proxy.nix
index 599ff38..916ca29 100644
--- a/configs/nixos/modules/services/reverse-proxy.nix
+++ b/configs/nixos/modules/services/reverse-proxy.nix
@@ -80,36 +80,12 @@ let
     ) registry.route
   );
 
-  udpStreamsByPort = lib.foldl' (
-    acc: stream:
-    acc
-    // {
-      ${toString stream.port} = (acc.${toString stream.port} or [ ]) ++ [ stream ];
+  generatedStreamConfig = lib.concatMapStringsSep "\n" (stream: ''
+    server {
+      listen ${toString stream.port} udp;
+      proxy_pass ${stream.address}:${toString stream.port};
     }
-  ) { } generatedUdpStreams;
-
-  duplicateUdpPortMessages = lib.concatLists (
-    lib.mapAttrsToList (
-      port: streams:
-      if lib.length streams > 1 then
-        [
-          "duplicate UDP route port ${port} in ${lib.concatMapStringsSep " and " (stream: mkRegistryPath "route" stream.host stream.entry) streams}"
-        ]
-      else
-        [ ]
-    ) udpStreamsByPort
-  );
-
-  generatedStreamConfig =
-    if duplicateUdpPortMessages != [ ] then
-      throw (builtins.head duplicateUdpPortMessages)
-    else
-      lib.concatMapStringsSep "\n" (stream: ''
-        server {
-          listen ${toString stream.port} udp;
-          proxy_pass ${stream.address}:${toString stream.port};
-        }
-      '') generatedUdpStreams;
+  '') generatedUdpStreams;
 in
 {
   options.modules.services.reverse-proxy = {
diff --git a/configs/nixos/registry/route.nix b/configs/nixos/registry/route.nix
index 38439e7..c1ef4e7 100644
--- a/configs/nixos/registry/route.nix
+++ b/configs/nixos/registry/route.nix
@@ -5,6 +5,14 @@
       assertion = lib.registry.predicates.uniqueValue (entry: entry.value.domain);
       message = "Route domains must be unique.";
     }
+    {
+      assertion = entries:
+        let
+          ports = lib.concatMap (entry: entry.value.udp.ports) entries;
+        in
+        builtins.length (lib.unique ports) == builtins.length ports;
+      message = "Route UDP ports must be unique.";
+    }
   ];
 
   type = lib.types.submodule {