From 46a47fa06188fa40231db19e284bc8493bd47d9e Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Tue, 6 Oct 2026 22:54:58 -0400
Subject: [PATCH] feat(nixos): configure route body limits

---
 configs/nixos/hosts/pikachu/default.nix          |  1 +
 configs/nixos/modules/services/reverse-proxy.nix |  3 +++
 configs/nixos/registry/route.nix                 | 13 +++++++++++++
 3 files changed, 17 insertions(+)

diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix
index 1febafc..06845e7 100644
--- a/configs/nixos/hosts/pikachu/default.nix
+++ b/configs/nixos/hosts/pikachu/default.nix
@@ -174,6 +174,7 @@
         domain = "files.alexion.dev";
         protocol = "https";
         port = 3923;
+        clientMaxBodySize = "1g";
       };
       trustedSources = [ "${registry.address.${config.networking.hostName}."reverse-proxy"}/32" ];
     };
diff --git a/configs/nixos/modules/services/reverse-proxy.nix b/configs/nixos/modules/services/reverse-proxy.nix
index 0d4712a..a9b7e3e 100644
--- a/configs/nixos/modules/services/reverse-proxy.nix
+++ b/configs/nixos/modules/services/reverse-proxy.nix
@@ -99,6 +99,9 @@ let
       value = {
         forceSSL = !isHttp;
         enableACME = !isHttp;
+        extraConfig = lib.optionalString (route.clientMaxBodySize != null) ''
+          client_max_body_size ${route.clientMaxBodySize};
+        '';
         locations."/".proxyPass = mkBackend address port;
       };
     };
diff --git a/configs/nixos/registry/route.nix b/configs/nixos/registry/route.nix
index 0f74491..0f71a8b 100644
--- a/configs/nixos/registry/route.nix
+++ b/configs/nixos/registry/route.nix
@@ -29,6 +29,12 @@
         );
       message = "UDP routes must set ports and not port.";
     }
+    {
+      assertion =
+        entries:
+        lib.all (entry: entry.value.protocol != "udp" || entry.value.clientMaxBodySize == null) entries;
+      message = "UDP routes must not set clientMaxBodySize.";
+    }
   ];
 
   type = lib.types.submodule {
@@ -64,6 +70,13 @@
         ];
         description = "Sets the UDP ports for a UDP route.";
       };
+
+      clientMaxBodySize = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "1g";
+        description = "Maximum HTTP request body the reverse proxy accepts.";
+      };
     };
   };
 }
-- 
2.47.3