configs/nixos/AGENTS.md

@@ -65,3 +65,5 @@
   and Zeus), not in the generic host module.
 - Module-relative paths resolve from the module file. Update them when moving a module into a subdirectory.
 - On Pikachu, `uptime` does not support `-s`. Use `who -b` to report the boot time.
+- Evaluating a NixOS guest's inner `config.services.nginx` can force incomplete ACME values.
+  Evaluate the parent host's `config.system.build.toplevel` to validate an ACME-enabled guest.

configs/nixos/modules/services/reverse-proxy.nix

@@ -40,43 +40,14 @@ let
       proxy_pass ${stream.address}:${toString stream.port};
     }
   '') generatedUdpStreams;
-  generatedVirtualHosts =
+  generatedVirtualHosts = lib.listToAttrs generatedVirtualHostList;
-    if duplicateDomainMessages != [ ] then
-      throw (builtins.head duplicateDomainMessages)
-    else
-      lib.listToAttrs generatedVirtualHostList;
 
-  duplicateDomainMessages = lib.concatLists (
+  # Route registry validation already requires unique domains.
-    lib.mapAttrsToList (
+  generatedVirtualHostList = lib.concatLists (
-      domain: virtualHosts:
-      if lib.length virtualHosts > 1 then
-        [
-          "duplicate route domain ${domain} in ${
-            lib.concatMapStringsSep " and " (
-              virtualHost: mkRegistryPath virtualHost.registryName virtualHost.host virtualHost.entry
-            ) virtualHosts
-          }"
-        ]
-      else
-        [ ]
-    ) virtualHostsByDomain
-  );
-
-  virtualHostsByDomain = lib.foldl' (
-    acc: virtualHost:
-    acc
-    // {
-      ${virtualHost.name} = (acc.${virtualHost.name} or [ ]) ++ [ virtualHost ];
-    }
-  ) { } generatedVirtualHostList;
-
-  generatedVirtualHostList = generatedHttpsVirtualHostList ++ generatedHttpVirtualHostList;
-
-  generatedHttpsVirtualHostList = lib.concatLists (
     lib.mapAttrsToList (
       host: routes:
-      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "https") (
+      lib.mapAttrsToList (entry: route: mkVirtualHost host entry route.protocol) (
-        lib.filterAttrs (_entry: route: route.protocol == "https") routes
+        lib.filterAttrs (_entry: route: route.protocol != "udp") routes
       )
     ) registry.route
   );
@@ -93,8 +64,6 @@ let
       inherit (route) port;
     in
     {
-      inherit host entry;
-      registryName = "route";
       name = route.domain;
       value = {
         forceSSL = !isHttp;
@@ -108,15 +77,6 @@ let
 
   mkBackend = address: port: "http://${address}:${toString port}";
 
-  generatedHttpVirtualHostList = lib.concatLists (
-    lib.mapAttrsToList (
-      host: routes:
-      lib.mapAttrsToList (entry: _route: mkVirtualHost host entry "http") (
-        lib.filterAttrs (_entry: route: route.protocol == "http") routes
-      )
-    ) registry.route
-  );
-
   mkRegistryPath =
     registryName: host: entry:
     "registry.${registryName}.${host}.${entry}";