feat(reverse-proxy): add Pikachu reverse proxy guest

lib/default.nix

@@ -14,6 +14,8 @@ let
     ;
 
   serviceIdentityRegistry = import ./service-identities.nix { inherit lib; };
+  reverseProxyRoutes = import ./reverse-proxy-routes.nix { inherit lib; };
+
   collectNixFiles =
     dir:
     flatten (
@@ -44,6 +46,7 @@ let
       self
       specialArgs
       bridgeName
+      reverseProxyRoutes
       ;
   };
 
@@ -81,6 +84,7 @@ in
     mkHost
     mkHosts
     bridgeName
+    reverseProxyRoutes
     ;
 
   inherit (guests) deriveMac guest;

lib/guests.nix

@@ -3,6 +3,7 @@
   self,
   specialArgs,
   bridgeName,
+  reverseProxyRoutes,
 }:
 let
   inherit (lib) escapeShellArg mapAttrsToList;
@@ -130,6 +131,10 @@ let
             guest takes its address by DHCP, keeping IP management at the router.
           '';
         };
+        reverseProxy = reverseProxyRoutes.mkRouteOptions {
+          subject = "guest route";
+          enableDefault = false;
+        };
         mounts = lib.mkOption {
           type = lib.types.attrsOf (
             lib.types.submodule {
@@ -273,6 +278,10 @@ let
       config = lib.mkIf cfg.enable {
         sops.secrets = lib.genAttrs cfg.secrets (_: { });
 
+        modules.reverse-proxy.routes.${machineName} = lib.mkIf cfg.reverseProxy.enable (
+          reverseProxyRoutes.routeFields cfg.reverseProxy
+        );
+
         assertions = [
           {
             assertion = mountCollisions == [ ];

lib/reverse-proxy-routes.nix

@@ -0,0 +1,77 @@
+{ lib }:
+let
+  mkRouteOptions =
+    {
+      name ? null,
+      subject ? "route",
+      enableDefault ? true,
+    }:
+    {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = enableDefault;
+        description = "Whether this reverse-proxy ${subject} is active.";
+      };
+
+      host = lib.mkOption (
+        {
+          type = lib.types.str;
+          description = "Primary hostname served by this reverse-proxy ${subject}.";
+        }
+        // lib.optionalAttrs (name != null) {
+          default = name;
+          defaultText = lib.literalMD "the route attribute name";
+        }
+      );
+
+      aliases = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Additional hostnames served by this reverse-proxy ${subject}.";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        default = "/";
+        description = "URL path prefix proxied by this reverse-proxy ${subject}.";
+      };
+
+      backend = lib.mkOption {
+        type = lib.types.str;
+        description = "Full HTTP backend URL that receives proxied traffic.";
+      };
+
+      tls = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to serve this reverse-proxy ${subject} with ACME-backed TLS.";
+      };
+
+      websockets = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable websocket proxy headers for this reverse-proxy ${subject}.";
+      };
+    };
+
+  routeFields = route: {
+    inherit (route)
+      host
+      aliases
+      path
+      backend
+      tls
+      websockets
+      ;
+  };
+in
+{
+  inherit mkRouteOptions routeFields;
+
+  routeType = lib.types.submodule (
+    { name, ... }:
+    {
+      options = mkRouteOptions { inherit name; };
+    }
+  );
+}