From 3fca42147da7a43f34a25fec9a2ecb551cc74fcc Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Mon, 17 Aug 2026 14:32:08 -0400
Subject: [PATCH] feat(reverse-proxy): collect fleet routes

---
 flake.nix                | 40 ++++++++++++++++++++++++++++++++++++++++
 guests/reverse-proxy.nix |  3 ++-
 lib/default.nix          | 13 ++++++++++++-
 3 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index 4740f82..0877545 100644
--- a/flake.nix
+++ b/flake.nix
@@ -173,6 +173,46 @@
               touch $out
             '';
 
+          reverse-proxy-fleet-routes =
+            let
+              routeHost =
+                lib.nixosSystem {
+                  system = "x86_64-linux";
+                  specialArgs.my = self.lib;
+                  modules = [
+                    ./modules/reverse-proxy.nix
+                    {
+                      modules.reverse-proxy.routes.app = {
+                        host = "worker.alexion.dev";
+                        backend = "http://10.23.20.126:3923";
+                      };
+                    }
+                  ];
+                };
+              fleetRoutes = self.lib.collectReverseProxyRoutes {
+                inherit routeHost;
+                pikachu = self.nixosConfigurations.pikachu;
+              };
+              testConfig =
+                (self.nixosConfigurations.pikachu.extendModules {
+                  specialArgs.reverseProxyFleetRoutes = fleetRoutes;
+                }).config;
+              vhosts = testConfig.containers.reverse-proxy.config.services.nginx.virtualHosts;
+            in
+            pkgs.runCommand "reverse-proxy-fleet-routes-check" { } ''
+              ${
+                lib.optionalString (
+                  !(
+                    fleetRoutes ? routeHost-app
+                    && fleetRoutes ? pikachu-actualbudget
+                    && vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
+                    && vhosts."budget.alexion.dev".locations."/".proxyPass == "http://10.23.20.42:5006"
+                  )
+                ) "exit 1"
+              }
+              touch $out
+            '';
+
           reverse-proxy-secondary-path-requires-root =
             let
               testConfig =
diff --git a/guests/reverse-proxy.nix b/guests/reverse-proxy.nix
index 2db77ed..03d7cca 100644
--- a/guests/reverse-proxy.nix
+++ b/guests/reverse-proxy.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   my,
+  reverseProxyFleetRoutes ? config.modules.reverse-proxy.routes,
   ...
 }:
 let
@@ -34,7 +35,7 @@ in
       interior = {
         modules.reverse-proxy = {
           enable = true;
-          routes = config.modules.reverse-proxy.routes // legacyRoutes;
+          routes = reverseProxyFleetRoutes // legacyRoutes;
         };
 
         networking.firewall.allowedTCPPorts = [ 2022 ];
diff --git a/lib/default.nix b/lib/default.nix
index 22be36d..d0f6ff2 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -16,6 +16,15 @@ let
   serviceIdentityRegistry = import ./service-identities.nix { inherit lib; };
   reverseProxyRoutes = import ./reverse-proxy-routes.nix { inherit lib; };
 
+  collectReverseProxyRoutes =
+    hosts:
+    lib.concatMapAttrs (
+      hostName: host:
+      lib.mapAttrs' (
+        routeName: route: lib.nameValuePair "${hostName}-${routeName}" route
+      ) host.config.modules.reverse-proxy.routes
+    ) hosts;
+
   collectNixFiles =
     dir:
     flatten (
@@ -34,8 +43,9 @@ let
     );
 
   specialArgs = {
-    inherit inputs;
+    inherit inputs self;
     my = self.lib;
+    reverseProxyFleetRoutes = self.lib.collectReverseProxyRoutes self.nixosConfigurations;
   };
 
   bridgeName = id: "br-vlan${toString id}";
@@ -84,6 +94,7 @@ in
     mkHost
     mkHosts
     bridgeName
+    collectReverseProxyRoutes
     reverseProxyRoutes
     ;