alexion/dotfiles
Archived
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(reverse-proxy): use route registry

Browse Source
This commit was merged in pull request #61.
This commit is contained in:
alexion
2026-08-23 23:44:22 -04:00
parent c267a2ec5c
commit 45c6d01b1f
10 changed files with 328 additions and 338 deletions
Download Patch File Download Diff File Expand all files Collapse all files

261
flake.nix
View File

@@ -193,20 +193,33 @@
reverse-proxy-basic-route =
let
routeHost = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.address.test.budget = "10.23.20.42";
registry.route.test.budget = {
domain = "budget.alexion.dev";
port = 5006;
};
system.stateVersion = "26.11";
}
];
};
registry = self.lib.registry.collect { hosts.test = routeHost; };
testConfig =
(lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
specialArgs = {
my = self.lib;
inherit registry;
};
modules = [
./modules/reverse-proxy.nix
{
modules.reverse-proxy = {
enable = true;
routes."budget.alexion.dev" = {
path = "/";
backend = "http://10.23.20.42:5006";
};
};
modules.reverse-proxy.enable = true;
}
];
}).config;
@@ -224,21 +237,22 @@
reverse-proxy-actualbudget-guest-route =
let
testConfig = self.nixosConfigurations.pikachu.config;
route = testConfig.modules.reverse-proxy.routes.actualbudget;
route = testConfig.registry.route.pikachu.actualbudget;
vhost = testConfig.containers.reverse-proxy.config.services.nginx.virtualHosts."budget.alexion.dev";
in
pkgs.runCommand "reverse-proxy-actualbudget-guest-route-check" { } ''
${
lib.optionalString (
!(
route.host == "budget.alexion.dev"
&& route.backend == null
&& route.endpoint == "pikachu-actualbudget"
route.domain == "budget.alexion.dev"
&& route.port == 5006
&& route.tls
&& route.aliases == [ ]
&& route.path == "/"
&& !route.websockets
&& !(route ? backend)
&& !(route ? path)
&& !(route ? scheme)
&& !(route ? aliases)
&& !(route ? tls)
&& !(route ? websockets)
&& !(route ? enable)
&& vhost.locations."/".proxyPass == "http://10.23.20.42:5006"
)
) "exit 1"
@@ -313,7 +327,6 @@
inputs.sops-nix.nixosModules.sops
self.lib.registry.module
./modules/network.nix
./modules/reverse-proxy.nix
(self.lib.guest { name = "copyparty"; })
{
networking.hostName = "pikachu";
@@ -361,34 +374,46 @@
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
./modules/reverse-proxy.nix
self.lib.registry.module
{
modules.reverse-proxy.routes.app = {
host = "worker.alexion.dev";
backend = "http://10.23.20.126:3923";
registry.address.routeHost.app = "10.23.20.126";
registry.route.routeHost.app = {
domain = "worker.alexion.dev";
port = 3923;
};
system.stateVersion = "26.11";
}
];
};
endpoints = self.lib.networkEndpoints.collectFleetEndpoints {
pikachu = self.nixosConfigurations.pikachu;
registry = self.lib.registry.collect {
hosts = {
inherit routeHost;
pikachu = self.nixosConfigurations.pikachu;
};
};
fleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes {
inherit routeHost;
pikachu = self.nixosConfigurations.pikachu;
} endpoints;
testConfig =
(self.nixosConfigurations.pikachu.extendModules {
specialArgs.reverseProxyFleetRoutes = fleetRoutes;
(lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
my = self.lib;
inherit registry;
};
modules = [
./modules/reverse-proxy.nix
{
modules.reverse-proxy.enable = true;
}
];
}).config;
vhosts = testConfig.containers.reverse-proxy.config.services.nginx.virtualHosts;
vhosts = testConfig.services.nginx.virtualHosts;
in
pkgs.runCommand "reverse-proxy-fleet-routes-check" { } ''
${
lib.optionalString (
!(
fleetRoutes ? routeHost-app
&& fleetRoutes ? pikachu-actualbudget
registry.route ? routeHost
&& registry.route.routeHost ? app
&& registry.route.pikachu ? actualbudget
&& vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
&& vhosts."budget.alexion.dev".locations."/".proxyPass == "http://10.23.20.42:5006"
&& vhosts."files.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
@@ -398,9 +423,9 @@
touch $out
'';
reverse-proxy-endpoint-backends =
reverse-proxy-address-backends =
let
endpointHost =
workerHost =
lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
@@ -408,22 +433,11 @@
self.lib.registry.module
{
registry.address.worker.self = "10.23.50.146";
system.stateVersion = "26.11";
}
];
};
routeHost =
lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
./modules/reverse-proxy.nix
{
modules.reverse-proxy.routes.app = {
host = "worker.alexion.dev";
endpoint = "worker";
registry.route.worker.self = {
domain = "worker.alexion.dev";
port = 8080;
};
system.stateVersion = "26.11";
}
];
};
@@ -435,7 +449,6 @@
inputs.sops-nix.nixosModules.sops
self.lib.registry.module
./modules/network.nix
./modules/reverse-proxy.nix
(self.lib.guest { name = "files"; })
{
networking.hostName = "pikachu";
@@ -446,44 +459,47 @@
address = "10.23.20.126";
reverseProxy = {
enable = true;
host = "files.alexion.dev";
port = 3923;
route = {
domain = "files.alexion.dev";
port = 3923;
};
};
};
system.stateVersion = "26.11";
}
];
};
endpoints = self.lib.networkEndpoints.collectFleetEndpoints {
worker = endpointHost;
pikachu = guestRouteHost;
registry = self.lib.registry.collect {
hosts = {
worker = workerHost;
pikachu = guestRouteHost;
};
};
fleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes {
inherit routeHost;
pikachu = guestRouteHost;
} endpoints;
testConfig =
(lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
specialArgs = {
my = self.lib;
inherit registry;
};
modules = [
./modules/reverse-proxy.nix
{
modules.reverse-proxy = {
enable = true;
routes = fleetRoutes;
};
modules.reverse-proxy.enable = true;
}
];
}).config;
vhosts = testConfig.services.nginx.virtualHosts;
workerCompositeEntry = registry.join "worker" "self";
in
pkgs.runCommand "reverse-proxy-endpoint-backends-check" { } ''
pkgs.runCommand "reverse-proxy-address-backends-check" { } ''
${
lib.optionalString (
!(
vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.50.146:8080"
&& fleetRoutes."pikachu-files".endpoint == "pikachu-files"
workerCompositeEntry.address == "10.23.50.146"
&& workerCompositeEntry.route.domain == "worker.alexion.dev"
&& vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.50.146:8080"
&& registry.route.pikachu.files.port == 3923
&& vhosts."files.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
)
) "exit 1"
@@ -491,34 +507,95 @@
touch $out
'';
reverse-proxy-secondary-path-requires-root =
reverse-proxy-route-requires-address =
let
testConfig =
(lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
./modules/reverse-proxy.nix
{
modules.reverse-proxy = {
enable = true;
routes.raichu-files = {
host = "files.alexion.dev";
path = "/raichu";
backend = "http://10.23.20.10:3923";
};
};
}
];
}).config;
hasFailedRootAssertion = lib.any (
assertion:
assertion.assertion == false
&& assertion.message == "modules.reverse-proxy.routes for files.alexion.dev must include a primary / route."
) testConfig.assertions;
routeHost = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.route.raichu.files = {
domain = "files.alexion.dev";
port = 3923;
};
system.stateVersion = "26.11";
}
];
};
registry = self.lib.registry.collect { hosts.raichu = routeHost; };
testConfig = lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
my = self.lib;
inherit registry;
};
modules = [
./modules/reverse-proxy.nix
{
modules.reverse-proxy.enable = true;
system.stateVersion = "26.11";
}
];
};
result = builtins.tryEval (builtins.deepSeq testConfig.config.services.nginx.virtualHosts true);
in
pkgs.runCommand "reverse-proxy-secondary-path-requires-root-check" { } ''
${lib.optionalString (!hasFailedRootAssertion) "exit 1"}
pkgs.runCommand "reverse-proxy-route-requires-address-check" { } ''
${lib.optionalString result.success "exit 1"}
touch $out
'';
reverse-proxy-duplicate-domain-fails =
let
pikachu = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.address.pikachu.copyparty = "10.23.20.126";
registry.route.pikachu.copyparty = {
domain = "files.alexion.dev";
port = 3923;
};
system.stateVersion = "26.11";
}
];
};
raichu = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.address.raichu.files = "10.23.20.10";
registry.route.raichu.files = {
domain = "files.alexion.dev";
port = 3923;
};
system.stateVersion = "26.11";
}
];
};
registry = self.lib.registry.collect { hosts = { inherit pikachu raichu; }; };
testConfig = lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
my = self.lib;
inherit registry;
};
modules = [
./modules/reverse-proxy.nix
{
modules.reverse-proxy.enable = true;
system.stateVersion = "26.11";
}
];
};
result = builtins.tryEval (builtins.deepSeq testConfig.config.services.nginx.virtualHosts true);
in
pkgs.runCommand "reverse-proxy-duplicate-domain-fails-check" { } ''
${lib.optionalString result.success "exit 1"}
touch $out
'';
};