feat(reverse-proxy): add Pikachu reverse proxy guest

guests/actualbudget.nix

@@ -22,6 +22,44 @@ in
   ];
 
   options.guests.actualbudget = {
+    reverseProxy = {
+      enable = lib.mkEnableOption "the public reverse-proxy route for the Actual Budget guest";
+
+      host = lib.mkOption {
+        type = lib.types.str;
+        description = "Primary hostname served by the Actual Budget route.";
+      };
+
+      aliases = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Additional hostnames served by the Actual Budget route.";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        default = "/";
+        description = "URL path prefix proxied to Actual Budget.";
+      };
+
+      backend = lib.mkOption {
+        type = lib.types.str;
+        description = "Full HTTP backend URL for the Actual Budget service.";
+      };
+
+      tls = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to serve Actual Budget with ACME-backed TLS.";
+      };
+
+      websockets = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable websocket proxying for Actual Budget.";
+      };
+    };
+
     dataPath = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -30,21 +68,35 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.dataPath != null;
-        message = "guests.actualbudget.dataPath must point at the host directory that stores Actual Budget data.";
-      }
-    ];
-
-    guests.actualbudget = {
-      mounts.${dataDir}.hostPath = cfg.dataPath;
-      limits = {
-        memory = lib.mkDefault "2G";
-        cpu = lib.mkDefault "200%";
-        tasksMax = lib.mkDefault 512;
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && cfg.reverseProxy.enable) {
+      modules.reverse-proxy.routes.actualbudget = {
+        inherit (cfg.reverseProxy)
+          host
+          aliases
+          path
+          backend
+          tls
+          websockets
+          ;
       };
-    };
-  };
+    })
+    (lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = cfg.dataPath != null;
+          message = "guests.actualbudget.dataPath must point at the host directory that stores Actual Budget data.";
+        }
+      ];
+
+      guests.actualbudget = {
+        mounts.${dataDir}.hostPath = cfg.dataPath;
+        limits = {
+          memory = lib.mkDefault "2G";
+          cpu = lib.mkDefault "200%";
+          tasksMax = lib.mkDefault 512;
+        };
+      };
+    })
+  ];
 }

guests/reverse-proxy.nix

@@ -0,0 +1,51 @@
+{
+  config,
+  lib,
+  my,
+  ...
+}:
+let
+  legacyBackend = "http://10.23.20.32";
+  legacyHosts = [
+    "games.alexion.dev"
+    "git.alexion.dev"
+    "music.alexion.dev"
+    "photos.alexion.dev"
+    "plex.alexion.dev"
+    "servers.alexion.dev"
+    "todo.alexion.dev"
+    "wings.alexion.dev"
+  ];
+  legacyRoutes = lib.listToAttrs (
+    map (host: {
+      name = "legacy-${lib.replaceStrings [ "." ] [ "-" ] host}";
+      value = {
+        inherit host;
+        backend = legacyBackend;
+      };
+    }) legacyHosts
+  );
+in
+{
+  imports = [
+    (my.guest {
+      name = "reverse-proxy";
+      interior = {
+        modules.reverse-proxy = {
+          enable = true;
+          routes = config.modules.reverse-proxy.routes // legacyRoutes;
+        };
+      };
+    })
+  ];
+
+  config = lib.mkIf config.guests.reverse-proxy.enable {
+    guests.reverse-proxy = {
+      limits = {
+        memory = lib.mkDefault "1G";
+        cpu = lib.mkDefault "100%";
+        tasksMax = lib.mkDefault 256;
+      };
+    };
+  };
+}