alexion/dotfiles
Archived
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(registry): validate unique addresses and routes

Browse Source
This commit is contained in:
alexion
2026-08-25 22:10:09 -04:00
parent f45aa44ead
commit 959a9f98ae
4 changed files with 109 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files

127
flake.nix
View File

@@ -403,6 +403,38 @@
touch $out
'';
address-registry-duplicate-value-fails =
let
alpha = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.address.alpha.self = "10.23.50.146";
system.stateVersion = "26.11";
}
];
};
beta = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.address.beta.self = "10.23.50.146";
system.stateVersion = "26.11";
}
];
};
registry = self.lib.registry.collect { hosts = { inherit alpha beta; }; };
result = builtins.tryEval (builtins.deepSeq registry.address true);
in
pkgs.runCommand "address-registry-duplicate-value-fails-check" { } ''
${lib.optionalString result.success "exit 1"}
touch $out
'';
ssh-targets-use-address-registry =
let
neogaiaConfig = self.nixosConfigurations.neogaia.config;
@@ -434,7 +466,7 @@
modules = [
self.lib.registry.module
{
registry.address.routeHost.app = "10.23.20.126";
registry.address.routeHost.app = "10.23.20.127";
registry.route.routeHost.app = {
domain = "worker.alexion.dev";
port = 3923;
@@ -472,7 +504,7 @@
registry.route ? routeHost
&& registry.route.routeHost ? app
&& registry.route.pikachu ? actualbudget
&& vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
&& vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.20.127:3923"
&& vhosts."budget.alexion.dev".locations."/".proxyPass == "http://10.23.20.42:5006"
&& vhosts."files.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
)
@@ -481,6 +513,44 @@
touch $out
'';
route-registry-duplicate-domain-fails =
let
alpha = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.route.alpha.app = {
domain = "files.alexion.dev";
port = 3923;
};
system.stateVersion = "26.11";
}
];
};
beta = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.route.beta.app = {
domain = "files.alexion.dev";
port = 3923;
};
system.stateVersion = "26.11";
}
];
};
registry = self.lib.registry.collect { hosts = { inherit alpha beta; }; };
result = builtins.tryEval (builtins.deepSeq registry.route true);
in
pkgs.runCommand "route-registry-duplicate-domain-fails-check" { } ''
${lib.optionalString result.success "exit 1"}
touch $out
'';
reverse-proxy-address-backends =
let
workerHost =
@@ -603,59 +673,6 @@
touch $out
'';
reverse-proxy-duplicate-domain-fails =
let
pikachu = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.address.pikachu.copyparty = "10.23.20.126";
registry.route.pikachu.copyparty = {
domain = "files.alexion.dev";
port = 3923;
};
system.stateVersion = "26.11";
}
];
};
raichu = lib.nixosSystem {
system = "x86_64-linux";
specialArgs.my = self.lib;
modules = [
self.lib.registry.module
{
registry.address.raichu.files = "10.23.20.10";
registry.route.raichu.files = {
domain = "files.alexion.dev";
port = 3923;
};
system.stateVersion = "26.11";
}
];
};
registry = self.lib.registry.collect { hosts = { inherit pikachu raichu; }; };
testConfig = lib.nixosSystem {
system = "x86_64-linux";
specialArgs = {
my = self.lib;
inherit registry;
};
modules = [
./modules/reverse-proxy.nix
{
modules.reverse-proxy.enable = true;
system.stateVersion = "26.11";
}
];
};
result = builtins.tryEval (builtins.deepSeq testConfig.config.services.nginx.virtualHosts true);
in
pkgs.runCommand "reverse-proxy-duplicate-domain-fails-check" { } ''
${lib.optionalString result.success "exit 1"}
touch $out
'';
};
};
}

29
lib/registry.nix
View File

@@ -16,6 +16,7 @@ let
nameValuePair
removeSuffix
types
unique
;
assertionType = types.submodule {
@@ -36,6 +37,30 @@ let
};
};
validators = {
uniqueValue =
{
value,
message,
}:
entries:
let
values = map value entries;
in
[
{
assertion = builtins.length (unique values) == builtins.length values;
inherit message;
}
];
};
registryLib = lib // {
registry = (lib.registry or { }) // {
inherit validators;
};
};
registryDefinitionModule = {
options = {
type = mkOption {
@@ -76,7 +101,7 @@ let
mkRegistry = path:
let
evaluated = lib.evalModules {
specialArgs = { inherit lib; };
specialArgs.lib = registryLib;
modules = [
registryDefinitionModule
path
@@ -189,7 +214,7 @@ let
};
in
{
inherit definitions;
inherit definitions validators;
module = {
options.registry = mapAttrs (_name: registry: registryOption registry) definitions;

5
registry/address.nix
View File

@@ -1,4 +1,9 @@
{ lib, ... }:
{
type = lib.types.str;
validate = lib.registry.validators.uniqueValue {
value = entry: entry.value;
message = "Address registry values must be unique.";
};
}

5
registry/route.nix
View File

@@ -1,5 +1,10 @@
{ lib, ... }:
{
validate = lib.registry.validators.uniqueValue {
value = entry: entry.value.domain;
message = "Route domains must be unique.";
};
type = lib.types.submodule {
options = {
domain = lib.mkOption {