From c50e9968511b9a72625ada01e6b50d328ea76f58 Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Mon, 17 Aug 2026 14:32:08 -0400
Subject: [PATCH] feat(reverse-proxy): collect fleet routes

---
 flake.nix                    | 40 ++++++++++++++++++++++++++++++++++++
 guests/reverse-proxy.nix     |  3 ++-
 lib/default.nix              |  3 ++-
 lib/reverse-proxy-routes.nix | 11 +++++++++-
 4 files changed, 54 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index 4740f82..bdadfbe 100644
--- a/flake.nix
+++ b/flake.nix
@@ -173,6 +173,46 @@
               touch $out
             '';
 
+          reverse-proxy-fleet-routes =
+            let
+              routeHost =
+                lib.nixosSystem {
+                  system = "x86_64-linux";
+                  specialArgs.my = self.lib;
+                  modules = [
+                    ./modules/reverse-proxy.nix
+                    {
+                      modules.reverse-proxy.routes.app = {
+                        host = "worker.alexion.dev";
+                        backend = "http://10.23.20.126:3923";
+                      };
+                    }
+                  ];
+                };
+              fleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes {
+                inherit routeHost;
+                pikachu = self.nixosConfigurations.pikachu;
+              };
+              testConfig =
+                (self.nixosConfigurations.pikachu.extendModules {
+                  specialArgs.reverseProxyFleetRoutes = fleetRoutes;
+                }).config;
+              vhosts = testConfig.containers.reverse-proxy.config.services.nginx.virtualHosts;
+            in
+            pkgs.runCommand "reverse-proxy-fleet-routes-check" { } ''
+              ${
+                lib.optionalString (
+                  !(
+                    fleetRoutes ? routeHost-app
+                    && fleetRoutes ? pikachu-actualbudget
+                    && vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
+                    && vhosts."budget.alexion.dev".locations."/".proxyPass == "http://10.23.20.42:5006"
+                  )
+                ) "exit 1"
+              }
+              touch $out
+            '';
+
           reverse-proxy-secondary-path-requires-root =
             let
               testConfig =
diff --git a/guests/reverse-proxy.nix b/guests/reverse-proxy.nix
index 2db77ed..03d7cca 100644
--- a/guests/reverse-proxy.nix
+++ b/guests/reverse-proxy.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   my,
+  reverseProxyFleetRoutes ? config.modules.reverse-proxy.routes,
   ...
 }:
 let
@@ -34,7 +35,7 @@ in
       interior = {
         modules.reverse-proxy = {
           enable = true;
-          routes = config.modules.reverse-proxy.routes // legacyRoutes;
+          routes = reverseProxyFleetRoutes // legacyRoutes;
         };
 
         networking.firewall.allowedTCPPorts = [ 2022 ];
diff --git a/lib/default.nix b/lib/default.nix
index 22be36d..88d4e3b 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -34,8 +34,9 @@ let
     );
 
   specialArgs = {
-    inherit inputs;
+    inherit inputs self;
     my = self.lib;
+    reverseProxyFleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes self.nixosConfigurations;
   };
 
   bridgeName = id: "br-vlan${toString id}";
diff --git a/lib/reverse-proxy-routes.nix b/lib/reverse-proxy-routes.nix
index 920f85c..d6de9a1 100644
--- a/lib/reverse-proxy-routes.nix
+++ b/lib/reverse-proxy-routes.nix
@@ -64,9 +64,18 @@ let
       websockets
       ;
   };
+
+  collectFleetRoutes =
+    hosts:
+    lib.concatMapAttrs (
+      hostName: host:
+      lib.mapAttrs' (
+        routeName: route: lib.nameValuePair "${hostName}-${routeName}" route
+      ) host.config.modules.reverse-proxy.routes
+    ) hosts;
 in
 {
-  inherit mkRouteOptions routeFields;
+  inherit collectFleetRoutes mkRouteOptions routeFields;
 
   routeType = lib.types.submodule (
     { name, ... }: