feat(reverse-proxy): add Pikachu reverse proxy guest

modules/services/actualbudget.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.modules.services.actualbudget;
+  rp = cfg.reverseProxy;
 in
 {
   options.modules.services.actualbudget = {
@@ -40,23 +41,75 @@ in
       default = "storage";
       description = "Group account that owns Actual Budget's writable state.";
     };
-  };
 
-  config = lib.mkIf cfg.enable {
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      uid = cfg.uid;
-      group = cfg.group;
-    };
+    reverseProxy = {
+      enable = lib.mkEnableOption "the public reverse-proxy route for Actual Budget";
 
-    services.actual = {
-      enable = true;
-      openFirewall = true;
-      user = cfg.user;
-      group = cfg.group;
-      settings = {
-        inherit (cfg) port dataDir;
+      host = lib.mkOption {
+        type = lib.types.str;
+        description = "Primary hostname served by the Actual Budget route.";
+      };
+
+      aliases = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Additional hostnames served by the Actual Budget route.";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        default = "/";
+        description = "URL path prefix proxied to Actual Budget.";
+      };
+
+      backend = lib.mkOption {
+        type = lib.types.str;
+        description = "Full HTTP backend URL for the Actual Budget service.";
+      };
+
+      tls = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to serve Actual Budget with ACME-backed TLS.";
+      };
+
+      websockets = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable websocket proxying for Actual Budget.";
       };
     };
   };
+
+  config = lib.mkMerge [
+    (lib.mkIf rp.enable {
+      modules.reverse-proxy.routes.actualbudget = {
+        inherit (rp)
+          host
+          aliases
+          path
+          backend
+          tls
+          websockets
+          ;
+      };
+    })
+    (lib.mkIf cfg.enable {
+      users.users.${cfg.user} = {
+        isSystemUser = true;
+        uid = cfg.uid;
+        group = cfg.group;
+      };
+
+      services.actual = {
+        enable = true;
+        openFirewall = true;
+        user = cfg.user;
+        group = cfg.group;
+        settings = {
+          inherit (cfg) port dataDir;
+        };
+      };
+    })
+  ];
 }