fix(reverse-proxy): reject unmatched HTTPS hosts

flake.nix

@@ -189,7 +189,7 @@
                     }
                   ];
                 };
-              fleetRoutes = self.lib.collectReverseProxyRoutes {
+              fleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes {
                 inherit routeHost;
                 pikachu = self.nixosConfigurations.pikachu;
               };

lib/default.nix

@@ -16,15 +16,6 @@ let
   serviceIdentityRegistry = import ./service-identities.nix { inherit lib; };
   reverseProxyRoutes = import ./reverse-proxy-routes.nix { inherit lib; };
 
-  collectReverseProxyRoutes =
-    hosts:
-    lib.concatMapAttrs (
-      hostName: host:
-      lib.mapAttrs' (
-        routeName: route: lib.nameValuePair "${hostName}-${routeName}" route
-      ) host.config.modules.reverse-proxy.routes
-    ) hosts;
-
   collectNixFiles =
     dir:
     flatten (
@@ -45,7 +36,7 @@ let
   specialArgs = {
     inherit inputs self;
     my = self.lib;
-    reverseProxyFleetRoutes = self.lib.collectReverseProxyRoutes self.nixosConfigurations;
+    reverseProxyFleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes self.nixosConfigurations;
   };
 
   bridgeName = id: "br-vlan${toString id}";
@@ -94,7 +85,6 @@ in
     mkHost
     mkHosts
     bridgeName
-    collectReverseProxyRoutes
     reverseProxyRoutes
     ;
 

lib/reverse-proxy-routes.nix

@@ -64,9 +64,18 @@ let
       websockets
       ;
   };
+
+  collectFleetRoutes =
+    hosts:
+    lib.concatMapAttrs (
+      hostName: host:
+      lib.mapAttrs' (
+        routeName: route: lib.nameValuePair "${hostName}-${routeName}" route
+      ) host.config.modules.reverse-proxy.routes
+    ) hosts;
 in
 {
-  inherit mkRouteOptions routeFields;
+  inherit collectFleetRoutes mkRouteOptions routeFields;
 
   routeType = lib.types.submodule (
     { name, ... }: