fix(reverse-proxy): reject unmatched HTTPS hosts

flake.nix

@@ -189,7 +189,7 @@
                     }
                   ];
                 };
-              fleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes {
+              fleetRoutes = self.lib.collectReverseProxyRoutes {
                 inherit routeHost;
                 pikachu = self.nixosConfigurations.pikachu;
               };

lib/default.nix

@@ -16,6 +16,15 @@ let
   serviceIdentityRegistry = import ./service-identities.nix { inherit lib; };
   reverseProxyRoutes = import ./reverse-proxy-routes.nix { inherit lib; };
 
+  collectReverseProxyRoutes =
+    hosts:
+    lib.concatMapAttrs (
+      hostName: host:
+      lib.mapAttrs' (
+        routeName: route: lib.nameValuePair "${hostName}-${routeName}" route
+      ) host.config.modules.reverse-proxy.routes
+    ) hosts;
+
   collectNixFiles =
     dir:
     flatten (
@@ -36,7 +45,7 @@ let
   specialArgs = {
     inherit inputs self;
     my = self.lib;
-    reverseProxyFleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes self.nixosConfigurations;
+    reverseProxyFleetRoutes = self.lib.collectReverseProxyRoutes self.nixosConfigurations;
   };
 
   bridgeName = id: "br-vlan${toString id}";
@@ -85,6 +94,7 @@ in
     mkHost
     mkHosts
     bridgeName
+    collectReverseProxyRoutes
     reverseProxyRoutes
     ;
 

lib/reverse-proxy-routes.nix

@@ -64,18 +64,9 @@ let
       websockets
       ;
   };
-
-  collectFleetRoutes =
-    hosts:
-    lib.concatMapAttrs (
-      hostName: host:
-      lib.mapAttrs' (
-        routeName: route: lib.nameValuePair "${hostName}-${routeName}" route
-      ) host.config.modules.reverse-proxy.routes
-    ) hosts;
 in
 {
-  inherit collectFleetRoutes mkRouteOptions routeFields;
+  inherit mkRouteOptions routeFields;
 
   routeType = lib.types.submodule (
     { name, ... }: