prototype copyparty reverse proxy config

flake.nix

@@ -118,79 +118,6 @@
             touch $out
           '';
 
-          copyparty-reverse-proxy-trust-config =
-            let
-              pikachuConfig = self.nixosConfigurations.pikachu.config;
-              serviceConfig = pikachuConfig.containers.copyparty.config.systemd.services.copyparty.serviceConfig;
-              configScript = builtins.readFile serviceConfig.ExecStartPre;
-              plainConfig =
-                (lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    ./modules/services/copyparty.nix
-                    {
-                      modules.services.copyparty = {
-                        enable = true;
-                        passwordFile = "/run/password";
-                        volumes."/" = {
-                          path = "/srv/files";
-                          access.A = [ "alexion" ];
-                        };
-                      };
-                    }
-                  ];
-                }).config;
-              plainScript = builtins.readFile plainConfig.systemd.services.copyparty.serviceConfig.ExecStartPre;
-            in
-            pkgs.runCommand "copyparty-reverse-proxy-trust-config-check" { } ''
-              ${
-                lib.optionalString (
-                  !(
-                    lib.hasInfix "  rproxy: 1" configScript
-                    && lib.hasInfix "  xff-hdr: x-forwarded-for" configScript
-                    && lib.hasInfix "  xff-src: 10.23.20.109/32" configScript
-                    && !(lib.hasInfix "rproxy" plainScript)
-                    && !(lib.hasInfix "xff-hdr" plainScript)
-                    && !(lib.hasInfix "xff-src" plainScript)
-                  )
-                ) "exit 1"
-              }
-              touch $out
-            '';
-
-          copyparty-reverse-proxy-trust-requires-source =
-            let
-              testConfig =
-                (lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    ./modules/services/copyparty.nix
-                    {
-                      modules.services.copyparty = {
-                        enable = true;
-                        passwordFile = "/run/password";
-                        reverseProxy.enable = true;
-                        volumes."/" = {
-                          path = "/srv/files";
-                          access.A = [ "alexion" ];
-                        };
-                      };
-                    }
-                  ];
-                }).config;
-              hasFailedTrustedSourcesAssertion = lib.any (
-                assertion:
-                assertion.assertion == false
-                && assertion.message == "modules.services.copyparty.reverseProxy.trustedSources must name at least one trusted proxy source when reverse-proxy support is enabled."
-              ) testConfig.assertions;
-            in
-            pkgs.runCommand "copyparty-reverse-proxy-trust-requires-source-check" { } ''
-              ${lib.optionalString (!hasFailedTrustedSourcesAssertion) "exit 1"}
-              touch $out
-            '';
-
           reverse-proxy-basic-route =
             let
               testConfig =
@@ -223,209 +150,24 @@
 
           reverse-proxy-actualbudget-guest-route =
             let
-              testConfig = self.nixosConfigurations.pikachu.config;
+              testConfig =
+                (self.nixosConfigurations.pikachu.extendModules {
+                  modules = [
+                    {
+                      guests.actualbudget.reverseProxy = {
+                        enable = true;
+                        host = "budget.alexion.dev";
+                        backend = "http://10.23.20.42:5006";
+                      };
+                    }
+                  ];
+                }).config;
               route = testConfig.modules.reverse-proxy.routes.actualbudget;
-              vhost = testConfig.containers.reverse-proxy.config.services.nginx.virtualHosts."budget.alexion.dev";
             in
             pkgs.runCommand "reverse-proxy-actualbudget-guest-route-check" { } ''
               ${
                 lib.optionalString (
-                  !(
-                    route.host == "budget.alexion.dev"
-                    && route.backend == null
-                    && route.endpoint == "pikachu-actualbudget"
-                    && route.port == 5006
-                    && route.tls
-                    && route.aliases == [ ]
-                    && route.path == "/"
-                    && !route.websockets
-                    && vhost.locations."/".proxyPass == "http://10.23.20.42:5006"
-                  )
-                ) "exit 1"
-              }
-              touch $out
-            '';
-
-          network-endpoint-fleet-registry =
-            let
-              hostEndpointConfig =
-                lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    ./modules/network.nix
-                    {
-                      modules.network.endpoint.address = "10.23.50.146";
-                    }
-                  ];
-                };
-              guestEndpointConfig =
-                lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    inputs.sops-nix.nixosModules.sops
-                    ./modules/network.nix
-                    ./modules/reverse-proxy.nix
-                    (self.lib.guest { name = "copyparty"; })
-                    {
-                      modules.network.vlans = [ 20 ];
-                      guests.copyparty = {
-                        enable = true;
-                        vlan = 20;
-                        endpoint.address = "10.23.20.126";
-                      };
-                    }
-                  ];
-                };
-              fleetEndpoints = self.lib.networkEndpoints.collectFleetEndpoints {
-                neogaia = hostEndpointConfig;
-                pikachu = guestEndpointConfig;
-              };
-            in
-            pkgs.runCommand "network-endpoint-fleet-registry-check" { } ''
-              ${
-                lib.optionalString (
-                  !(
-                    fleetEndpoints.neogaia.address == "10.23.50.146"
-                    && fleetEndpoints."pikachu-copyparty".address == "10.23.20.126"
-                    && !(fleetEndpoints ? pikachu)
-                    && guestEndpointConfig.config.containers.copyparty.config.systemd.network.networks."20-eth0".networkConfig.DHCP == "yes"
-                  )
-                ) "exit 1"
-              }
-              touch $out
-            '';
-
-          reverse-proxy-fleet-routes =
-            let
-              routeHost =
-                lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    ./modules/reverse-proxy.nix
-                    {
-                      modules.reverse-proxy.routes.app = {
-                        host = "worker.alexion.dev";
-                        backend = "http://10.23.20.126:3923";
-                      };
-                    }
-                  ];
-                };
-              endpoints = self.lib.networkEndpoints.collectFleetEndpoints {
-                pikachu = self.nixosConfigurations.pikachu;
-              };
-              fleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes {
-                inherit routeHost;
-                pikachu = self.nixosConfigurations.pikachu;
-              } endpoints;
-              testConfig =
-                (self.nixosConfigurations.pikachu.extendModules {
-                  specialArgs.reverseProxyFleetRoutes = fleetRoutes;
-                }).config;
-              vhosts = testConfig.containers.reverse-proxy.config.services.nginx.virtualHosts;
-            in
-            pkgs.runCommand "reverse-proxy-fleet-routes-check" { } ''
-              ${
-                lib.optionalString (
-                  !(
-                    fleetRoutes ? routeHost-app
-                    && fleetRoutes ? pikachu-actualbudget
-                    && vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
-                    && vhosts."budget.alexion.dev".locations."/".proxyPass == "http://10.23.20.42:5006"
-                    && vhosts."files.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
-                  )
-                ) "exit 1"
-              }
-              touch $out
-            '';
-
-          reverse-proxy-endpoint-backends =
-            let
-              endpointHost =
-                lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    ./modules/network.nix
-                    {
-                      modules.network.endpoint.address = "10.23.50.146";
-                    }
-                  ];
-                };
-              routeHost =
-                lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    ./modules/reverse-proxy.nix
-                    {
-                      modules.reverse-proxy.routes.app = {
-                        host = "worker.alexion.dev";
-                        endpoint = "worker";
-                        port = 8080;
-                      };
-                    }
-                  ];
-                };
-              guestRouteHost =
-                lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    inputs.sops-nix.nixosModules.sops
-                    ./modules/network.nix
-                    ./modules/reverse-proxy.nix
-                    (self.lib.guest { name = "files"; })
-                    {
-                      networking.hostName = "pikachu";
-                      modules.network.vlans = [ 20 ];
-                      guests.files = {
-                        enable = true;
-                        vlan = 20;
-                        endpoint.address = "10.23.20.126";
-                        reverseProxy = {
-                          enable = true;
-                          host = "files.alexion.dev";
-                          port = 3923;
-                        };
-                      };
-                    }
-                  ];
-                };
-              endpoints = self.lib.networkEndpoints.collectFleetEndpoints {
-                worker = endpointHost;
-                pikachu = guestRouteHost;
-              };
-              fleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes {
-                inherit routeHost;
-                pikachu = guestRouteHost;
-              } endpoints;
-              testConfig =
-                (lib.nixosSystem {
-                  system = "x86_64-linux";
-                  specialArgs.my = self.lib;
-                  modules = [
-                    ./modules/reverse-proxy.nix
-                    {
-                      modules.reverse-proxy = {
-                        enable = true;
-                        routes = fleetRoutes;
-                      };
-                    }
-                  ];
-                }).config;
-              vhosts = testConfig.services.nginx.virtualHosts;
-            in
-            pkgs.runCommand "reverse-proxy-endpoint-backends-check" { } ''
-              ${
-                lib.optionalString (
-                  !(
-                    vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.50.146:8080"
-                    && fleetRoutes."pikachu-files".endpoint == "pikachu-files"
-                    && vhosts."files.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
-                  )
+                  !(route.host == "budget.alexion.dev" && route.backend == "http://10.23.20.42:5006")
                 ) "exit 1"
               }
               touch $out

guests/reverse-proxy.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   my,
-  reverseProxyFleetRoutes ? config.modules.reverse-proxy.routes,
   ...
 }:
 let
@@ -35,7 +34,7 @@ in
       interior = {
         modules.reverse-proxy = {
           enable = true;
-          routes = reverseProxyFleetRoutes // legacyRoutes;
+          routes = config.modules.reverse-proxy.routes // legacyRoutes;
         };
 
         networking.firewall.allowedTCPPorts = [ 2022 ];

hosts/pikachu/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 # pikachu — AZW ME Pro server.
 # Disk layout is in ./disk.nix.
 # `fileSystems` for the root disk are derived from it.
@@ -79,11 +79,10 @@
     vlan = 20;
     mac = "BC:24:11:C1:CD:28";
     dataPath = "/pikachu/data/actualbudget";
-    endpoint.address = "10.23.20.42";
     reverseProxy = {
       enable = true;
       host = "budget.alexion.dev";
-      port = 5006;
+      backend = "http://10.23.20.42:5006";
     };
   };
 
@@ -91,7 +90,6 @@
     enable = true;
     vlan = 20;
     mac = "02:98:64:5a:07:4f";
-    endpoint.address = "10.23.20.109";
   };
 
   guests.copyparty = {
@@ -99,12 +97,11 @@
     vlan = 20;
     mac = "02:23:20:39:23:01";
     statePath = "/pikachu/data/copyparty";
-    endpoint.address = "10.23.20.126";
     reverseProxy = {
       enable = true;
       host = "files.alexion.dev";
-      port = 3923;
-      trustedSources = [ "${config.guests.reverse-proxy.endpoint.address}/32" ];
+      backend = "http://10.23.20.126:3923";
+      trustedSources = [ "10.23.20.109/32" ];
     };
     volumes = {
       "/inbox" = {

lib/default.nix

@@ -14,7 +14,6 @@ let
     ;
 
   serviceIdentityRegistry = import ./service-identities.nix { inherit lib; };
-  networkEndpoints = import ./network-endpoints.nix { inherit lib; };
   reverseProxyRoutes = import ./reverse-proxy-routes.nix { inherit lib; };
 
   collectNixFiles =
@@ -34,15 +33,10 @@ let
       ) (builtins.readDir dir)
     );
 
-  specialArgs =
-    let
-      networkFleetEndpoints = self.lib.networkEndpoints.collectFleetEndpoints self.nixosConfigurations;
-    in
-    {
-      inherit inputs networkFleetEndpoints self;
-      my = self.lib;
-      reverseProxyFleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes self.nixosConfigurations networkFleetEndpoints;
-    };
+  specialArgs = {
+    inherit inputs;
+    my = self.lib;
+  };
 
   bridgeName = id: "br-vlan${toString id}";
 
@@ -90,7 +84,6 @@ in
     mkHost
     mkHosts
     bridgeName
-    networkEndpoints
     reverseProxyRoutes
     ;
 

lib/guests.nix

@@ -131,18 +131,6 @@ let
             guest takes its address by DHCP, keeping IP management at the router.
           '';
         };
-        endpoint = {
-          address = lib.mkOption {
-            type = lib.types.nullOr lib.types.str;
-            default = null;
-            example = "10.23.20.126";
-            description = ''
-              Expected IP address assigned outside NixOS for this guest's
-              network endpoint. Left null, this guest contributes no endpoint to
-              the fleet endpoint registry.
-            '';
-          };
-        };
         reverseProxy = reverseProxyRoutes.mkRouteOptions {
           subject = "guest route";
           enableDefault = false;
@@ -290,17 +278,8 @@ let
       config = lib.mkIf cfg.enable {
         sops.secrets = lib.genAttrs cfg.secrets (_: { });
 
-        modules.network.endpoints.${machineName} = lib.mkIf (cfg.endpoint.address != null) {
-          inherit (cfg.endpoint) address;
-        };
-
         modules.reverse-proxy.routes.${machineName} = lib.mkIf cfg.reverseProxy.enable (
-          reverseProxyRoutes.routeFields (
-            cfg.reverseProxy
-            // lib.optionalAttrs (cfg.reverseProxy.backend == null && cfg.reverseProxy.endpoint == null) {
-              endpoint = "${config.networking.hostName}-${machineName}";
-            }
-          )
+          reverseProxyRoutes.routeFields cfg.reverseProxy
         );
 
         assertions = [

lib/network-endpoints.nix

@@ -1,42 +0,0 @@
-{ lib }:
-let
-  endpointOptions = {
-    address = lib.mkOption {
-      type = lib.types.str;
-      example = "10.23.20.126";
-      description = "Expected IP address assigned outside NixOS for this network endpoint.";
-    };
-  };
-
-  endpointType = lib.types.submodule {
-    options = endpointOptions;
-  };
-
-  endpointFields = endpoint: {
-    inherit (endpoint) address;
-  };
-
-  collectFleetEndpoints =
-    hosts:
-    lib.concatMapAttrs (
-      hostName: host:
-      let
-        cfg = host.config.modules.network;
-        hostEndpoint = lib.optionalAttrs (cfg.endpoint.address != null) {
-          ${hostName} = endpointFields cfg.endpoint;
-        };
-        guestEndpoints = lib.mapAttrs' (
-          endpointName: endpoint: lib.nameValuePair "${hostName}-${endpointName}" (endpointFields endpoint)
-        ) cfg.endpoints;
-      in
-      hostEndpoint // guestEndpoints
-    ) hosts;
-in
-{
-  inherit
-    collectFleetEndpoints
-    endpointFields
-    endpointOptions
-    endpointType
-    ;
-}

lib/reverse-proxy-routes.nix

@@ -37,28 +37,8 @@ let
       };
 
       backend = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        description = "Full HTTP backend URL that receives proxied traffic.";
-      };
-
-      endpoint = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        description = "Fleet network endpoint key used to derive the backend URL.";
-      };
-
-      port = lib.mkOption {
-        type = lib.types.nullOr (lib.types.ints.between 1 65535);
-        default = null;
-        example = 3923;
-        description = "Backend TCP port used with the fleet network endpoint.";
-      };
-
-      scheme = lib.mkOption {
         type = lib.types.str;
-        default = "http";
-        description = "Backend URL scheme used with the fleet network endpoint.";
+        description = "Full HTTP backend URL that receives proxied traffic.";
       };
 
       tls = lib.mkOption {
@@ -80,45 +60,13 @@ let
       aliases
       path
       backend
-      endpoint
-      port
-      scheme
       tls
       websockets
       ;
   };
-
-  endpointBackend = endpoints: route:
-    let
-      endpoint = endpoints.${route.endpoint} or (
-        throw "Unknown reverse-proxy endpoint `${route.endpoint}`. Known endpoints: ${lib.concatStringsSep ", " (lib.attrNames endpoints)}"
-      );
-    in
-    "${route.scheme}://${endpoint.address}:${toString route.port}";
-
-  resolvedRouteFields = endpoints: route:
-    let
-      routeWithBackend =
-        if route.backend != null then
-          route
-        else if route.endpoint != null && route.port != null then
-          route // { backend = endpointBackend endpoints route; }
-        else
-          throw "Reverse-proxy route `${route.host}${route.path}` needs either backend or endpoint plus port.";
-    in
-    routeFields routeWithBackend;
-
-  collectFleetRoutes =
-    hosts: endpoints:
-    lib.concatMapAttrs (
-      hostName: host:
-      lib.mapAttrs' (
-        routeName: route: lib.nameValuePair "${hostName}-${routeName}" (resolvedRouteFields endpoints route)
-      ) host.config.modules.reverse-proxy.routes
-    ) hosts;
 in
 {
-  inherit collectFleetRoutes mkRouteOptions resolvedRouteFields routeFields;
+  inherit mkRouteOptions routeFields;
 
   routeType = lib.types.submodule (
     { name, ... }:

modules/network.nix

@@ -43,28 +43,6 @@ in
       '';
     };
 
-    endpoint = {
-      address = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        example = "10.23.50.146";
-        description = ''
-          Expected IP address assigned outside NixOS for this host's network
-          endpoint. Left null, this host contributes no host endpoint to the
-          fleet endpoint registry.
-        '';
-      };
-    };
-
-    endpoints = lib.mkOption {
-      type = lib.types.attrsOf my.networkEndpoints.endpointType;
-      default = { };
-      description = ''
-        Network endpoint declarations contributed by placed workloads on this
-        host, keyed by their local stable endpoint name.
-      '';
-    };
-
     management = {
       vlan = lib.mkOption {
         type = lib.types.nullOr (lib.types.ints.between 1 4094);

modules/reverse-proxy.nix

@@ -20,8 +20,6 @@ let
     in
     lib.length paths != lib.length (lib.unique paths);
 
-  hasUnresolvedBackend = route: route.backend == null;
-
   mkLocation = route: {
     proxyPass = route.backend;
     proxyWebsockets = route.websockets;
@@ -36,9 +34,7 @@ let
       enableACME = rootRoute.tls;
       serverAliases = rootRoute.aliases;
       locations = lib.listToAttrs (
-        map (route: lib.nameValuePair route.path (mkLocation route)) (
-          builtins.filter (route: route.backend != null) routes
-        )
+        map (route: lib.nameValuePair route.path (mkLocation route)) routes
       );
     };
 in
@@ -62,11 +58,7 @@ in
       ++ lib.mapAttrsToList (host: routes: {
         assertion = !hasDuplicatePaths routes;
         message = "modules.reverse-proxy.routes for ${host} must not declare the same path more than once.";
-      }) routesByHost
-      ++ map (route: {
-        assertion = !hasUnresolvedBackend route;
-        message = "modules.reverse-proxy.routes for ${route.host}${route.path} must resolve to a backend URL before actualization.";
-      }) (builtins.filter hasUnresolvedBackend (lib.attrValues enabledRoutes));
+      }) routesByHost;
 
     networking.firewall.allowedTCPPorts = [
       80
@@ -80,13 +72,6 @@ in
 
     services.nginx = {
       enable = true;
-      commonHttpConfig = ''
-        server {
-          listen 0.0.0.0:443 ssl default_server;
-          listen [::0]:443 ssl default_server;
-          ssl_reject_handshake on;
-        }
-      '';
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       recommendedProxySettings = true;

prototypes/copyparty-rproxy-config/run.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+bold=$'\033[1m'
+reset=$'\033[0m'
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+mkdir -p "$tmp/state" "$tmp/root"
+
+printf '%sQuestion%s\n' "$bold" "$reset"
+printf 'Does the proposed copyparty reverse-proxy config parse and make a proxied HTTPS-origin login-shaped request pass the CORS gate?\n\n'
+
+printf '%sNix-generated config fragment%s\n' "$bold" "$reset"
+config_script=$(nix eval --raw '.#nixosConfigurations.pikachu.config.containers.copyparty.config.systemd.services.copyparty.serviceConfig.ExecStartPre')
+awk '/\[global\]/{show=1} /\[accounts\]/{show=0} show {print}' "$config_script" | grep -E 'rproxy|xff-hdr|xff-src' || true
+
+pkg=$(nix eval --raw '.#nixosConfigurations.pikachu.config.containers.copyparty.config.modules.services.copyparty.package.outPath')
+
+make_conf() {
+  local file=$1 port=$2 rproxy=$3
+  cat > "$file" <<EOF
+[global]
+  i: 127.0.0.1
+  p: $port
+  usernames
+  http-only
+  no-crt
+  no-thumb
+  no-snap
+  no-rescan
+  ses-db: $tmp/state/sessions-$port.db
+  chpw-db: $tmp/state/chpw-$port.json
+  shr-db: $tmp/state/shares-$port.db
+$rproxy
+
+[accounts]
+  alexion: prototype-password
+
+[/]
+  $tmp/root
+  accs:
+    A: alexion
+EOF
+}
+
+start_server() {
+  local conf=$1 log=$2
+  "$pkg/bin/copyparty" -c "$conf" >"$log" 2>&1 &
+  local pid=$!
+  for _ in {1..50}; do
+    if grep -q 'listening' "$log"; then
+      printf '%s' "$pid"
+      return 0
+    fi
+    sleep 0.1
+  done
+  cat "$log"
+  kill "$pid" 2>/dev/null || true
+  return 1
+}
+
+request() {
+  local label=$1 port=$2 host=$3 proto=${4:-}
+  local headers="$tmp/$label.headers"
+  local body="$tmp/$label.body"
+  local args=(
+    -sS
+    -D "$headers"
+    -o "$body"
+    -X POST
+    -H "Host: $host"
+    -H 'Origin: https://files.alexion.dev'
+    -H 'X-Forwarded-For: 10.23.20.20'
+  )
+  if [[ -n "$proto" ]]; then
+    args+=(-H "X-Forwarded-Proto: $proto")
+  fi
+  curl "${args[@]}" "http://127.0.0.1:$port/?pw=alexion:prototype-password" >/dev/null || true
+  printf '%-24s %s %s\n' "$label" "$(head -1 "$headers" | tr -d '\r')" "$(head -1 "$body")"
+}
+
+rproxy_config='  rproxy: 1
+  xff-hdr: x-forwarded-for
+  xff-src: 127.0.0.1/32'
+make_conf "$tmp/rproxy.conf" 39234 "$rproxy_config"
+pid=$(start_server "$tmp/rproxy.conf" "$tmp/rproxy.log")
+
+printf '\n%sCORS gate probes%s\n' "$bold" "$reset"
+request with-forwarded-https 39234 files.alexion.dev https
+request missing-forwarded-proto 39234 files.alexion.dev
+request wrong-forwarded-host 39234 '10.23.20.126:3923' https
+
+kill "$pid" 2>/dev/null || true
+wait "$pid" 2>/dev/null || true
+
+printf '\n%sRelevant server log%s\n' "$bold" "$reset"
+grep -E 'cors-reject|POST|http405|got proxied request|untrusted source|listening' "$tmp/rproxy.log" || true
+
+printf '\n%sNginx proxy headers%s\n' "$bold" "$reset"
+toplevel=$(nix build --print-out-paths '.#nixosConfigurations.pikachu.config.containers.reverse-proxy.config.system.build.toplevel' --no-link)
+nginx_conf=$(readlink -f "$toplevel/etc/nginx/nginx.conf")
+include_path=$(awk '/server_name files\.alexion\.dev;/{in_server=1} in_server && /include .*recommended-proxy_set_header/{print $2; exit}' "$nginx_conf" | tr -d ';')
+cat "$include_path"