flake.nix

@@ -173,6 +173,46 @@
               touch $out
             '';
 
+          reverse-proxy-fleet-routes =
+            let
+              routeHost =
+                lib.nixosSystem {
+                  system = "x86_64-linux";
+                  specialArgs.my = self.lib;
+                  modules = [
+                    ./modules/reverse-proxy.nix
+                    {
+                      modules.reverse-proxy.routes.app = {
+                        host = "worker.alexion.dev";
+                        backend = "http://10.23.20.126:3923";
+                      };
+                    }
+                  ];
+                };
+              fleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes {
+                inherit routeHost;
+                pikachu = self.nixosConfigurations.pikachu;
+              };
+              testConfig =
+                (self.nixosConfigurations.pikachu.extendModules {
+                  specialArgs.reverseProxyFleetRoutes = fleetRoutes;
+                }).config;
+              vhosts = testConfig.containers.reverse-proxy.config.services.nginx.virtualHosts;
+            in
+            pkgs.runCommand "reverse-proxy-fleet-routes-check" { } ''
+              ${
+                lib.optionalString (
+                  !(
+                    fleetRoutes ? routeHost-app
+                    && fleetRoutes ? pikachu-actualbudget
+                    && vhosts."worker.alexion.dev".locations."/".proxyPass == "http://10.23.20.126:3923"
+                    && vhosts."budget.alexion.dev".locations."/".proxyPass == "http://10.23.20.42:5006"
+                  )
+                ) "exit 1"
+              }
+              touch $out
+            '';
+
           reverse-proxy-secondary-path-requires-root =
             let
               testConfig =

guests/reverse-proxy.nix

@@ -2,6 +2,7 @@
   config,
   lib,
   my,
+  reverseProxyFleetRoutes ? config.modules.reverse-proxy.routes,
   ...
 }:
 let
@@ -34,7 +35,7 @@ in
       interior = {
         modules.reverse-proxy = {
           enable = true;
-          routes = config.modules.reverse-proxy.routes // legacyRoutes;
+          routes = reverseProxyFleetRoutes // legacyRoutes;
         };
 
         networking.firewall.allowedTCPPorts = [ 2022 ];

lib/default.nix

@@ -34,8 +34,9 @@ let
     );
 
   specialArgs = {
-    inherit inputs;
+    inherit inputs self;
     my = self.lib;
+    reverseProxyFleetRoutes = self.lib.reverseProxyRoutes.collectFleetRoutes self.nixosConfigurations;
   };
 
   bridgeName = id: "br-vlan${toString id}";

lib/reverse-proxy-routes.nix

@@ -64,9 +64,18 @@ let
       websockets
       ;
   };
+
+  collectFleetRoutes =
+    hosts:
+    lib.concatMapAttrs (
+      hostName: host:
+      lib.mapAttrs' (
+        routeName: route: lib.nameValuePair "${hostName}-${routeName}" route
+      ) host.config.modules.reverse-proxy.routes
+    ) hosts;
 in
 {
-  inherit mkRouteOptions routeFields;
+  inherit collectFleetRoutes mkRouteOptions routeFields;
 
   routeType = lib.types.submodule (
     { name, ... }:

modules/reverse-proxy.nix

@@ -72,6 +72,13 @@ in
 
     services.nginx = {
       enable = true;
+      commonHttpConfig = ''
+        server {
+          listen 0.0.0.0:443 ssl default_server;
+          listen [::0]:443 ssl default_server;
+          ssl_reject_handshake on;
+        }
+      '';
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       recommendedProxySettings = true;