refactor(nginx): ssl preread

modules/nixos/nginx/preread.nix

@@ -0,0 +1,103 @@
+let
+  serverModule = {config, nixosConfig, name, gensokyo-zone, lib, ...}: let
+    inherit (gensokyo-zone.lib) mkAlmostOptionDefault;
+    inherit (lib.options) mkOption mkEnableOption;
+    inherit (lib.modules) mkIf mkBefore mkOptionDefault;
+    inherit (lib.attrsets) mapAttrsToList;
+    inherit (lib.lists) optional;
+    inherit (lib.strings) concatStringsSep replaceStrings;
+    cfg = config.ssl.preread;
+    inherit (nixosConfig.services) nginx;
+  in {
+    options.ssl.preread = with lib.types; {
+      enable = mkEnableOption "ngx_stream_ssl_preread_module";
+      upstream = mkOption {
+        type = str;
+        default = "$preread_" + replaceStrings [ "'" ] [ "_" ] name;
+      };
+      upstreams = mkOption {
+        type = nullOr (attrsOf str);
+      };
+      streamConfig = mkOption {
+        type = lines;
+      };
+    };
+    config = let
+      inherit (nginx.stream) upstreams;
+      mkUpstream = host: upstream: "${host} ${upstreams.${upstream}.name};";
+      upstreams' = removeAttrs cfg.upstreams [ "default" ];
+      upstreamLines = mapAttrsToList mkUpstream upstreams'
+      ++ optional (cfg.upstreams ? default) (mkUpstream "default" cfg.upstreams.default);
+    in {
+      ssl.preread = {
+        streamConfig = mkIf (cfg.upstreams != null) ''
+          map $ssl_preread_server_name ${cfg.upstream} {
+            hostnames;
+            ${concatStringsSep "\n  " upstreamLines}
+          }
+        '';
+      };
+      proxy = mkIf cfg.enable {
+        ssl.enable = false;
+        upstream = mkAlmostOptionDefault cfg.upstream;
+      };
+      streamConfig = mkIf cfg.enable "ssl_preread on;";
+      serverBlock = mkIf cfg.enable (mkOptionDefault (mkBefore cfg.streamConfig));
+    };
+  };
+in {config, gensokyo-zone, lib, ...}: let
+  inherit (gensokyo-zone.lib) mkAlmostOptionDefault;
+  inherit (lib.options) mkOption mkEnableOption;
+  inherit (lib.modules) mkIf mkDefault mkOptionDefault;
+  cfg = config.services.nginx.ssl.preread;
+in {
+  options.services.nginx = with lib.types; {
+    ssl.preread = {
+      enable = mkEnableOption "ssl preread";
+      listenPort = mkOption {
+        type = port;
+        default = 444;
+      };
+      serverPort = mkOption {
+        type = port;
+        default = 443;
+      };
+      serverName = mkOption {
+        type = str;
+        default = "preread'https";
+      };
+      upstreamName = mkOption {
+        type = str;
+        default = "preread'nginx";
+      };
+    };
+    stream.servers = mkOption {
+      type = attrsOf (submoduleWith {
+        modules = [serverModule];
+        shorthandOnlyDefinesConfig = false;
+      });
+    };
+  };
+  config = {
+    services.nginx = {
+      defaultSSLListenPort = mkIf cfg.enable cfg.listenPort;
+      stream = {
+        upstreams.${cfg.upstreamName} = mkIf cfg.enable {
+          ssl.enable = true;
+          servers.access = {
+            addr = mkDefault "localhost";
+            port = mkOptionDefault cfg.listenPort;
+          };
+        };
+        servers.${cfg.serverName} = {
+          enable = mkIf (!cfg.enable) (mkAlmostOptionDefault false);
+          listen.https.port = cfg.serverPort;
+          ssl.preread = {
+            enable = true;
+            upstreams.default = mkOptionDefault cfg.upstreamName;
+          };
+        };
+      };
+    };
+  };
+}

modules/nixos/nginx/proxy.nix

@@ -93,6 +93,8 @@ let
       url = parseUrl config.proxyPass;
       upstream = nginx.upstreams'.${cfg.upstream};
       upstreamServer = upstream.servers.${upstream.defaultServerName};
+      dynamicUpstream = hasPrefix "$" cfg.upstream;
+      hasUpstream = cfg.upstream != null && !dynamicUpstream && upstream.defaultServerName != null;
       recommendedHeaders = {
         Host = if cfg.host == null then xvars.get.proxy_hostport else cfg.host;
         Referer = xvars.get.referer;
@@ -209,11 +211,11 @@ let
             mapNullable (_: url.path) config.proxyPass
           );
           host = mkOptionDefault (
-            if cfg.upstream != null then assert url.host == upstream.name; upstreamServer.addr
+            if hasUpstream then assert url.host == upstream.name; upstreamServer.addr
             else mapNullable (_: url.host) config.proxyPass
           );
           port = mkOptionDefault (
-            if cfg.upstream != null && url.port == null then assert url.host == upstream.name; upstreamServer.port
+            if hasUpstream && url.port == null then assert url.host == upstream.name; upstreamServer.port
             else mapNullable (_: url.port) config.proxyPass
           );
         };

modules/nixos/nginx/stream.nix

@@ -25,9 +25,6 @@
         type = lines;
         internal = true;
       };
-      ssl = {
-        preread.enable = mkEnableOption "ngx_stream_ssl_preread_module";
-      };
       proxy = {
         ssl = {
           enable = mkEnableOption "ssl upstream";
@@ -41,12 +38,8 @@
     };
 
     config = {
-      proxy.ssl.enable = mkIf config.ssl.preread.enable false;
       streamConfig = mkMerge [
         config.extraConfig
-        (mkIf config.ssl.preread.enable
-          "ssl_preread on;"
-        )
         (mkIf config.proxy.ssl.enable
           "proxy_ssl on;"
         )

modules/nixos/nginx/upstream.nix

@@ -204,6 +204,7 @@ let
     inherit (gensokyo-zone.lib) mkAlmostOptionDefault;
     inherit (lib.options) mkOption;
     inherit (lib.modules) mkIf;
+    inherit (lib.strings) hasPrefix;
     inherit (nixosConfig.services) nginx;
   in {
     options = with lib.types; {
@@ -217,12 +218,15 @@ let
 
     config = let
       proxyUpstream = nginx.stream.upstreams.${config.proxy.upstream};
+      dynamicUpstream = hasPrefix "$" config.proxy.upstream;
+      hasUpstream = config.proxy.upstream != null && !dynamicUpstream;
+      proxyPass =
+        if dynamicUpstream then config.proxy.upstream
+        else assert proxyUpstream.enable; proxyUpstream.name;
     in {
       proxy = {
-        url = mkIf (config.proxy.upstream != null) (mkAlmostOptionDefault (assert proxyUpstream.enable;
-          proxyUpstream.name
-        ));
-        ssl.enable = mkIf (config.proxy.upstream != null && proxyUpstream.ssl.enable) (mkAlmostOptionDefault true);
+        url = mkIf (config.proxy.upstream != null) (mkAlmostOptionDefault proxyPass);
+        ssl.enable = mkIf (hasUpstream && proxyUpstream.ssl.enable) (mkAlmostOptionDefault true);
       };
     };
   };
@@ -240,20 +244,27 @@ let
   locationModule = {config, nixosConfig, virtualHost, gensokyo-zone, lib, ...}: let
     inherit (gensokyo-zone.lib) mkAlmostOptionDefault;
     inherit (lib.modules) mkIf mkOptionDefault;
+    inherit (lib.strings) hasPrefix;
     inherit (nixosConfig.services) nginx;
   in {
     imports = [ proxyUpstreamModule ];
 
     config = let
       proxyUpstream = nginx.upstreams'.${config.proxy.upstream};
-      proxyScheme = if proxyUpstream.ssl.enable then "https" else "http";
+      proxyScheme = if config.proxy.ssl.enabled then "https" else "http";
+      dynamicUpstream = hasPrefix "$" config.proxy.upstream;
+      hasUpstream = config.proxy.upstream != null && !dynamicUpstream;
+      proxyHost =
+        if dynamicUpstream then config.proxy.upstream
+        else assert proxyUpstream.enable; proxyUpstream.name;
     in {
       proxy = {
         upstream = mkOptionDefault virtualHost.proxy.upstream;
         enable = mkIf (config.proxy.upstream != null && virtualHost.proxy.upstream == null) true;
-        url = mkIf (config.proxy.upstream != null) (mkAlmostOptionDefault (assert proxyUpstream.enable;
-          "${proxyScheme}://${proxyUpstream.name}"
-        ));
+        url = mkIf (config.proxy.upstream != null) (mkAlmostOptionDefault
+          "${proxyScheme}://${proxyHost}"
+        );
+        ssl.enabled = mkAlmostOptionDefault (if hasUpstream then proxyUpstream.ssl.enable else false);
       };
     };
   };