1{den, ...}: {
 2  # Example:
 3  #
 4  # reverseProxy = {
 5  #   "example.com" = {
 6  #     # address = "127.0.0.1"
 7  #     port = 12345;
 8  #     https = true;
 9  #     aliases = ["example.org"];
10  #   }
11  # }
12  den.quirks.reverseProxy.description = "Reverse proxies for web services";
13
14  # Mirrors reverseProxy, but these services are never exposed publicly: caddy
15  # only serves them on the owning host's own Tailscale interface, and headscale
16  # publishes them as Magic DNS records pointing at that host's Tailscale IP.
17  den.quirks.reverseProxyTailscale.description = "Reverse proxies for web services exposed only over Tailscale";
18
19  den.aspects.services.webserver.reverse-proxy-processer = {
20    __isPolicy = true;
21    fn = _: let
22      inherit (den.lib.policy) pipe;
23    in [
24      (pipe.from den.quirks.reverseProxy [
25        (pipe.collect ({host, ...}: true))
26        pipe.withProvenance
27      ])
28    ];
29  };
30
31  den.aspects.services.webserver.reverse-proxy-tailscale-processer = {
32    __isPolicy = true;
33    fn = _: let
34      inherit (den.lib.policy) pipe;
35    in [
36      (pipe.from den.quirks.reverseProxyTailscale [
37        (pipe.collect ({host, ...}: true))
38        pipe.withProvenance
39      ])
40    ];
41  };
42}