1{den, ...}: {
 2  # Example:
 3  #
 4  # reverseProxy = {
 5  #   "example.com" = {
 6  #     port = 12345;
 7  #     # https = true;         # optional: proxy HTTPS site
 8  #     # path = "/app";        # optional: only proxy requests under this path prefix
 9  #     # stripPath = true;     # optional (default true): strip path prefix before forwarding
10  #     # upstream = "/api";    # optional: prepend a path to the backend URL
11  #   }
12  # }
13  den.quirks.reverseProxy.description = "Reverse proxies for web services";
14
15  # Mirrors reverseProxy, but these services are never exposed publicly: caddy
16  # only serves them on the owning host's own Tailscale interface, and headscale
17  # publishes them as Magic DNS records pointing at that host's Tailscale IP.
18  den.quirks.reverseProxyTailscale.description = "Reverse proxies for web services exposed only over Tailscale";
19
20  den.aspects.services.webserver.reverse-proxy-processer = {
21    __isPolicy = true;
22    fn = _: let
23      inherit (den.lib.policy) pipe;
24    in [
25      (pipe.from den.quirks.reverseProxy [
26        (pipe.collect ({host, ...}: true))
27        pipe.withProvenance
28      ])
29    ];
30  };
31
32  den.aspects.services.webserver.reverse-proxy-tailscale-processer = {
33    __isPolicy = true;
34    fn = _: let
35      inherit (den.lib.policy) pipe;
36    in [
37      (pipe.from den.quirks.reverseProxyTailscale [
38        (pipe.collect ({host, ...}: true))
39        pipe.withProvenance
40      ])
41    ];
42  };
43}