Commit 702d947

@@ -0,0 +1,10 @@
+{den, ...}: {
+  den.hosts.hyacine.settings = {
+  };
+
+  den.aspects.hyacine = {
+    includes = [
+      den.aspects.services.webserver
+    ];
+  };
+}

@@ -0,0 +1,68 @@
+{
+  den,
+  lib,
+  ...
+}: {
+  den.aspects.services.webserver.caddy = {
+    includes = [
+      den.aspects.services.webserver.caddy.reverse-proxy-collector
+    ];
+
+    persist = {
+      directories = [
+        {
+          directory = "/var/lib/caddy";
+          user = "caddy";
+          group = "caddy";
+        }
+      ];
+    };
+
+    nixos = {
+      services.caddy = {
+        enable = true;
+        # Reload Caddy instead of restarting it when configuration file changes.
+        enableReload = true;
+
+        globalConfig = ''
+          http_port   80
+          https_port  443
+        '';
+      };
+
+      networking.firewall.allowedTCPPorts = [80 443];
+    };
+  };
+
+  den.aspects.services.webserver.caddy.reverse-proxy-collector = {host, ...}: {
+    nixos = {reverseProxy, ...}: let
+      _processedRP = lib.mergeAttrsList (map (
+          r:
+            lib.mapAttrs (
+              _: conf:
+                {
+                  address =
+                    if (r.source.host.name == host.name)
+                    then "127.0.0.1"
+                    else abort "Not implemented for outside host webserver";
+                  https = false;
+                }
+                // conf
+            )
+            r.value
+        )
+        reverseProxy);
+
+      virtualHosts =
+        lib.mapAttrs (domain: conf: {
+          extraConfig = ''
+            encode zstd gzip
+            reverse_proxy http${lib.optionalString conf.https "s"}://${conf.address}:${toString conf.port}
+          '';
+        })
+        _processedRP;
+    in {
+      services.caddy.virtualHosts = virtualHosts;
+    };
+  };
+}

@@ -0,0 +1,9 @@
+{den, ...}: {
+  den.aspects.services.webserver = {
+    includes = [
+      den.aspects.services.webserver.reverse-proxy-processer
+
+      den.aspects.services.webserver.caddy
+    ];
+  };
+}

@@ -0,0 +1,25 @@
+{den, ...}: {
+  # Example:
+  #
+  # reverseProxy = {
+  #   "example.com" = {
+  #     # address = "127.0.0.1"
+  #     port = 12345;
+  #     https = true;
+  #     aliases = ["example.org"];
+  #   }
+  # }
+  den.quirks.reverseProxy.description = "Reverse proxies for web services";
+
+  den.aspects.services.webserver.reverse-proxy-processer = {
+    __isPolicy = true;
+    fn = _: let
+      inherit (den.lib.policy) pipe;
+    in [
+      (pipe.from den.quirks.reverseProxy [
+        (pipe.collect ({host, ...}: true))
+        pipe.withProvenance
+      ])
+    ];
+  };
+}