ports test

modules/infra/cloudflared.nix

@@ -1,32 +1,34 @@
-{ den, ... }: let
-  tunnel_uuid = "4118935e-359b-4dd2-95bd-eb27f7b0c5bb";
+let
+  uuid   = "4118935e-359b-4dd2-95bd-eb27f7b0c5bb";
   domain = "bug.tools";
-  creds  = "/home/bug/.cloudflared/${tunnel_uuid}.json";
+  creds  = "/home/bug/.cloudflared/${uuid}.json";
+in {
+  den.aspects.cloudflared = {
+    nixos = { config, pkgs, lib, ... }: {
+      options.den.tunnels = lib.mkOption {
+        default     = [];
+        description = "Cloudflared tunnel subdomains, matched directly against portmap keys.";
+        type = lib.types.listOf lib.types.str;
+      };
 
-  tunnel = port: subdomain: { pkgs, ... }: {
-    environment = {
-      systemPackages = [ pkgs.cloudflared ];
+      config = {
+        environment.systemPackages = [ pkgs.cloudflared ];
+        environment.etc."cloudflared/${uuid}.json".source = creds;
 
-      etc."cloudflared/${tunnel_uuid}.json".source = creds;
-    };
+        services.cloudflared = {
+          enable = true;
 
-    services.cloudflared = {
-      enable = true;
+          tunnels.${uuid} = {
+            credentialsFile = "/etc/cloudflared/${uuid}.json";
+            default         = "http_status:404";
 
-      tunnels.${tunnel_uuid} = {
-        credentialsFile = "/etc/cloudflared/${tunnel_uuid}.json";
-        default = "http_status:404";
-
-        ingress = {
-          "${subdomain}.${domain}" = "http://127.0.0.1:${toString port}";
+            ingress = lib.listToAttrs (map (subdomain: {
+              name  = "${subdomain}.${domain}";
+              value = "http://127.0.0.1:${toString config.den.portmap.${subdomain}}";
+            }) config.den.tunnels);
+          };
         };
       };
     };
   };
-in {
-  den.aspects.tunnel = port: subdomain: den.lib.parametric {
-    includes = [
-      (_: { nixos = tunnel port subdomain; })
-    ];
-  };
-}
+}