# Internal reverse proxy for the gateway: Caddy terminates TLS for
# <service>.<site><siteId>.<proxy.domain> (e.g. omada.cnx1.cnx.network) and
# forwards to backends by their internal address. The cert is a real Let's
# Encrypt wildcard (*.<site><siteId>.<domain>) obtained via ACME DNS-01
# against proxy.acme.nameserver with a gateway-scoped TSIG key, so browsers
# trust it without any CA install; the names only *resolve* internally —
# Blocky answers them with the router's LAN address, the public zone never
# carries them.
#
# The TSIG secret is the shared dns-acme-<hostname>-secret generator
# (acme-secret.nix, declared here via default.nix); the nameserver machine
# must declare the same generator and load the key (this fleet: ns1).
{ settings }:
{ config, lib, ... }:
let
  cfg = settings;
  hostname = config.networking.hostName;
  tsigKey = "acme_${lib.replaceStrings [ "-" ] [ "_" ] hostname}";
  certName = "${cfg.site}${toString cfg.siteId}.${cfg.proxy.domain}";
  nameserver = "${cfg.proxy.acme.nameserver}:53";
in
{
  config = lib.mkIf cfg.proxy.enable {
    assertions = [
      {
        assertion = lib.all (v: cfg.vlans ? ${v}) cfg.proxy.allowVlans;
        message = "router: proxy.allowVlans must name VLANs defined in vlans.";
      }
    ];

    # Render the shared per-gateway TSIG secret into a lego rfc2136 env file,
    # scoped on the nameserver to _acme-challenge.<site><siteId> TXT records.
    clan.core.vars.generators."dns-acme-${hostname}-rfc2136" = {
      files."rfc2136.env".secret = true; # root-owned; systemd reads it as root
      dependencies = [ "dns-acme-${hostname}-secret" ];
      script = ''
        printf 'RFC2136_NAMESERVER=${nameserver}\nRFC2136_TSIG_ALGORITHM=hmac-sha256.\nRFC2136_TSIG_KEY=${tsigKey}\nRFC2136_TSIG_SECRET=%s\n' \
          "$(cat "$in"/dns-acme-${hostname}-secret/secret)" > "$out"/rfc2136.env
      '';
    };

    security.acme = {
      acceptTerms = true;
      defaults.email = cfg.proxy.acme.email;
      # One wildcard for every proxied service; DNS-01, so issuance works
      # behind PPPoE with no inbound reachability at all.
      certs.${certName} = {
        domain = "*.${certName}";
        dnsProvider = "rfc2136";
        environmentFile =
          config.clan.core.vars.generators."dns-acme-${hostname}-rfc2136".files."rfc2136.env".path;
        # Only that nameserver accepts this key's UPDATE; check propagation
        # against it directly rather than a public resolver.
        dnsResolver = nameserver;
        # Caddy reads the cert from explicit file paths (tls directive below),
        # so it won't notice a renewal on its own.
        reloadServices = [ "caddy.service" ];
      };
    };

    # The lego-issued cert is owned group=acme; Caddy needs to read the key.
    users.users.caddy.extraGroups = [ "acme" ];

    # The explicit `tls cert key` points Caddy at the wildcard cert and disables
    # its automatic ACME, so no extra issuance happens.
    services.caddy = {
      enable = true;
      virtualHosts = lib.mapAttrs' (
        name: svc:
        lib.nameValuePair "${name}.${certName}" {
          extraConfig = ''
            tls /var/lib/acme/${certName}/cert.pem /var/lib/acme/${certName}/key.pem
            ${
              if svc.insecureSkipVerify then
                ''
                  reverse_proxy ${svc.backend} {
                    transport http {
                      tls_insecure_skip_verify
                    }
                  }''
              else
                "reverse_proxy ${svc.backend}"
            }
          '';
        }
      ) cfg.proxy.services;
    };

    # Blocky answers <anything>.<site><siteId>.cnx.network (customDNS covers
    # subdomains) with the router's LAN address — clients on any allowed VLAN
    # reach that address through the router's input path.
    services.blocky.settings.customDNS.mapping.${certName} = cfg.vlans.lan.address;

    # 443 serves the proxy; 80 only carries Caddy's automatic HTTP->HTTPS
    # redirect. mgmt is already a trusted interface; listed anyway so shrinking
    # trustedInterfaces later doesn't silently break the proxy.
    networking.firewall.interfaces = lib.genAttrs (map (v: "vlan-${v}") cfg.proxy.allowVlans) (_: {
      allowedTCPPorts = [
        80
        443
      ];
    });
  };
}