modules/nixos/clicks/services/nginx/tailscaleAuth/default.nix

# SPDX-FileCopyrightText: 2024 Clicks Codes
#
# SPDX-License-Identifier: GPL-3.0-only

{ lib, config, ... }:
let
  cfg = config.clicks.services.tailscaleAuth;
in
{
  options.clicks.services.tailscaleAuth = {
    enable = lib.mkEnableOption "Enable tailscaleAuth for Nginx";
    expectedTailnet = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      description = "The tailnet to expect when authenticating";
      default =  null;
    };
    hosts = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      description = "A list of hosts to put behind tailscale auth";
      default = [];
    };
  };
  config = lib.mkIf cfg.enable {
    assertions = [
      {
        assertion = cfg.expectedTailnet == null || lib.clicks.strings.endsWith ".ts.net" cfg.expectedTailnet;
        message = "Your expected tailnet must be an official *.ts.net tailnet, headscale is not supported";
      }
    ];

    services.nginx.tailscaleAuth = {
      enable = true;
      expectedTailnet = lib.modules.mkIf (cfg.expectedTailnet != null) cfg.expectedTailnet;

      virtualHosts = cfg.hosts;
    };
  };
}