From 2f8d666060f20d35730309945be4f0c9acce0cae Mon Sep 17 00:00:00 2001
From: Yisroel Baum <yisroel.d.baum@gmail.com>
Date: Mon, 17 Aug 2026 23:50:57 +0300
Subject: [PATCH] test frontend redirect hosts

---
 nix/checks/module-eval.nix | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/nix/checks/module-eval.nix b/nix/checks/module-eval.nix
index f9f2a97..b1f0dc4 100644
--- a/nix/checks/module-eval.nix
+++ b/nix/checks/module-eval.nix
@@ -23,7 +23,10 @@ let
               borgPassphrase = "/run/secrets/borg-passphrase";
               borgPrivateKey = "/run/secrets/borg-private-key";
             };
-            frontend.hostName = "www.example.test";
+            frontend = {
+              hostName = "example.test";
+              redirectHostNames = [ "www.example.test" ];
+            };
             backend = {
               hostName = "api.example.test";
               environmentFile = "/run/secrets/rabbi-gerzi.env";
@@ -35,6 +38,10 @@ let
 
   evaluatedHostName = evaluatedConfig.services.rabbi-gerzi.backend.hostName;
 
+  evaluatedFrontendHostName = evaluatedConfig.services.rabbi-gerzi.frontend.hostName;
+
+  frontendRedirectVirtualHost = evaluatedConfig.services.nginx.virtualHosts."www.example.test";
+
   backendVirtualHost = evaluatedConfig.services.nginx.virtualHosts.${evaluatedHostName};
 
   phpOptions = evaluatedConfig.services.phpfpm.pools.rabbi-gerzi.phpOptions;
@@ -66,6 +73,18 @@ let
       passed = lib.hasInfix expectedNginxClientMaxBodySize backendVirtualHost.extraConfig;
       message = "nginx client_max_body_size is not 6m";
     }
+    {
+      passed = frontendRedirectVirtualHost.globalRedirect == evaluatedFrontendHostName;
+      message = "frontend redirect does not target the canonical host";
+    }
+    {
+      passed = frontendRedirectVirtualHost.forceSSL;
+      message = "frontend redirect does not force HTTPS";
+    }
+    {
+      passed = frontendRedirectVirtualHost.enableACME;
+      message = "frontend redirect does not enable ACME";
+    }
     {
       passed = backupConfig.repo == "ssh://mgjjruz9@mgjjruz9.repo.borgbase.com/./repo";
       message = "Borg repository is not the Rabbi Gerzi repository";