virtual_host: Proxy websockets based on HTTP Upgrade header

This is more foregiving that trying to determine what paths are used for
websockets.

manifests/lib/reverse_proxy.pp

@@ -5,39 +5,34 @@ define nest::lib::reverse_proxy (
   Optional[Variant[String[1], Array[String[1]]]] $ip = undef,
   Optional[Integer] $port                            = undef,
   Boolean $ssl                                       = true,
-  Optional[String[1]] $websockets                    = undef,
-  Boolean $allow_encoded_slashes                     = false,
+  Boolean $encoded_slashes                           = false,
   Boolean $preserve_host                             = false,
+  Variant[Boolean, String] $websockets               = false,
   Hash[String[1], Any] $extra_params                 = {},
 ) {
-  if $websockets {
-    include '::apache::mod::proxy_wstunnel'
+  if $encoded_slashes {
+    $proxy_pass_keywords = ['nocanon']
+    $allow_encoded_slashes = on
   }
 
-  $proxy_pass_match = [
-    $websockets ? {
-      undef   => [],
-      default => {
-        'path'         => "^/(${websockets})$",
-        'url'          => "ws://${destination}/\$1",
-        'reverse_urls' => [],
-      },
-    },
+  $proxy_pass = [{
+    'path'     => '/',
+    'url'      => "http://${destination}/",
+    'keywords' => $proxy_pass_keywords,
+  }]
+
+  if $websockets {
+    include '::apache::mod::proxy_wstunnel'
 
-    $allow_encoded_slashes ? {
-      true    => {
-        'path'         => '^/(.*)$',
-        'url'          => "http://${destination}/\$1",
-        'keywords'     => ['nocanon'],
-        'reverse_urls' => [],
-      },
-      default => [],
-    },
-  ].flatten
+    $wsdestination = $websockets ? {
+      String  => $websockets,
+      default => $destination,
+    }
 
-  $vhost_allow_encoded_slashes = $allow_encoded_slashes ? {
-    true    => on,
-    default => undef,
+    $websocket_rewrites = [{
+      'rewrite_cond' => ['%{HTTP:Upgrade} =websocket [NC]'],
+      'rewrite_rule' => ["^/(.*)$ ws://${wsdestination}/\$1 [P,L]"],
+    }]
   }
 
   $certbot_exception = @(EOT)
@@ -56,10 +51,10 @@ define nest::lib::reverse_proxy (
     ssl           => $ssl,
     zfs_docroot   => false,
     extra_params  => {
-      'allow_encoded_slashes' => $vhost_allow_encoded_slashes,
+      'allow_encoded_slashes' => $allow_encoded_slashes,
+      'proxy_pass'            => $proxy_pass,
       'proxy_preserve_host'   => $preserve_host,
-      'proxy_pass_match'      => $proxy_pass_match,
-      'proxy_dest'            => "http://${destination}",
+      'rewrites'              => $websocket_rewrites,
       'custom_fragment'       => $certbot_exception,
     } + $extra_params,
   }

manifests/node/falcon.pp

@@ -106,10 +106,14 @@ class nest::node::falcon {
   $cpuset_param = "--cpuset-cpus ${cpuset}"
 
   Docker::Run {
-    dns              => '172.22.0.1',
-    dns_search       => 'nest',
-    extra_parameters => $cpuset_param,
-    service_provider => 'systemd',
+    dns                               => '172.22.0.1',
+    dns_search                        => 'nest',
+    extra_parameters                  => $cpuset_param,
+
+    # XXX: These should be added to site.pp after docker -> podman switch
+    docker_service                    => false,
+    restart_service_on_docker_refresh => false,
+    service_provider                  => 'systemd',
   }
 
   docker::run { 'nzbget':
@@ -196,7 +200,7 @@ class nest::node::falcon {
 
     'plex.nest':
       destination => 'localhost:32400',
-      websockets  => ':/websockets/.*',
+      websockets  => true,
     ;
 
     'radarr.nest':

manifests/service/gitlab.pp

@@ -68,9 +68,9 @@ class nest::service::gitlab (
     ;
 
     'gitlab.james.tl':
-      destination           => '172.18.0.2',
-      websockets            => '.*\.ws',
-      allow_encoded_slashes => true,
+      destination     => '172.18.0.2',
+      encoded_slashes => true,
+      websockets      => true,
     ;
 
     'registry.gitlab.james.tl':

manifests/service/gitlab_runner.pp

@@ -53,8 +53,8 @@ define nest::service::gitlab_runner (
       '/run/podman/podman.sock:/var/run/docker.sock',
       "/srv/gitlab-runner/${name}:/etc/gitlab-runner",
     ],
-    service_provider => 'systemd',
     depend_services  => ['podman.socket'],
+    docker_service   => 'podman.socket',
     require          => Exec["gitlab-runner-${name}-register"],
   }
 }