gateway: per-vhost public flag, private listen addresses, and IPv6 listeners

nix/module-eval/grafana.nix

@@ -91,6 +91,8 @@ let
     swarm.authelia.url = "https://auth.example.invalid";
     # Declares a vhost that binds its own `listen`, which the gateway refuses.
     gateway.vhosts."own-listen.t.local".listen = [ ];
+    # Asks to be private on a gateway with no private address to be private on.
+    gateway.vhosts."internal.t.local".public = false;
   };
 
   # Did ./host-modules/swarm-grafana.nix refuse this host, and for which of its
@@ -1081,6 +1083,16 @@ let
         && lib.hasInfix "own-listen.t.local.listen" a.message
       ) grafanaNoIdentity.assertions;
     }
+    {
+      # A private vhost with nowhere to listen would be silently unserved.
+      name = "a vhost with public = false is refused while there is no private address";
+      ok = lib.any (
+        a:
+        !a.assertion
+        && lib.hasInfix "privateListenAddresses is empty" a.message
+        && lib.hasInfix "internal.t.local" a.message
+      ) grafanaNoIdentity.assertions;
+    }
   ];
 in
 runGroup "grafana" cases