uuuuh

5 files changed, 83 insertions, 15 deletions

diff --git a/hosts/omega-relay/certs.nix b/hosts/omega-relay/certs.nix
new file mode 100644
index 0000000..affa18e
--- /dev/null
+++ b/hosts/omega-relay/certs.nix
@@ -0,0 +1,18 @@
+{pkgs, config, lib, ...}: 
+  let 
+    names = [
+      "moni.wilkuu.xyz"
+      "matrix.wilkuu.xyz"
+      "rss.wilkuu.xyz" 
+      "bulwark.wilkuu.xyz"
+      "uptime.wilkuu.xyz"
+      "bitwarden.wilkuu.xyz"
+      "wilkuu.xyz"
+    ];
+    in
+{
+  services.nginx.virtualHosts = lib.genAttrs names (name: {
+    enableACME = lib.mkForce false; 
+    useACMEHost = "wilkuu.xyz";
+  }); 
+} 
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 27cbf13..181add4 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -10,6 +10,7 @@
     ./disko.nix
     ./vm.nix
     ./hardware-configuration.nix
+    ./certs.nix
     ../../services/mysql.nix
     ../../services/vaultwarden.nix
     ../../services/uptimekuma.nix
@@ -53,7 +54,7 @@
       prometheus.enableExporters = true;
       desecDyn = {
         enable = true;
-        domains."wilkuu.dedyn.io" = {
+        domains."wilkuu.xyz" = {
           doWildcard = true;
           enableDDNS = true;
           enableACME = true;
@@ -174,18 +175,10 @@
           tryFiles = "$uri $uri/ =404";
         };
       };
-      virtualHosts."wilkuu.dedyn.io" = {
-        forceSSL = true;
-        useACMEHost = "wilkuu.dedyn.io";
-        root = "/srv/www/wilkuu.dedyn.io/";
-        locations."/" = {
-          index = "index.html";
-          tryFiles = "$uri $uri/ =404";
-        };
-      };
       virtualHosts."moni.wilkuu.xyz" = {
         forceSSL = true;
-        enableACME = true;
+        enableACME = false;
+        useACMEHost = "wilkuu.xyz";  
         locations."/" = {
           proxyPass = "http://192.168.88.5:3132";
           recommendedProxySettings = true;
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
index c276831..4bbc77a 100644
--- a/hosts/omega-relay/firewall.nix
+++ b/hosts/omega-relay/firewall.nix
@@ -79,10 +79,10 @@ in
             ];
             presharedKeyFile = config.sops.secrets."wg/home/chrono/PSK".path;
             publicKey = "rP5lJY6ea7BKX40edzqNMJbhfLkSlSwG1FipEufeflk=";
-            # endpoint       = "45.138.54.155:16556";
-            endpoint = "wilkuu.duckdns.org:16556";
+            endpoint       = "45.138.54.155:16556";
+            # endpoint = "wilkuu.duckdns.org:16556";
             name = "wg-home-chronosphere";
-
+            persistentKeepalive = 5;
           }
         ];
       };
diff --git a/hosts/tacitus/default.nix b/hosts/tacitus/default.nix
index f4a135c..50d5542 100644
--- a/hosts/tacitus/default.nix
+++ b/hosts/tacitus/default.nix
@@ -64,4 +64,61 @@
       PermitRootLogin = "no";
     };
   };
+  users.groups.mikrotik-exporter = { };
+  users.users.mikrotik-exporter = {
+    isSystemUser = true;
+    group = "mikrotik-exporter";
+  };
+
+  # TODO: "Make each device hold it's own password."
+  sops.secrets."prometheus/mikrotik/username" = {
+    owner = "mikrotik-exporter";
+    sopsFile = ../../secrets/tacitus/prometheus.yaml;
+  };
+  sops.secrets."prometheus/mikrotik/password" = {
+    owner = "mikrotik-exporter";
+    sopsFile = ../../secrets/tacitus/prometheus.yaml;
+  };
+
+  sops.templates."prometheus-mikrotik-config" = {
+    owner = "mikrotik-exporter";
+    content = lib.generators.toYAML {} {
+      devices = [
+        {
+          name = "chronosphere";
+          address = "192.168.88.1";
+          user = config.sops.placeholder."prometheus/mikrotik/username";
+          password = config.sops.placeholder."prometheus/mikrotik/password";
+        }
+        {
+          name = "geneticmutator";
+          address = "192.168.88.2";
+          user = config.sops.placeholder."prometheus/mikrotik/username";
+          password = config.sops.placeholder."prometheus/mikrotik/password";
+        }
+
+      ];
+      features = {
+        dhcp = true;
+        dhcpv6 = true; 
+        optics = true;
+        health = true;
+        poe = true;
+        wlansta = true;
+        wlanif = true;
+        monitor=true;
+        routes = true; 
+        firware = true; 
+        netwatch = true;
+        conntrack = true;
+      };
+    };
+  };
+
+  services.prometheus.exporters.mikrotik = {
+    enable = true;
+    group = "mikrotik-exporter";
+    user = "mikrotik-exporter";
+    configFile = config.sops.templates.prometheus-mikrotik-config.path;
+  };
 }
diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix
index d29e73f..df48a9b 100644
--- a/hosts/tacitus/network.nix
+++ b/hosts/tacitus/network.nix
@@ -6,7 +6,7 @@ let
     25
     80
     443
-    config.services.grafana.port
+    config.services.grafana.settings.server.http_port
     config.services.prometheus.port
   ]
   ++ lib.mapAttrsToList (_: opt: opt.port) (