diff options
| -rw-r--r-- | .sops.yaml | 6 | ||||
| -rw-r--r-- | hosts/omega-relay/default.nix | 9 | ||||
| -rw-r--r-- | hosts/omega-relay/firewall.nix | 11 | ||||
| -rw-r--r-- | hosts/tacitus/default.nix | 7 | ||||
| -rw-r--r-- | hosts/tacitus/network.nix | 15 | ||||
| -rw-r--r-- | modules/default.nix | 1 |
6 files changed, 43 insertions, 6 deletions
@@ -4,7 +4,7 @@ keys: - &virtserver_omega_relay age1n20lpr5x2aep3l3ta62x2c9cnuz3m495f2dmguqs08ezlqgu4vwsqfskyg - &vm_omega_relay age13x9grwfpqjgvjfcnwg5snuntp5emze85hqc8qwuz9nfphfe2pg4skl29r4 - &server_omega_relay age18u22lycxtcasvlm298qwzwuc97z56kkhw8ssy9yx4gzlkskuwpyqdz80g4 - - &server_threshold age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht + - &server_tacitus age1yd07835r408vk259jk09wa0seg5ymu97mh556wgu0twf35588cms7y9jht creation_rules: @@ -23,9 +23,9 @@ creation_rules: - *virtserver_omega_relay - *vm_omega_relay - *server_omega_relay - - path_regex: secrets/threshold/[^/]+\.(yaml|json|env|ini)$ + - path_regex: secrets/tacitus/[^/]+\.(yaml|json|env|ini)$ age: - *admin_wilkuu - - *server_threshold + - *server_tacitus diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index ab2dcfa..27cbf13 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -50,6 +50,7 @@ isVM = config.addons.virtualisation.isTestVM; in { + prometheus.enableExporters = true; desecDyn = { enable = true; domains."wilkuu.dedyn.io" = { @@ -182,6 +183,14 @@ tryFiles = "$uri $uri/ =404"; }; }; + virtualHosts."moni.wilkuu.xyz" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://192.168.88.5:3132"; + recommendedProxySettings = true; + }; + }; }; networking.hostName = "omega-relay"; diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix index 38cd9a1..c276831 100644 --- a/hosts/omega-relay/firewall.nix +++ b/hosts/omega-relay/firewall.nix @@ -23,7 +23,16 @@ let secureTCP = [ # config.wilkuu.services.mysql.port - ]; + ] + ++ lib.mapAttrsToList (_: opt: opt.port) ( + lib.filterAttrs ( + _: e: + let + evaluated = builtins.tryEval e; + in + evaluated.success && e ? enable && e.enable + ) config.services.prometheus.exporters + ); secureUDP = [ ]; diff --git a/hosts/tacitus/default.nix b/hosts/tacitus/default.nix index ea68490..f4a135c 100644 --- a/hosts/tacitus/default.nix +++ b/hosts/tacitus/default.nix @@ -1,5 +1,6 @@ { lib, + config, ... }: { @@ -8,6 +9,12 @@ ./disko.nix ./hardware.nix ]; + + wilkuu.services = { + prometheus.enableScraper = true; + prometheus.enableExporters = true; + }; + addons = { desktop.xfce.enable = lib.mkForce true; gpg.enable = true; diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix index a4d0c03..ee24ad0 100644 --- a/hosts/tacitus/network.nix +++ b/hosts/tacitus/network.nix @@ -1,4 +1,4 @@ -{ ... }: +{ config, lib, ... }: let baseTCP = [ 20 @@ -6,7 +6,18 @@ let 25 80 443 - ]; + config.services.grafana.port + config.services.prometheus.port + ] ++ lib.mapAttrsToList (_: opt: opt.port) ( + lib.filterAttrs ( + _: e: + let + evaluated = builtins.tryEval e; + in + evaluated.success && e ? enable && e.enable + ) config.services.prometheus.exporters + ); + baseUDP = [ ]; baseTCPRanges = [ ]; diff --git a/modules/default.nix b/modules/default.nix index 98abe6d..180e31b 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -15,6 +15,7 @@ ./motd.nix ./locale.nix ./test_endpoint.nix + ./prometheus.nix ]; nixpkgs.overlays = [ |