From 3b5c3b8acaa17c1fafdc26701dd0b02ea08b3bea Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <jakub@wilkuu.nl>
Date: Mon, 10 Aug 2026 23:02:56 +0200
Subject: nixfmt nix flake update exporters

---
 hosts/omega-relay/default.nix | 46 +++++++++++++++++++++++++++++++++++++++----
 1 file changed, 42 insertions(+), 4 deletions(-)

(limited to 'hosts')

diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index 542b843..4d89763 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -54,7 +54,7 @@
     {
       prometheus.enableExporters = true;
       cgit = {
-        enable = true; 
+        enable = true;
         domain = "git.wilkuu.nl";
       };
       desecDyn = {
@@ -153,6 +153,21 @@
       maxtime = "168h"; # Do not ban for more than 1 week
       overalljails = true; # Calculate the bantime based on all the violations
     };
+    jails = {
+      nginx-http-auth = ''
+        enabled = true
+        filter = nginx-http-auth
+        logpath = /var/log/nginx/error.log
+        maxretry = 5
+      '';
+
+      nginx-badbots = ''
+        enabled = true
+        filter = nginx-badbots
+        logpath = /var/log/nginx/access.log
+        maxretry = 2
+      '';
+    };
   };
 
   virtualisation = {
@@ -170,6 +185,7 @@
       domain = if isVM then "omega-relay.local" else "wilkuu.xyz";
     in
     {
+      statusPage = true;
       enable = true;
       virtualHosts."${domain}" = {
         enableACME = !isVM;
@@ -265,9 +281,31 @@
 
     };
   };
-  services.prometheus.exporters.unbound = {
-    enable = true;
-
+  services.prometheus.exporters = {
+    unbound = {
+      enable = true;
+      group = "unbound";
+      unbound = {
+        host = "unix:///run/unbound/unbound.ctl";
+        key = "/var/lib/unbound/unbound_control.key";
+        certificate = "/var/lib/unbound/unbound_control.pem";
+        ca = "/var/lib/unbound/unbound_server.pem";
+      };
+    };
+    nginxlog = {
+      enable = true;
+      group = "nginx";
+      settings.namespaces = [
+        {
+          name = "default";
+          format = "$remote_addr - $remote_user [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"";
+          source.files = [
+            "/var/log/nginx/access.log"
+            "/var/log/nginx/error.log"
+          ];
+        }
+      ];
+    };
   };
 
   services.resolved = {
-- 
cgit v1.3.1