rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2024-11-15 13:23:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: rouven.seifert:5fd94d85400ee5900b821b1a9acf662ef5ab84f9
Branches Tags
rouven.seifert:main
rouven.seifert:push-vxnoqsltyuxy
..
compare: rouven.seifert:16f3500f096aa5b5566d820fe7aa173c8679efc1
Branches Tags
rouven.seifert:main
rouven.seifert:push-vxnoqsltyuxy

No commits in common. "5fd94d85400ee5900b821b1a9acf662ef5ab84f9" and "16f3500f096aa5b5566d820fe7aa173c8679efc1" have entirely different histories.
5fd94d8540 ... 16f3500f09

11 changed files with 70 additions and 239 deletions
Show stats Expand all files Collapse all files

1
hosts/falkenstein/default.nix
View file

@ -10,7 +10,6 @@
./modules/dns ./modules/dns
./modules/fail2ban ./modules/fail2ban
./modules/mail ./modules/mail
./modules/monitoring
./modules/networks ./modules/networks
./modules/pfersel ./modules/pfersel
./modules/purge ./modules/purge

18
hosts/falkenstein/modules/monitoring/default.nix
View file

@ -1,18 +0,0 @@
{ config, ... }:
{
services.prometheus = {
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
};
postfix = {
enable = true;
};
};
};
networking.firewall.allowedTCPPorts = [
config.services.prometheus.exporters.node.port
config.services.prometheus.exporters.postfix.port
];
}

1
hosts/fujitsu/default.nix
View file

@ -3,7 +3,6 @@
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
./modules/networks ./modules/networks
./modules/monitoring
]; ];
boot.loader.grub.enable = true; boot.loader.grub.enable = true;

14
hosts/fujitsu/modules/monitoring/default.nix
View file

@ -1,14 +0,0 @@
{ config, ... }:
{
services.prometheus = {
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
};
};
};
networking.firewall.allowedTCPPorts = [
config.services.prometheus.exporters.node.port
];
}

1
hosts/nuc/default.nix
View file

@ -12,7 +12,6 @@
./modules/cache ./modules/cache
./modules/matrix ./modules/matrix
./modules/mautrix-telegram ./modules/mautrix-telegram
./modules/monitoring
./modules/seafile ./modules/seafile
./modules/torrent ./modules/torrent
./modules/vaultwarden ./modules/vaultwarden

97
hosts/nuc/modules/monitoring/default.nix
View file

@ -1,97 +0,0 @@
{ config, ... }:
let
domain = "monitoring.${config.networking.domain}";
in
{
age.secrets."grafana/oidc_secret" = {
file = ../../../../secrets/nuc/grafana/oidc.age;
owner = "grafana";
};
# grafana configuration
services.grafana = {
enable = true;
settings = {
server = {
inherit domain;
http_addr = "127.0.0.1";
http_port = 2342;
root_url = "https://${domain}";
};
database = {
type = "postgres";
user = "grafana";
host = "/run/postgresql";
};
"auth.generic_oauth" = {
enabled = true;
name = "Authentik";
allow_sign_up = true;
client_id = "grafana";
client_secret = "$__file{${config.age.secrets."grafana/oidc_secret".path}}";
scopes = "openid email profile offline_access roles";
email_attribute_path = "email";
login_attribute_path = "username";
name_attribute_path = "full_name";
auth_url = "https://auth.rfive.de/application/o/authorize/";
token_url = "https://auth.rfive.de/application/o/token/";
api_url = "https://auth.rfive.de/application/o/userinfo/";
role_attribute_path = "contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'";
};
};
};
services.postgresql = {
enable = true;
ensureUsers = [
{
name = "grafana";
ensureDBOwnership = true;
}
];
ensureDatabases = [ "grafana" ];
};
services.prometheus = {
enable = true;
port = 9001;
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
};
# postfix = {
# enable = true;
# port = 9003;
# };
};
scrapeConfigs = [
{
job_name = "node";
static_configs = [{
targets = [
"nuc.vpn.rfive.de:${toString config.services.prometheus.exporters.node.port}"
"falkenstein.vpn.rfive.de:${toString config.services.prometheus.exporters.node.port}"
"cudy.vpn.rfive.de:${toString config.services.prometheus.exporters.node.port}"
"fujitsu.vpn.rfive.de:${toString config.services.prometheus.exporters.node.port}"
];
}];
scrape_interval = "15s";
}
{
job_name = "postfix";
static_configs = [{
targets = [ "falkenstein.vpn.rfive.de:${toString config.services.prometheus.exporters.postfix.port}" ];
}];
}
];
};
# nginx reverse proxy
services.caddy.virtualHosts.${domain}.extraConfig = ''
reverse_proxy 127.0.0.1:${toString config.services.grafana.settings.server.http_port}
'';
}

3
hosts/nuc/modules/networks/default.nix
View file

@ -35,7 +35,8 @@
}]; }];
networkConfig = { networkConfig = {
DNS = [ DNS = [
"192.168.42.1" "9.9.9.9"
"149.112.112.112"
]; ];
LLDP = true; LLDP = true;
EmitLLDP = "nearest-bridge"; EmitLLDP = "nearest-bridge";

148
overlays/default.nix
View file

@ -63,92 +63,80 @@ in
adguardian-term = callPackage ../pkgs/adguardian-term { }; adguardian-term = callPackage ../pkgs/adguardian-term { };
# upstream package is broken and can't be fixed by overriding attrs. so I just completely redo it in here # upstream package is broken and can't be fixed by overriding attrs. so I just completely redo it in here
seahub = (python3Packages.buildPythonApplication rec { seahub = (python3Packages.buildPythonApplication
pname = "seahub"; rec {
version = "11.0.1"; pname = "seahub";
format = "other"; version = "11.0.1";
src = fetchFromGitHub { format = "other";
owner = "haiwen"; src = fetchFromGitHub {
repo = "seahub"; owner = "haiwen";
rev = "v11.0.1-pro"; repo = "seahub";
sha256 = "sha256-dxMvbiAdECMZIf+HgA5P2gZYI9l+k+nhmdzfg90037A="; rev = "v11.0.1-pro";
}; sha256 = "sha256-dxMvbiAdECMZIf+HgA5P2gZYI9l+k+nhmdzfg90037A=";
};
dontBuild = true; dontBuild = true;
doCheck = false; # disabled because it requires a ccnet environment doCheck = false; # disabled because it requires a ccnet environment
nativeBuildInputs = [ nativeBuildInputs = [
makeWrapper makeWrapper
]; ];
propagatedBuildInputs = with python3Packages; [ propagatedBuildInputs = with python3Packages; [
django django
future future
django-compressor django-compressor
django-statici18n django-statici18n
django-webpack-loader django-webpack-loader
django-simple-captcha django-simple-captcha
django-picklefield django-picklefield
django-formtools django-formtools
mysqlclient mysqlclient
pillow pillow
python-dateutil python-dateutil
djangorestframework djangorestframework
openpyxl openpyxl
requests requests
requests-oauthlib requests-oauthlib
chardet chardet
pyjwt pyjwt
pycryptodome pycryptodome
qrcode qrcode
pysearpc pysearpc
seaserv seaserv
gunicorn gunicorn
markdown markdown
bleach bleach
python-ldap python-ldap
pyopenssl pyopenssl
(buildPythonPackage rec { (buildPythonPackage rec {
pname = "djangosaml2"; pname = "djangosaml2";
version = "1.7.0"; version = "1.7.0";
doCheck = false; doCheck = false;
propagatedBuildInputs = [ propagatedBuildInputs = [
pysaml2 pysaml2
django django
defusedxml defusedxml
]; ];
src = fetchPypi { src = fetchPypi {
inherit pname version; inherit pname version;
sha256 = "sha256-WiMl2UvbOskLA5o5LXPrBF2VktlDnlBNdc42eZ62Fko="; sha256 = "sha256-WiMl2UvbOskLA5o5LXPrBF2VktlDnlBNdc42eZ62Fko=";
}; };
}) })
]; ];
installPhase = '' installPhase = ''
cp -dr --no-preserve='ownership' . $out/ cp -dr --no-preserve='ownership' . $out/
wrapProgram $out/manage.py \ wrapProgram $out/manage.py \
--prefix PYTHONPATH : "$PYTHONPATH:$out/thirdpart:" --prefix PYTHONPATH : "$PYTHONPATH:$out/thirdpart:"
''; '';
passthru = rec {
python = prev.python3;
pythonPath = python.pkgs.makePythonPath propagatedBuildInputs;
};
});
# (hopefully) fix systemd journal reading
prometheus-postfix-exporter = prev.prometheus-postfix-exporter.overrideAttrs (_old: {
patches = [
./prometheus-postfix-exporter/0001-cleanup-also-catch-milter-reject.patch
];
src = fetchFromGitHub {
owner = "adangel";
repo = "postfix_exporter";
rev = "414ac12ee63415eede46cb3084d755a6da6fba23";
hash = "sha256-m1kVaO3N7XC1vtnxXX9kMiEFPmZuoopRUYgA7gQzP8w=";
};
});
passthru = rec {
python = prev.python3;
pythonPath = python.pkgs.makePythonPath propagatedBuildInputs;
};
});
} }

25
overlays/prometheus-postfix-exporter/0001-cleanup-also-catch-milter-reject.patch
View file

@ -1,25 +0,0 @@
From f4c5dd5628c873981b2d6d6b8f3bbf036b9fd724 Mon Sep 17 00:00:00 2001
From: Rouven Seifert <rouven.seifert@ifsr.de>
Date: Thu, 2 May 2024 11:20:27 +0200
Subject: [PATCH] cleanup: also catch milter-reject
---
postfix_exporter.go | 2 ++
1 file changed, 2 insertions(+)
diff --git a/postfix_exporter.go b/postfix_exporter.go
index f20d99c..676d767 100644
--- a/postfix_exporter.go
+++ b/postfix_exporter.go
@@ -335,6 +335,8 @@ func (e *PostfixExporter) CollectFromLogLine(line string) {
e.cleanupProcesses.Inc()
} else if strings.Contains(remainder, ": reject: ") {
e.cleanupRejects.Inc()
+ } else if strings.Contains(remainder, ": milter-reject: ") {
+ e.cleanupRejects.Inc()
} else {
e.addToUnsupportedLine(line, subprocess, level)
}
--
2.44.0

1
secrets.nix
View file

@ -24,7 +24,6 @@ in
"secrets/nuc/keycloak/db.age".publicKeys = [ rouven nuc ]; "secrets/nuc/keycloak/db.age".publicKeys = [ rouven nuc ];
"secrets/nuc/authentik/core.age".publicKeys = [ rouven nuc ]; "secrets/nuc/authentik/core.age".publicKeys = [ rouven nuc ];
"secrets/nuc/authentik/ldap.age".publicKeys = [ rouven nuc ]; "secrets/nuc/authentik/ldap.age".publicKeys = [ rouven nuc ];
"secrets/nuc/grafana/oidc.age".publicKeys = [ rouven nuc ];
"secrets/nuc/cache.age".publicKeys = [ rouven nuc ]; "secrets/nuc/cache.age".publicKeys = [ rouven nuc ];
"secrets/nuc/borg/passphrase.age".publicKeys = [ rouven nuc ]; "secrets/nuc/borg/passphrase.age".publicKeys = [ rouven nuc ];
"secrets/nuc/borg/key.age".publicKeys = [ rouven nuc ]; "secrets/nuc/borg/key.age".publicKeys = [ rouven nuc ];

BIN
secrets/nuc/grafana/oidc.age
View file

Binary file not shown.