modules/private/monitoring/status.nix

   1 { config, pkgs, lib, name, ... }:
   2 {
   3   options = {
   4     myServices.status = {
   5       enable = lib.mkOption {
   6         type = lib.types.bool;
   7         default = false;
   8         description = ''
   9           Whether to enable status app.
  10         '';
  11       };
  12     };
  13   };
  14   config = lib.mkIf config.myServices.status.enable {
  15     secrets.keys."naemon-status/environment" = {
  16       user = "naemon";
  17       group = "naemon";
  18       permissions = "0400";
  19       text = ''
  20         TOKENS=${builtins.concatStringsSep " " config.myEnv.monitoring.nrdp_tokens}
  21         '';
  22     };
  23     services.nginx = {
  24       enable = true;
  25       recommendedOptimisation = true;
  26       recommendedGzipSettings = true;
  27       recommendedProxySettings = true;
  28       upstreams."netdata".servers = { "127.0.0.1:19999" = {}; };
  29       upstreams."netdata".extraConfig = ''
  30         keepalive 64;
  31         '';
  32       virtualHosts."status.immae.eu" = {
  33         acmeRoot = config.myServices.certificates.webroot;
  34         useACMEHost = name;
  35         forceSSL = true;
  36         locations."/".proxyPass = "http://unix:/run/naemon-status/socket.sock:/";
  37
  38         locations."= /netdata".return = "301 /netdata/";
  39         locations."~ /netdata/(?<ndpath>.*)".extraConfig = ''
  40           proxy_redirect off;
  41           proxy_set_header Host $host;
  42
  43           proxy_set_header X-Forwarded-Host $host;
  44           proxy_set_header X-Forwarded-Server $host;
  45           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  46           proxy_http_version 1.1;
  47           proxy_pass_request_headers on;
  48           proxy_set_header Connection "keep-alive";
  49           proxy_store off;
  50           proxy_pass http://netdata/$ndpath$is_args$args;
  51
  52           gzip on;
  53           gzip_proxied any;
  54           gzip_types *;
  55           '';
  56       };
  57     };
  58     security.acme.certs."${name}" = {
  59       extraDomains."status.immae.eu" = null;
  60       user = config.services.nginx.user;
  61       group = config.services.nginx.group;
  62     };
  63
  64     myServices.certificates.enable = true;
  65     networking.firewall.allowedTCPPorts = [ 80 443 ];
  66     systemd.services.naemon-status = {
  67       description = "Naemon status";
  68       after = [ "network.target" ];
  69       wantedBy = [ "multi-user.target" ];
  70
  71       serviceConfig = {
  72         EnvironmentFile = config.secrets.fullPaths."naemon-status/environment";
  73         Type = "simple";
  74         WorkingDirectory = "${./status}";
  75         ExecStart = let
  76           python = pkgs.python3.withPackages (p: [ p.gunicorn p.flask p.flask_login ]);
  77         in
  78           "${python}/bin/gunicorn -w4 --bind unix:/run/naemon-status/socket.sock app:app";
  79         User = "naemon";
  80         RuntimeDirectory = "naemon-status";
  81         StandardOutput = "journal";
  82         StandardError = "inherit";
  83       };
  84     };
  85   };
  86 }