]> git.immae.eu Git - perso/Immae/Config/Nix.git/blob - modules/private/system/monitoring-1.nix
Switch to colemna
[perso/Immae/Config/Nix.git] / modules / private / system / monitoring-1.nix
1 { config, pkgs, lib, resources, ... }:
2 {
3 deployment = {
4 targetUser = "root";
5 targetHost = lib.head config.hostEnv.ips.main.ip4;
6 };
7 # ssh-keyscan monitoring-1 | nix-shell -p ssh-to-age --run ssh-to-age
8 secrets.ageKeys = [ "age1dn4lzhgxusqrpjjnzm7w8ml39ptf326htuzmpqdqs2gg3wq7cqzqxuvx8k" ];
9 boot.kernelPackages = pkgs.linuxPackages_latest;
10 myEnv = import ../../../nixops/secrets/environment.nix;
11
12 imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ] ++ builtins.attrValues (import ../..);
13
14 myServices.monitoring.enable = true;
15 myServices.monitoring.master = true;
16 myServices.status.enable = true;
17 networking = {
18 firewall.enable = true;
19 interfaces."ens3".ipv4.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
20 (n: ips: map (ip: { address = ip; prefixLength = 32; }) (ips.ip4 or []))
21 (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips));
22 interfaces."ens3".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList
23 (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or []))
24 config.hostEnv.ips);
25 defaultGateway6 = { address = "fe80::1"; interface = "ens3"; };
26 };
27 boot.loader.grub.device = "nodev";
28 fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
29 myServices.mailRelay.enable = true;
30
31 security.pki.certificateFiles = [
32 (pkgs.fetchurl {
33 url = "http://downloads.e.eriomem.net/eriomemca.pem";
34 sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh";
35 })
36 ];
37
38 services.netdata.enable = true;
39 services.netdata.configDir."stream.conf" = config.secrets.fullPaths."netdata-stream.conf";
40 services.netdata.config.web."allow dashboard from" = "localhost";
41 services.netdata.config.web."allow badges from" = "*";
42 services.netdata.config.web."allow streaming from" = "*";
43 services.netdata.config.web."allow netdata.conf from" = "fd*";
44 services.netdata.config.web."allow management from" = "fd*";
45 networking.firewall.allowedTCPPorts = [ 19999 ];
46
47 secrets.keys = {
48 "netdata-stream.conf" = {
49 user = config.services.netdata.user;
50 group = config.services.netdata.group;
51 permissions = "0400";
52 text = builtins.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (_: key: ''
53 [${key}]
54 enabled = yes
55 default history = 3600
56 default memory = ram
57 health enabled by default = auto
58 '') config.myEnv.monitoring.netdata_keys);
59 };
60 };
61 users.users."${config.services.netdata.user}".extraGroups = [ "keys" ];
62 # This value determines the NixOS release with which your system is
63 # to be compatible, in order to avoid breaking some software such as
64 # database servers. You should change this only after NixOS release
65 # notes say you should.
66 # https://nixos.org/nixos/manual/release-notes.html
67 system.stateVersion = "20.03"; # Did you read the comment?
68 }