]>
Commit | Line | Data |
---|---|---|
1a64deeb | 1 | { config, pkgs, lib, nixpkgs, php, secrets, ... }: |
e820134d | 2 | { |
282c67a1 IB |
3 | # ssh-keyscan monitoring-1 | nix-shell -p ssh-to-age --run ssh-to-age |
4 | secrets.ageKeys = [ "age1dn4lzhgxusqrpjjnzm7w8ml39ptf326htuzmpqdqs2gg3wq7cqzqxuvx8k" ]; | |
e820134d | 5 | boot.kernelPackages = pkgs.linuxPackages_latest; |
e820134d | 6 | |
1a64deeb IB |
7 | imports = [ |
8 | secrets.nixosModules.users-config-monitoring-1 | |
9 | (nixpkgs + "/nixos/modules/profiles/qemu-guest.nix") | |
10 | ./monitoring-master.nix | |
11 | ./monitoring.nix | |
12 | ./status.nix | |
13 | ./status_engine.nix | |
14 | ]; | |
15 | ||
16 | nixpkgs.overlays = builtins.attrValues php.overlays; | |
17 | nixpkgs.config.permittedInsecurePackages = [ | |
18 | "python-2.7.18.6" # for nagios-cli | |
19 | ]; | |
e820134d IB |
20 | |
21 | myServices.monitoring.enable = true; | |
22 | myServices.monitoring.master = true; | |
23 | myServices.status.enable = true; | |
24 | networking = { | |
25 | firewall.enable = true; | |
1a64deeb IB |
26 | interfaces."ens3".ipv4.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList |
27 | (n: ips: map (ip: { address = ip; prefixLength = 32; }) (ips.ip4 or [])) | |
28 | (pkgs.lib.attrsets.filterAttrs (n: v: n != "main") config.hostEnv.ips)); | |
e820134d IB |
29 | interfaces."ens3".ipv6.addresses = pkgs.lib.flatten (pkgs.lib.attrsets.mapAttrsToList |
30 | (n: ips: map (ip: { address = ip; prefixLength = (if n == "main" && ip == pkgs.lib.head ips.ip6 then 64 else 128); }) (ips.ip6 or [])) | |
619e4f46 | 31 | config.hostEnv.ips); |
e820134d IB |
32 | defaultGateway6 = { address = "fe80::1"; interface = "ens3"; }; |
33 | }; | |
34abd6af IB |
34 | boot.loader.grub.device = "nodev"; |
35 | fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; }; | |
e820134d IB |
36 | myServices.mailRelay.enable = true; |
37 | ||
171d8e1a IB |
38 | security.pki.certificateFiles = [ |
39 | (pkgs.fetchurl { | |
40 | url = "http://downloads.e.eriomem.net/eriomemca.pem"; | |
41 | sha256 = "1ixx4c6j3m26j8dp9a3dkvxc80v1nr5aqgmawwgs06bskasqkvvh"; | |
42 | }) | |
43 | ]; | |
44 | ||
e43fdf34 | 45 | services.netdata.enable = true; |
1a64deeb | 46 | services.netdata.configDir."stream.conf" = config.secrets.fullPaths."netdata-stream.conf"; |
e43fdf34 IB |
47 | services.netdata.config.web."allow dashboard from" = "localhost"; |
48 | services.netdata.config.web."allow badges from" = "*"; | |
49 | services.netdata.config.web."allow streaming from" = "*"; | |
50 | services.netdata.config.web."allow netdata.conf from" = "fd*"; | |
51 | services.netdata.config.web."allow management from" = "fd*"; | |
52 | networking.firewall.allowedTCPPorts = [ 19999 ]; | |
0e374709 | 53 | |
4c4652aa IB |
54 | secrets.keys = { |
55 | "netdata-stream.conf" = { | |
0e374709 IB |
56 | user = config.services.netdata.user; |
57 | group = config.services.netdata.group; | |
58 | permissions = "0400"; | |
59 | text = builtins.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (_: key: '' | |
60 | [${key}] | |
61 | enabled = yes | |
62 | default history = 3600 | |
63 | default memory = ram | |
64 | health enabled by default = auto | |
65 | '') config.myEnv.monitoring.netdata_keys); | |
4c4652aa IB |
66 | }; |
67 | }; | |
0e374709 | 68 | users.users."${config.services.netdata.user}".extraGroups = [ "keys" ]; |
e820134d IB |
69 | # This value determines the NixOS release with which your system is |
70 | # to be compatible, in order to avoid breaking some software such as | |
71 | # database servers. You should change this only after NixOS release | |
72 | # notes say you should. | |
73 | # https://nixos.org/nixos/manual/release-notes.html | |
1a64deeb | 74 | system.stateVersion = "23.05"; # Did you read the comment? |
e820134d | 75 | } |