modules/private/monitoring/status.nix

   1 { config, pkgs, lib, name, ... }:
   2 {
   3   options = {
   4     myServices.status = {
   5       enable = lib.mkOption {
   6         type = lib.types.bool;
   7         default = false;
   8         description = ''
   9           Whether to enable status app.
  10         '';
  11       };
  12     };
  13   };
  14   config = lib.mkIf config.myServices.status.enable {
  15     secrets.keys = [
  16       {
  17         dest = "naemon-status/environment";
  18         user = "naemon";
  19         group = "naemon";
  20         permission = "0400";
  21         text = ''
  22           TOKENS=${builtins.concatStringsSep " " config.myEnv.monitoring.nrdp_tokens}
  23           '';
  24       }
  25     ];
  26     services.nginx = {
  27       enable = true;
  28       recommendedOptimisation = true;
  29       recommendedGzipSettings = true;
  30       recommendedProxySettings = true;
  31       upstreams."netdata".servers = { "127.0.0.1:19999" = {}; };
  32       upstreams."netdata".extraConfig = ''
  33         keepalive 64;
  34         '';
  35       virtualHosts."status.immae.eu" = {
  36         acmeRoot = config.myServices.certificates.webroot;
  37         useACMEHost = name;
  38         forceSSL = true;
  39         locations."/".proxyPass = "http://unix:/run/naemon-status/socket.sock:/";
  40
  41         locations."= /netdata".return = "301 /netdata/";
  42         locations."~ /netdata/(?<ndpath>.*)".extraConfig = ''
  43           proxy_redirect off;
  44           proxy_set_header Host $host;
  45
  46           proxy_set_header X-Forwarded-Host $host;
  47           proxy_set_header X-Forwarded-Server $host;
  48           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  49           proxy_http_version 1.1;
  50           proxy_pass_request_headers on;
  51           proxy_set_header Connection "keep-alive";
  52           proxy_store off;
  53           proxy_pass http://netdata/$ndpath$is_args$args;
  54
  55           gzip on;
  56           gzip_proxied any;
  57           gzip_types *;
  58           '';
  59       };
  60     };
  61     security.acme.certs."${name}" = {
  62       extraDomains."status.immae.eu" = null;
  63       user = config.services.nginx.user;
  64       group = config.services.nginx.group;
  65     };
  66
  67     myServices.certificates.enable = true;
  68     networking.firewall.allowedTCPPorts = [ 80 443 ];
  69     systemd.services.naemon-status = {
  70       description = "Naemon status";
  71       after = [ "network.target" ];
  72       wantedBy = [ "multi-user.target" ];
  73
  74       serviceConfig = {
  75         EnvironmentFile = config.secrets.fullPaths."naemon-status/environment";
  76         Type = "simple";
  77         WorkingDirectory = "${./status}";
  78         ExecStart = let
  79           python = pkgs.python3.withPackages (p: [ p.gunicorn p.flask p.flask_login ]);
  80         in
  81           "${python}/bin/gunicorn -w4 --bind unix:/run/naemon-status/socket.sock app:app";
  82         User = "naemon";
  83         RuntimeDirectory = "naemon-status";
  84         StandardOutput = "journal";
  85         StandardError = "inherit";
  86       };
  87     };
  88   };
  89 }