modules/private/monitoring/status.nix

   1 { config, pkgs, lib, name, ... }:
   2 {
   3   options = {
   4     myServices.status = {
   5       enable = lib.mkOption {
   6         type = lib.types.bool;
   7         default = false;
   8         description = ''
   9           Whether to enable status app.
  10         '';
  11       };
  12     };
  13   };
  14   config = lib.mkIf config.myServices.status.enable {
  15     secrets.keys = [
  16       {
  17         dest = "naemon-status/environment";
  18         user = "naemon";
  19         group = "naemon";
  20         permission = "0400";
  21         text = ''
  22           TOKENS=${builtins.concatStringsSep " " config.myEnv.monitoring.nrdp_tokens}
  23           '';
  24       }
  25     ];
  26     services.nginx = {
  27       enable = true;
  28       recommendedOptimisation = true;
  29       recommendedGzipSettings = true;
  30       recommendedProxySettings = true;
  31       virtualHosts."status.immae.eu" = {
  32         acmeRoot = config.myServices.certificates.webroot;
  33         useACMEHost = name;
  34         forceSSL = true;
  35         locations."/".proxyPass = "http://unix:/run/naemon-status/socket.sock:/";
  36       };
  37     };
  38     security.acme.certs."${name}" = {
  39       extraDomains."status.immae.eu" = null;
  40       user = config.services.nginx.user;
  41       group = config.services.nginx.group;
  42     };
  43
  44     myServices.certificates.enable = true;
  45     networking.firewall.allowedTCPPorts = [ 80 443 ];
  46     systemd.services.naemon-status = {
  47       description = "Naemon status";
  48       after = [ "network.target" ];
  49       wantedBy = [ "multi-user.target" ];
  50
  51       serviceConfig = {
  52         EnvironmentFile = config.secrets.fullPaths."naemon-status/environment";
  53         Type = "simple";
  54         WorkingDirectory = "${./status}";
  55         ExecStart = let
  56           python = pkgs.python3.withPackages (p: [ p.gunicorn p.flask p.flask_login ]);
  57         in
  58           "${python}/bin/gunicorn -w4 --bind unix:/run/naemon-status/socket.sock app:app";
  59         User = "naemon";
  60         RuntimeDirectory = "naemon-status";
  61         StandardOutput = "journal";
  62         StandardError = "inherit";
  63       };
  64     };
  65   };
  66 }