systems/monitoring-1/status.nix

   1 { config, pkgs, lib, name, ... }:
   2 {
   3   options = {
   4     myServices.status = {
   5       enable = lib.mkOption {
   6         type = lib.types.bool;
   7         default = false;
   8         description = ''
   9           Whether to enable status app.
  10         '';
  11       };
  12     };
  13   };
  14   config = lib.mkIf config.myServices.status.enable {
  15     secrets.keys."naemon-status/environment" = {
  16       user = "naemon";
  17       group = "naemon";
  18       permissions = "0400";
  19       text = ''
  20         TOKENS=${builtins.concatStringsSep " " config.myEnv.monitoring.nrdp_tokens}
  21         '';
  22     };
  23     services.nginx = {
  24       enable = true;
  25       recommendedOptimisation = true;
  26       recommendedGzipSettings = true;
  27       recommendedProxySettings = true;
  28       virtualHosts."status.immae.eu" = {
  29         acmeRoot = config.security.acme.defaults.webroot;
  30         useACMEHost = name;
  31         forceSSL = true;
  32         locations."/".proxyPass = "http://unix:/run/naemon-status/socket.sock:/";
  33       };
  34     };
  35     security.acme.certs."${name}" = {
  36       extraDomainNames = [ "status.immae.eu" ];
  37       group = config.services.nginx.group;
  38     };
  39
  40     networking.firewall.allowedTCPPorts = [ 80 443 ];
  41     systemd.services.naemon-status = {
  42       description = "Naemon status";
  43       after = [ "network.target" ];
  44       wantedBy = [ "multi-user.target" ];
  45
  46       serviceConfig = {
  47         EnvironmentFile = config.secrets.fullPaths."naemon-status/environment";
  48         Type = "simple";
  49         WorkingDirectory = "${./status}";
  50         ExecStart = let
  51           python = pkgs.python3.withPackages (p: [ p.gunicorn p.flask p.flask_login ]);
  52         in
  53           "${python}/bin/gunicorn -w4 --bind unix:/run/naemon-status/socket.sock app:app";
  54         User = "naemon";
  55         RuntimeDirectory = "naemon-status";
  56         StandardOutput = "journal";
  57         StandardError = "inherit";
  58       };
  59     };
  60   };
  61 }