darkkirb/nixos-config
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix up all the metrics

Browse source
This commit is contained in:
Charlotte 🦝 Delenk 2022-05-03 10:31:27 +01:00
parent 25b958d65b
commit 2f861840a6
Signed by: darkkirb
GPG key ID: AB2BD8DAF2E37122
13 changed files with 125 additions and 92 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
config/nixos-8gb-fsn1-1.nix
View file

@ -17,7 +17,6 @@
./services/dovecot.nix
./services/postfix.nix
./services/minecraft.nix
./services/minio.nix
./services/loki.nix
./services/reverse-proxy.nix
./services/matrix-media-repo.nix

1
config/services/elasticsearch.nix
View file

@ -3,4 +3,5 @@
enable = true;
cluster_name = "chir-rs";
};
# TODO: elasticsearch-exporter
}

7
config/services/hydra.nix
View file

@ -30,6 +30,12 @@ in
jobs = .*
</githubstatus>
store_uri = s3://cache-chir-rs?scheme=https&endpoint=s3.us-west-000.backblazeb2.com&secret-key=${config.sops.secrets."services/hydra/cache-key".path}&multipart-upload=true&compression=zstd&compression-level=15
<hydra_notify>
<prometheus>
listen_address = 127.0.0.1
port = 9199
</prometheus>
</hydra_notify>
'';
giteaTokenFile = "/run/secrets/services/hydra/gitea_token";
githubTokenFile = "/run/secrets/services/hydra/github_token";
@ -38,6 +44,7 @@ in
"/run/hydra-machines"
];
};
networking.firewall.interfaces."wg0".allowedTCPPorts = [ 9199 ];
nix.settings.allowed-uris = [ "https://github.com/" "https://git.chir.rs/" "https://darkkirb.de/" "https://git.neo-layout.org/" "https://static.darkkirb.de/" ];
sops.secrets."services/hydra/gitea_token" = { };
sops.secrets."services/hydra/github_token" = { };

2
config/services/mastodon.nix
View file

@ -18,6 +18,7 @@ in
imports = [
./elasticsearch.nix
../../modules/mastodon.nix
./statsd-exporter.nix
];
services.mastodon = {
enable = true;
@ -43,6 +44,7 @@ in
S3_OPEN_TIMEOUT = "120";
S3_READ_TIMEOUT = "120";
S3_MULTIPART_THRESHOLD = "5242880";
STATSD_ADDR = "127.0.0.1:9125";
};
redis.createLocally = false;
otpSecretFile = config.sops.secrets."services/mastodon/otpSecret".path;

6
config/services/matrix-media-repo.nix
View file

@ -26,9 +26,15 @@ let
region = "us-west-000";
};
}];
metrics = {
enabled = true;
bindAddress = "[::]";
port = 9000;
};
});
in
{
networking.firewall.interfaces."wg0".allowedTCPPorts = [ 9000 ];
systemd.services.matrix-media-repo = {
description = "Matrix Media Repo";
after = [ "network.target" ];

62
config/services/minio.nix
View file

@ -1,62 +0,0 @@
{ pkgs, lib, config, ... }:
let
listenIPs = (import ../../utils/getInternalIP.nix config).listenIPs;
listenStatements = lib.concatStringsSep "\n" (builtins.map (ip: "listen ${ip}:443 http3;") listenIPs) + ''
add_header Alt-Svc 'h3=":443"';
'';
in
{
services.minio = {
enable = false;
rootCredentialsFile = "/run/secrets/security/minio/credentials_file";
};
services.nginx.virtualHosts."minio.int.chir.rs" = {
listenAddresses = listenIPs;
sslCertificate = "/var/lib/acme/int.chir.rs/cert.pem";
sslCertificateKey = "/var/lib/acme/int.chir.rs/key.pem";
locations."/" = {
proxyPass = "http://127.0.0.1:9000";
proxyWebsockets = true;
};
extraConfig = listenStatements;
};
services.nginx.virtualHosts."minio-console.int.chir.rs" = {
listenAddresses = listenIPs;
sslCertificate = "/var/lib/acme/int.chir.rs/cert.pem";
sslCertificateKey = "/var/lib/acme/int.chir.rs/key.pem";
locations."/" = {
proxyPass = "http://127.0.0.1:9001";
proxyWebsockets = true;
};
extraConfig = listenStatements;
};
sops.secrets."security/minio/credentials_file" = { };
systemd.services.minio = {
enable = true;
description = "Minio Object Storage";
after = [ "network.target" ];
environment = {
MINIO_BROWSER = "on";
MINIO_REGION = "eu-west-1";
MINIO_CACHE = "on";
MINIO_CACHE_DRIVES = "/var/cache/minio";
MINIO_CACHE_QUOTA = "80";
MINIO_CACHE_WATERMARK_LOW = "70";
MINIO_CACHE_WATERMARK_HIGH = "90";
};
serviceConfig = {
Type = "simple";
User = "minio";
Group = "minio";
LimitNOFILE = 65536;
EnvironmentFile = "/run/secrets/security/minio/credentials_file";
ExecStart = "${pkgs.minio}/bin/minio gateway s3 --json --address :9000 --console-address :9001 --config-dir=/var/lib/minio/config http://[fd00:e621:e621:2::2]:9000";
};
wantedBy = [ "multi-user.target" ];
};
users.users.minio = {
group = "minio";
uid = config.ids.uids.minio;
};
users.groups.minio.gid = config.ids.gids.minio;
}

66
config/services/prometheus.nix
View file

@ -11,10 +11,10 @@
job_name = "node_exporter";
static_configs = [{
targets = [
"[fd0d:a262:1fa6:e621:b4e1:8ff:e658:6f49]:${toString config.services.prometheus.exporters.node.port}"
"[fd0d:a262:1fa6:e621:47e6:24d4:2acb:9437]:${toString config.services.prometheus.exporters.node.port}"
"[fd0d:a262:1fa6:e621:f45a:db9f:eb7c:1a3f]:${toString config.services.prometheus.exporters.node.port}"
"[fd0d:a262:1fa6:e621:bc9b:6a33:86e4:873b]:${toString config.services.prometheus.exporters.node.port}"
"nixos-8gb-fsn1-1.int.chir.rs:${toString config.services.prometheus.exporters.node.port}"
"nutty-noon.int.chir.rs:${toString config.services.prometheus.exporters.node.port}"
"nas.int.chir.rs:${toString config.services.prometheus.exporters.node.port}"
"thinkrac.int.chir.rs:${toString config.services.prometheus.exporters.node.port}"
];
}];
}
@ -22,7 +22,7 @@
job_name = "bind_exporter";
static_configs = [{
targets = [
"[fd0d:a262:1fa6:e621:b4e1:8ff:e658:6f49]:${toString config.services.prometheus.exporters.bind.port}"
"nixos-8gb-fsn1-1.int.chir.rs:${toString config.services.prometheus.exporters.bind.port}"
];
}];
}
@ -30,7 +30,7 @@
job_name = "postgres_exporter";
static_configs = [{
targets = [
"[fd0d:a262:1fa6:e621:b4e1:8ff:e658:6f49]:${toString config.services.prometheus.exporters.postgres.port}"
"nixos-8gb-fsn1-1.int.chir.rs:${toString config.services.prometheus.exporters.postgres.port}"
];
}];
}
@ -38,27 +38,59 @@
job_name = "gitea_exporter";
static_configs = [{
targets = [
"[fd0d:a262:1fa6:e621:b4e1:8ff:e658:6f49]:${toString config.services.gitea.httpPort}"
"nixos-8gb-fsn1-1.int.chir.rs:${toString config.services.gitea.httpPort}"
];
}];
}
{
job_name = "minio_exporter";
bearer_token_file = "/run/secrets/services/minio_scrape";
metrics_path = "/minio/v0/metrics/cluster";
scheme = "https";
static_configs = [
{
job_name = "dovecot_exporter";
static_configs = [{
targets = [
"minio.int.chir.rs"
"nixos-8gb-fsn1-1.int.chir.rs:${toString config.services.prometheus.exporters.dovecot.port}"
];
}];
}
{
job_name = "hydra_exporter";
static_configs = [{
targets = [
"nas.int.chir.rs:9199"
];
}];
}
{
job_name = "statsd_exporter";
static_configs = [{
targets = [
"nas.int.chir.rs:9102"
];
}];
}
{
job_name = "matrix_media_repo";
static_configs = [{
targets = [
"nixos-8gb-fsn1-1.int.chir.rs:9000"
];
}];
}
{
job_name = "rspamd_exporter";
static_configs = [{
targets = [
"nas.int.chir.rs:7980"
];
}];
}
{
job_name = "synapse";
static_configs = [{
targets = [
"nas.int.chir.rs:9009"
];
}];
}
];
checkConfig = false;
};
sops.secrets."services/minio_scrape" = {
owner = "prometheus";
};
}

2
config/services/promtail.nix
View file

@ -9,7 +9,7 @@ let
filename = "/tmp/positions.yaml";
};
client = {
url = "http://[fd0d:a262:1fa6:e621:b4e1:08ff:e658:6f49]:3100/loki/api/v1/push";
url = "http://nixos-8gb-fsn1-1.int.chir.rs:3100/loki/api/v1/push";
external_labels.host = config.networking.hostName;
};
scrape_configs = [

2
config/services/rspamd.nix
View file

@ -203,5 +203,7 @@
11332
11333
11334
7980
];
services.prometheus.exporters.rspamd.enable = true;
}

38
config/services/statsd-exporter.nix Normal file
View file

@ -0,0 +1,38 @@
{ pkgs, ... }: {
systemd.services."prometheus-statsd-exporter" = {
enable = true;
wantedBy = [ "multi-user.target" "mastodon-web.service" "mastodon-sidekiq.service" "mastodon-streaming.service" ];
after = [ "network.target" ];
serviceConfig = {
Restart = "always";
PrivateTmp = true;
WorkingDirectory = "/tmp";
DynamicUser = true;
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
UMask = "0077";
ExeStart = ''
${pkgs.prometheus-statsd-exporter}/bin/prometheus-statsd-exporter --web-listen-adress="[::]:9102" --statsd.listen-upd="127.0.0.1:9125"
'';
};
};
networking.firewall.interfaces."wg0".allowedTCPPorts = [ 9102 ];
}

8
config/services/synapse.nix
View file

@ -14,6 +14,12 @@
names = [ "client" "federation" ];
compress = false;
}];
}
{
port = 9009;
type = "metrics";
bind_addresses = [ "::" ];
resources = [ ];
}];
admin_contact = "mailto:lotte@chir.rs";
retention.enabled = true;
@ -54,9 +60,11 @@
];
signing_key_path = config.sops.secrets."services/synapse/private_key".path;
encryption_enabled_by_default_for_room_type = "all";
enable_metrics = true;
};
withJemalloc = true;
};
networking.firewall.interfaces."wg0".allowedTCPPorts = [ 9009 ];
sops.secrets."services/synapse/private_key" = { owner = "matrix-synapse"; };
services.postgresql.ensureDatabases = [
"synapse"

7
secrets/nixos-8gb-fsn1-1.yaml
View file

@ -6,8 +6,6 @@ security:
dns: ENC[AES256_GCM,data:+jonRU4hUZHC9qzvnDJTDOgyk21lFbH2sWBNxRdhIdGZFCGogXW+32EupL7Uowyu2kSaYCaGPDTTfrhWQHktPypdXpkbu8tWlM5U8aRORWQ0B8Ro7wIt8gS/xuObUUdfEJ7DCzi9XqCLi2p+zeloT49DahUbOPjwnCsabWlsObszOQ7kXpXInFaOCHeoMG5knOT1Ls29W9bvv9QKkRG6TSkI4sNXTFCnIoAAOWy3NI9xwrFZMMxaInah4RW/z8KWVzeCfYjiyquyjOUsPOjPhA+p1zt6,iv:vJe3/6/k47V7NwdutLjAbY1UxLGKEZ8YvoJnEfYeZAc=,tag:PvVSk1J3r8BDG5x7rraSZw==,type:str]
dns2: ENC[AES256_GCM,data:YPtlAMHX1WvdddcKPTNKxGIZ0A3eUi2G2JmhKcyiV9WNJCh2km/IKZ+ot9wzQBYOCl8nDexMJa3iW5ZKAhmPjWZi1+6EqwsWjk0pEYjXJj2Dp+L5t9+QN5ZHTZ6uUEESpxO/QjrFMxTie2TOLm58fYGHgMcagTES6PgmGkMAdCxojNQEZaLpkBovfa5j+FsnIwco9vXdLN+Ikp0mJ6arHIFz5w0+ypxP3ny9jOP6XGqrowCDAIsRGHFqnEBYoEblunWDqAAQGurAUr5fi3e234Kw19aj,iv:tRR8HnbEF0ZlIKuQ0R7t+QQNhYsnYsBHSn+ymPMQEzs=,tag:Q3E6+cnmQ3tz4kZIW5/CtQ==,type:str]
cloudflare: ENC[AES256_GCM,data:nddIsuWzpnhgz/FVHo7sklxzKxfKPds2zCOCSaPIk9tSRZaH2SH/N5ybRXwVaAaz6jpO3xJNtwYFAizxy7Lxj2f3MJvKQ5iscip7B6zBN0liLuXLUWo2reZqb4CbPuT++zBB1XLlL9lkhyZWhzEL9v/p+OvYUer8IAsaYfWMEP5Xj+XLmzrwdLjwhLZHL5+EYtmXzwrOq7yS7POiyjYDf7HiSG3EZAwhzv+LMh/ai7P3G2wi2TbCCPc=,iv:u0fhTL1d/574R9WGzzyIpl7iG9uzVr2yXSrUDxxcBPY=,tag:XYOpq+bKSUbWwN42QNTgow==,type:str]
minio:
credentials_file: ENC[AES256_GCM,data:tBNvwrEdu4KVkADT3tnHcomxcpJbjBntAjJnACxqS3IzaHcpxtFM3tBnMw2zjpgCbtF8h+GCZrye+o5RhJWo5vW6KSmIvYnoM5w=,iv:0SzUMSZoYMl+SlINDj1tJjNABoJBjrMJoXfh88kVBDI=,tag:8kXujM6obBXmDCuPMWo35Q==,type:str]
restic:
password: ENC[AES256_GCM,data:8W1pEFt+1lW2/Y11OrJa+glMM1A=,iv:V0R7PlBMxl/oTJxE10MIDMtbqr98bE/po+/92MGMftY=,tag:juGYo8nQy7IJUX28f2ZznQ==,type:str]
services:
@ -23,7 +21,6 @@ services:
accessGrant: ENC[AES256_GCM,data:pPDtDdIiMuSipzHn1YNpskJVzWCsMdO5avpO2ij4U/25PNjIayJWkhKnfZHBw7de9v5b+ipgJrbXbrw6fcK0WivZNsVsQWf3qvEcWq3Bzgxel0ZQtstV8ZYawhEz8iIegDNwwvdMpnN0TPkkeFSNtaMZALK5QRATKCTE1gZS0ZNW+0jLrmU9sWKgd0LB9oGxIm0Rv6JlCnqPLnl4AyUsPWf9kJiS7JCLVhuQTV+eM8GvQCKDB1/V/ym4h0Cx3872u26R9gzWGIl0pDUbfRhc3MtpwEsBEUp8Czq+LV0gIUH17mcu3cY5uf7jUIW27n601IPOFxRGoRohA1REPKcwHpVUKiSh1ARDPTOpDcBqEh4eCNgdjnCOrXoVw/leEmrTyxqhyguU6nc=,iv:RdzJzQuPzKlFuCE9C2VheDEYNVf3Iaj19Gn9wtJ4dOQ=,tag:F08I8it+3F5Ny9ABuQOt9A==,type:str]
accessKey: ENC[AES256_GCM,data:YysAFxo=,iv:eAcnMmLT0U8PwJ0Wddv3YC0zXIjg9vsQaopP1CBjtP0=,tag:IPlU9yVm2fuokXMIohvlfQ==,type:str]
secretKey: ENC[AES256_GCM,data:nwn6rhS8pz2/E5gDwSCH1VWPhw==,iv:ZhlIzMjnrZR8bTGOTkY0HMsc9JZNDXp0KgweVfwcK7g=,tag:/JQeF/bZm1Wp6NjeSzf/Jw==,type:str]
minio_scrape: ENC[AES256_GCM,data:w+VescGVui8/70HsSP/WCQG/E9fU0X45BXF2qwPNE2vnYM9XyCreHezX218Vb5qDOU3vRl71CJGVH4nv28nBgWvtu017ITfh56CX9dZt7tFAUx198WqXxW1Xc+D9NggWHXUFyAD80+dkzoPH2mUrdhBYeXwlhwyp9+DLF0Up00kdLsjDtSHpDiKKoIvzk3m0K00GZkMtOOENpomAoqtUduUupYRmL1GaHBMJ+XcuLuyvfSI3uSK9BzFxIfNPcJdrP2F28g==,iv:xe7BrC5mLz48efufLup5v0x/aI0kaqXNQ07l4G6kUdg=,tag:yepSZfc3034JaYo2pp15CA==,type:str]
old-homepage: ENC[AES256_GCM,data:DgOLD0YCRXsRSvrjQ/pK4RpYdzcO/j2Ifg4eYXFivrEVVj5ooPKeeeJAMX+L+XOjjNmHo5r8o0AvBnvJ4TeGto3VOQynkxw5apvkedR5ecC654Sz5+bRGr2bgtVzujiLH7+IiB3ljH9KYflYASvfmumowmR8R6074GNGKZlH2F7UYDKDdbd48p4pOFWP3Lv5/1iDvJ7Ve3hVASZqiUlS4elMa+8T0HYKkJyxWb76AT+t0M54ps6xgqDYbjrmbO2+UK95Z8DanOk06tk1t30=,iv:2/KdwQ86SO/LFeHTGNDVY+d4ZQnujK7OGuBuGEwkCbU=,tag:7yOVg0V29aGMTT8O5422kw==,type:str]
postfixadmin:
dbpassword: ENC[AES256_GCM,data:37kEiKKgJVRIzzWXY3o/Wpk5UQ==,iv:LAJXgMr/rTMkds1r1kEWzhwNb6aPzsAhqUEeoLyBDbo=,tag:TI7oYxdpNzw2dXA4hLmVnQ==,type:str]
@ -75,8 +72,8 @@ sops:
N1lNTTRhSDFsczd4VjNudUU2NEt4MUEKdVJIJmaoGcwUHa0BGB45jqYnm9aPVZxP
dl1vkMx8EAiKhWKbBwQm5fFZcNh371rspGE7KOXmwNbNWef5bVfHpQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-04-29T16:33:22Z"
mac: ENC[AES256_GCM,data:VbhWyToSWgtXsdmsmvZJHOc01zBE6TrqZ7q2Sq2eCDLRTnBW24TGgmaNOLo9eY9ENo+k781xzsXOVgvZMhEY8TMVqycF0XbbqZielQfjP4vBvvnupSVxjfVLDBpmISQJkA56eYSQ6cPpj99NKjD7ag6V2gD7CW/JCfXVjsMap8s=,iv:ryO8KhxsQoK6s2oycXXSubI4jj7aPkjcctlsEWtTbzI=,tag:h+uU81PBNQ2QBhhBWDBz6A==,type:str]
lastmodified: "2022-05-03T08:42:43Z"
mac: ENC[AES256_GCM,data:pXoVXU61RUQnXK3IyximmyQWyAHCpm+MTFk5ucVht08zylw0c16pCSXxJOc4hlx0P+zi7sVAxqjalUd4ZJgL7fNDd4N9YiKrvgJrikMDsa9L7hz18vdX4dtKqH2F5jpwrP0hP1FdWZpnF96oXnwGI74iJLMtHx5dDtYdDLm6fdg=,iv:RY7HPFAgyaT5NCV/6Zaf5Du8XNyN6Xn6EWZ9t8br018=,tag:49cgIjWx2vgxUHJPErZeQQ==,type:str]
pgp:
- created_at: "2022-02-02T17:50:42Z"
enc: |

5
zones/int.chir.rs.nix
View file

@ -8,7 +8,7 @@ in
SOA = {
nameServer = "ns1.chir.rs.";
adminEmail = "lotte@chir.rs";
serial = 13;
serial = 14;
};
NS = [
"ns1.chir.rs."
@ -179,6 +179,9 @@ in
}
];
};
thinkrac.AAAA = [
(ttl zoneTTL (aaaa "fd0d:a262:1fa6:e621:bc9b:6a33:86e4:873b"))
];
nas = {
AAAA = [
(ttl zoneTTL (aaaa "fd0d:a262:1fa6:e621:bc9b:6a33:86e4:873b"))