You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

239 lines
5.3 KiB
Nix

let
secrets = import ../secrets.nix;
in {
network.description = "Cryto";
workbot = {config, lib, pkgs, ...}@args:
{
config = {
services.nginx = let
hostRoot = pkgs.writeTextDir "index.html" "Hello world!";
reverseProxy = target: {
proxyPass = target;
extraConfig = ''
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 443;
'';
};
requireTLS = {
enableACME = true;
forceSSL = true;
};
in {
enable = true;
virtualHosts = {
"_" = {
default = true;
root = hostRoot;
};
"hydra.cryto.net" = {
locations = {
"/" = reverseProxy "http://localhost:3333";
};
} // requireTLS;
"prometheus.cryto.net" = {
locations = {
"/" = reverseProxy "http://localhost:9090";
};
} // requireTLS;
"metrics.cryto.net" = {
locations = {
"/" = reverseProxy "http://localhost:8452";
};
} // requireTLS;
"nix-cache.cryto.net" = {
root = "/var/lib/hydra-builds";
} // requireTLS;
};
};
services.postgresql = {
enable = true;
};
services.hydra = {
enable = true;
port = 3333;
hydraURL = "http://hydra.cryto.net/";
notificationSender = "hydra@cryto.net";
useSubstitutes = false;
minimumDiskFree = 20;
minimumDiskFreeEvaluator = 20;
buildMachinesFiles = pkgs.lib.mkIf (config.nix.buildMachines == []) [];
extraConfig = ''
store_uri = file:///var/lib/hydra-builds?secret-key=/var/lib/hydra/binary-cache.key&write-nar-listing=1
binary_cache_public_uri = https://nix-cache.cryto.net
'';
};
/* FIXME: Declaratively define data sources; Grafana module for NixOS does not appear to support this yet? */
services.grafana = {
enable = true;
port = 8452;
rootUrl = "https://metrics.cryto.net/";
security = {
adminUser = secrets.grafana.username;
adminPassword = secrets.grafana.password;
};
auth = {
anonymous.enable = true;
};
};
services.prometheus = {
enable = true;
globalConfig = {
scrape_interval = "30s";
};
scrapeConfigs = let
nameInstance = address: name: {
source_labels = [ "__address__" ];
target_label = "instance";
regex = address;
replacement = name;
};
in [
{
job_name = "prometheus";
static_configs = [{
targets = [
"localhost:9090"
];
}];
relabel_configs = [
(nameInstance "localhost:9090" "workbot")
];
} {
job_name = "nodes";
scrape_interval = "10s";
static_configs = [{
targets = [
"localhost:9100"
"80.255.0.137:9100"
"64.187.233.73:9100"
];
}];
relabel_configs = [
(nameInstance "localhost:9100" "workbot")
(nameInstance "80.255.0.137:9100" "osmium")
(nameInstance "64.187.233.73:9100" "nijaxor")
];
}
];
exporters = {
node = {
enable = true;
enabledCollectors = [
"systemd"
];
};
};
};
networking.firewall.allowedTCPPorts = [
80
443
];
};
};
osmium = { config, lib, pkgs, ... }@args:
let
pastebinStream = (import ../applications/pastebin-stream.nix) args;
generateCaddyConfiguration = (import ../lib/generate/caddy-configuration.nix) args;
in let
proxiedApplications = [{
hostname = config.systems.osmium.applications.pastebin-stream.hostname;
tls = true;
proxyTarget = "http://localhost:3000";
}];
in
{
imports = [
(pastebinStream {
errorPath = "/var/lib/pastebin-stream/errors";
rev = "d7a09deda0916fa99920156e928d281a5bd3d97a";
sha256 = "08xjcwmbzdmkzbz1al3vkryiix1y2zqc8yv4lsrw21dz0c5zl726";
})
];
config = {
services.caddy = {
enable = true;
agree = true;
email = "admin@cryto.net";
config = ''
${generateCaddyConfiguration proxiedApplications}
'';
};
services.node-pastebin-stream = {
enable = true;
errorReporting = {
enable = true;
metadata = {
from = "ops@cryto.net";
to = "admin@cryto.net";
};
};
};
networking.firewall.allowedTCPPorts = [
80
443
9100 # Prometheus node exporter
];
environment.systemPackages = with pkgs; [
htop
];
services.prometheus.exporters = {
node = {
enable = true;
enabledCollectors = [
"systemd"
];
};
};
};
options.systems.osmium = with lib; {
applications.pastebin-stream = {
hostname = mkOption {
description = ''
The hostname to expose the pastebin-stream application on.
'';
type = types.str;
};
};
};
};
nijaxor = { config, lib, pkgs, ... }@args:
{
config = {
networking.firewall.allowedTCPPorts = [
9100 # Prometheus node exporter
];
services.prometheus.exporters = {
node = {
enable = true;
enabledCollectors = [
"systemd"
];
};
};
};
};
}