90 lines
2.4 KiB
Nix
90 lines
2.4 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
vars = import ./vars.nix config;
|
|
domain = vars.domain;
|
|
in
|
|
{
|
|
|
|
# vnStat for tracking network interface stats
|
|
services.vnstat.enable = true;
|
|
|
|
# https://wiki.nixos.org/wiki/Prometheus
|
|
services.prometheus = {
|
|
enable = true;
|
|
exporters = {
|
|
# TODO: DNS, Kea, Knot, other exporters
|
|
node = {
|
|
enable = true;
|
|
enabledCollectors = [ "systemd" ];
|
|
};
|
|
};
|
|
scrapeConfigs = [
|
|
{
|
|
job_name = "node";
|
|
static_configs = [{
|
|
targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
|
|
}];
|
|
}
|
|
];
|
|
};
|
|
|
|
# https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
|
|
services.grafana = {
|
|
enable = true;
|
|
settings = {
|
|
security.allow_embedding = true;
|
|
server = {
|
|
http_port = 3001;
|
|
domain = "grouter.${domain}";
|
|
root_url = "https://%(domain)s/grafana/";
|
|
serve_from_sub_path = true;
|
|
};
|
|
};
|
|
provision = {
|
|
enable = true;
|
|
datasources.settings.datasources = [
|
|
{
|
|
name = "Prometheus";
|
|
type = "prometheus";
|
|
url = "http://localhost:${toString config.services.prometheus.port}";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
secrix.system.secrets.cf-api-key.encrypted.file = ./secrets/cf-api-key.age;
|
|
systemd.services.caddy.serviceConfig.EnvironmentFile = config.secrix.system.secrets.cf-api-key.decrypted.path;
|
|
services.caddy = {
|
|
enable = true;
|
|
package = pkgs.caddy.withPlugins {
|
|
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
|
|
hash = "sha256-2D7dnG50CwtCho+U+iHmSj2w14zllQXPjmTHr6lJZ/A=";
|
|
};
|
|
virtualHosts."*.${domain}".extraConfig = ''
|
|
encode
|
|
tls {
|
|
dns cloudflare {env.CF_API_KEY}
|
|
resolvers 1.1.1.1
|
|
}
|
|
|
|
@grouter host grouter.${domain}
|
|
handle @grouter {
|
|
@grafana path /grafana /grafana/*
|
|
handle @grafana {
|
|
reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
|
|
}
|
|
redir /adghome /adghome/
|
|
handle_path /adghome/* {
|
|
reverse_proxy localhost:${toString config.services.adguardhome.port}
|
|
basic_auth {
|
|
Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
|
|
}
|
|
}
|
|
handle /* {
|
|
reverse_proxy localhost:${toString config.services.glance.settings.server.port}
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
}
|