summaryrefslogtreecommitdiff
path: root/os
diff options
context:
space:
mode:
Diffstat (limited to 'os')
-rw-r--r--os/core/networking.nix78
-rw-r--r--os/srv/default.nix1
-rw-r--r--os/srv/firewall.nix16
-rw-r--r--os/srv/grafana.nix85
-rw-r--r--os/srv/loki.nix93
-rw-r--r--os/srv/netdata.nix23
-rw-r--r--os/srv/nginx.nix1
-rw-r--r--os/srv/prometheus.nix50
-rw-r--r--os/srv/vector.nix79
-rw-r--r--os/vms/net-core.nix6
10 files changed, 299 insertions, 133 deletions
diff --git a/os/core/networking.nix b/os/core/networking.nix
index 6cfe4ad..638ecd4 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -10,22 +10,29 @@ in
{
options.os.core.network = {
enable = lib.mkEnableOption "system-wide networking setup";
+ enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers";
+
+ isVM = lib.mkOption {
+ type = lib.types.bool;
+ default = false;
+ description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host.";
+ };
ips = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
- default = {
- router = "10.0.0.1";
+ default = rec {
+ router = vm1-opnsense;
host = "10.0.0.2";
- vm1-opnsense = "10.0.0.3";
- vm2-gateway = "10.0.0.4";
- vm3-monitor = "10.0.0.5";
- vm4-media = "10.0.0.6";
- vm5-sandbox = "10.0.0.7";
- vm6-storage = "10.0.0.8";
- vm7-web = "10.0.0.9";
- vm8-mail = "10.0.0.10";
- vm9-relays = "10.0.0.11";
- vm10-mc = "10.0.0.12";
+ vm1-opnsense = "10.0.0.1";
+ vm2-gateway = "10.0.0.3";
+ vm3-monitor = "10.0.0.4";
+ vm4-media = "10.0.0.5";
+ vm5-sandbox = "10.0.0.6";
+ vm6-storage = "10.0.0.7";
+ vm7-web = "10.0.0.8";
+ vm8-mail = "10.0.0.9";
+ vm9-relays = "10.0.0.10";
+ vm10-mc = "10.0.0.11";
};
description = "Central registry of static IP allocations for the cluster.";
};
@@ -50,7 +57,7 @@ in
};
range = lib.mkOption {
type = lib.types.str;
- default = "10.0.0.0/8";
+ default = "10.0.0.0/24";
description = "The broader subnet block representing the physical home network.";
};
};
@@ -116,6 +123,13 @@ in
];
})
+ (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) {
+ networking = {
+ firewall.enable = true;
+ nftables.enable = true;
+ };
+ })
+
(lib.mkIf (cfg.profile == "server") {
networking = {
useNetworkd = true;
@@ -123,24 +137,48 @@ in
};
systemd.network = {
enable = true;
+ wait-online.enable = lib.mkIf (!cfg.isVM) false;
- netdevs."10-br-srv" = {
- netdevConfig = {
- Name = "br-srv";
- Kind = "bridge";
+ netdevs = lib.mkIf (!cfg.isVM) {
+ "10-br-srv" = {
+ netdevConfig = {
+ Name = "br-srv";
+ Kind = "bridge";
+ };
};
};
networks."20-host-management" = {
- matchConfig.Name = "br-srv";
- address = [ "10.0.0.2/24" ];
- gateway = [ "10.0.0.1" ];
+ matchConfig.Name = if cfg.isVM then "eth0" else "br-srv";
+ address = [ "${cfg.lan.ip}/24" ];
+ gateway = [ cfg.ips.router ];
networkConfig.LinkLocalAddressing = "no";
};
};
boot.kernel.sysctl = {
"net.ipv4.ip_nonlocal_bind" = 1;
+ "net.ipv4.ip_forward" = 1;
};
})
+ (lib.mkIf
+ (
+ cfg.profile == "server"
+ && cfg.enableFirewall
+ && cfg.isVM
+ && config.networking.hostName != "vm2-gateway"
+ )
+ {
+ networking.nftables.enable = true;
+ networking.firewall = {
+ enable = true;
+ extraCommands = ''
+ nft add table ip nat 2>/dev/null || true
+ nft flush table ip nat
+ nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; }
+ nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect
+ '';
+ };
+ }
+ )
]
);
}
diff --git a/os/srv/default.nix b/os/srv/default.nix
index a808328..34aa179 100644
--- a/os/srv/default.nix
+++ b/os/srv/default.nix
@@ -9,7 +9,6 @@
./crowdsec.nix
./dns.nix
./files.nix
- ./firewall.nix
./gaming.nix
./grafana.nix
./headscale.nix
diff --git a/os/srv/firewall.nix b/os/srv/firewall.nix
deleted file mode 100644
index bc06ffe..0000000
--- a/os/srv/firewall.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ config, lib, ... }:
-let
- cfg = config.os.srv.firewall;
-in
-{
- options.os.srv.firewall = {
- enable = lib.mkEnableOption "enables the nixos firewall and nftables";
- };
-
- config = lib.mkIf cfg.enable {
- networking = {
- firewall.enable = true;
- nftables.enable = true;
- };
- };
-}
diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix
index 3e1333b..5428818 100644
--- a/os/srv/grafana.nix
+++ b/os/srv/grafana.nix
@@ -19,26 +19,80 @@ in
config = lib.mkIf cfg.enable {
services.grafana = {
enable = true;
- settings.server = {
- http_addr = "127.0.0.1";
- http_port = 3000;
+ openFirewall = true;
+
+ # Might use later
+ # declarativePlugins = [ ];
+
+ settings = {
+ server = {
+ protocol = "http";
+ http_port = 3000;
+ http_addr = "0.0.0.0";
+ domain = "grafana.${masterDomain}";
+ root_url = "https://grafana.${masterDomain}";
+ enforceDomain = true;
+ enable_gzip = true;
+ };
+ database = {
+ wal = true;
+ };
+ security = {
+ admin_user = "opc";
+ # TODO: Generate password to use in sops-nix
+ # admin_password = "sops"
+ admin_email = "adikro@disroot.org";
+ # TODO generate secret key and put it in sops-nix
+ # secret_key = "sops";
+ disable_gravatar = true;
+ cookie_secure = true;
+ cookie_samesite = "lax";
+ # security
+ allow_embedding = false;
+ strict_transport_security = true;
+
+ disable_initial_admin_creation = false;
+ disable_brute_force_login_protection = false;
+ };
+ # TODO setup mailing
+ # smtp = { enabled = true; };
+ analytics.feedback_links_enabled = false;
};
provision = {
enable = true;
- datasources.settings.datasources = [
- {
- name = "Prometheus";
- type = "prometheus";
- url = "http://127.0.0.1:9090";
- }
- {
- name = "Loki";
- type = "loki";
- url = "http://127.0.0.1:3100";
- }
- ];
+ datasources.settings = {
+ prune = true;
+
+ datasources = [
+ {
+ name = "Prometheus";
+ type = "prometheus";
+ url = "http://127.0.0.1:9090";
+ access = "proxy";
+ isDefault = true;
+ editable = false;
+ }
+ {
+ name = "Loki";
+ type = "loki";
+ url = "http://127.0.0.1:3100";
+ access = "proxy";
+ editable = false;
+ }
+ ];
+ };
};
+ # dashboards.settings = {
+ # providers = [
+ # {
+ # name = "default";
+ # type = "file";
+ # options.path = "/var/lib/grafana/dashboards";
+ # }
+ # ];
+ # };
};
+
os.srv.grafana.proxyConfig = {
"grafana.${masterDomain}" = {
enableACME = true;
@@ -46,6 +100,7 @@ in
locations."/" = {
proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
+ proxyWebsockets = true;
extraConfig = securityTemplates.restrictToInternal;
};
};
diff --git a/os/srv/loki.nix b/os/srv/loki.nix
index 2388432..84b94d8 100644
--- a/os/srv/loki.nix
+++ b/os/srv/loki.nix
@@ -1,9 +1,4 @@
-{
- config,
- lib,
- pkgs,
- ...
-}:
+{ config, lib, ... }:
let
cfg = config.os.srv.loki;
in
@@ -12,46 +7,56 @@ in
config = lib.mkIf cfg.enable {
services.loki = {
enable = true;
- configFile = pkgs.writeText "loki-config.yaml" (
- builtins.toJSON {
- auth_enabled = false;
- server = {
- http_listen_port = 3100;
- };
- common = {
- ring = {
- kvstore = {
- store = "inmemory";
- };
- };
- instance_interface_names = [ "lo" ];
+ configuration = {
+ server = {
+ http_listen_address = "0.0.0.0";
+ http_compress_responses = true;
+ };
+
+ common = {
+ instance_addr = "127.0.0.1";
+ path_prefix = "/var/lib/loki";
+ replication_factor = 1;
+
+ storage.filesystem = {
+ chunks_directory = "/var/lib/loki/chunks";
+ rules_directory = "/var/lib/loki/rules";
};
- ingester = {
- lifecycler = {
- address = "127.0.0.1";
+ };
+
+ schema_config.configs = [
+ {
+ from = "2026-01-01";
+ store = "tsdb";
+ object_store = "filesystem";
+ schema = "v13";
+ index = {
+ prefix = "loki_index_";
+ period = "24h";
};
- };
- storage_config = {
- filesystem = {
- directory = "/var/lib/loki/chunks";
- };
- };
- schema_config = {
- configs = [
- {
- from = "2020-10-24";
- store = "tsdb";
- object_store = "filesystem";
- schema = "v13";
- index = {
- prefix = "index_";
- period = "24h";
- };
- }
- ];
- };
- }
- );
+ }
+ ];
+
+ ingester.wal.enabled = true;
+
+ limits_config = {
+ max_entries_limit_per_query = 10000;
+ reject_old_samples_max_age = "720h";
+ retention_period = "90d";
+ volume_enabled = true;
+ };
+
+ compactor = {
+ enabled = true;
+ retention_enabled = true;
+ retention_delete_delay = "1h";
+ compactor_window = "168h";
+ };
+
+ querier.query_timeout = "5m";
+ query_range.out_of_order_time_shifting = "5m";
+ analytics.reporting_enabled = false;
+ };
};
};
}
diff --git a/os/srv/netdata.nix b/os/srv/netdata.nix
index 87854d4..a7b4300 100644
--- a/os/srv/netdata.nix
+++ b/os/srv/netdata.nix
@@ -9,7 +9,14 @@ let
cfg = config.os.srv.netdata;
in
{
- options.os.srv.netdata.enable = lib.mkEnableOption "enables netdata monitoring";
+ options.os.srv.netdata = {
+ enable = lib.mkEnableOption "enables netdata monitoring";
+ proxyConfig = lib.mkOption {
+ type = lib.types.attrs;
+ default = { };
+ };
+ };
+
config = lib.mkIf cfg.enable {
services.netdata = {
enable = true;
@@ -21,13 +28,15 @@ in
};
};
- services.nginx.virtualHosts."netdata.${masterDomain}" = {
- enableACME = true;
- forceSSL = true;
+ os.srv.netdata.proxyConfig = {
+ "netdata.${masterDomain}" = {
+ enableACME = true;
+ forceSSL = true;
- locations."/" = {
- proxyPass = "http://127.0.0.1:19999";
- extraConfig = securityTemplates.restrictToInternal;
+ locations."/" = {
+ proxyPass = "http://${config.os.core.network.ips.host}:19999";
+ extraConfig = securityTemplates.restrictToInternal;
+ };
};
};
};
diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix
index a38b703..5161920 100644
--- a/os/srv/nginx.nix
+++ b/os/srv/nginx.nix
@@ -26,6 +26,7 @@ in
allow ::1;
allow ${config.os.core.network.lan.range};
+ allow 10.1.0.0/24;
allow ${config.os.core.network.wg.range};
allow ${config.os.core.network.hs.range};
diff --git a/os/srv/prometheus.nix b/os/srv/prometheus.nix
index afccef4..5b133be 100644
--- a/os/srv/prometheus.nix
+++ b/os/srv/prometheus.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+ config,
+ lib,
+ masterDomain,
+ ...
+}:
let
cfg = config.os.srv.prometheus;
in
@@ -9,26 +14,39 @@ in
enable = true;
port = 9090;
- alertmanagers = [
- {
- static_configs = [ { targets = [ "127.0.0.1:9093" ]; } ];
- }
- ];
-
scrapeConfigs = [
{
job_name = "prometheus";
static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ];
}
{
+ job_name = "node-hardware";
+ static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ];
+ }
+ {
job_name = "node_exporter";
static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ];
}
{
+ job_name = "bare_metal_host_netdata";
+ scheme = "https";
+ metrics_path = "/api/v1/allmetrics";
+ params = {
+ format = [ "prometheus" ];
+ };
+ static_configs = [
+ { targets = [ "netdata.${masterDomain}" ]; }
+ ];
+ }
+ {
job_name = "uptime_kuma";
metrics_path = "/metrics";
static_configs = [ { targets = [ "127.0.0.1:3001" ]; } ];
}
+ {
+ job_name = "network-latency";
+ static_configs = [ { targets = [ "127.0.0.1:9374" ]; } ];
+ }
];
exporters = {
node = {
@@ -37,28 +55,10 @@ in
port = 9100;
};
- alertmanager = {
- enable = true;
- port = 9093;
- configuration = {
- route = {
- receiver = "default-receiver";
- group_by = [ "alertname" ];
- };
- receivers = [
- {
- name = "default-receiver";
- }
- ];
- };
- };
-
smokeping = {
enable = true;
listenAddress = "127.0.0.1";
- pingInterval = "1s";
-
hosts = [
"10.0.0.1" # Personal Router
"192.168.0.1" # ISP Modem Box
diff --git a/os/srv/vector.nix b/os/srv/vector.nix
new file mode 100644
index 0000000..a216a19
--- /dev/null
+++ b/os/srv/vector.nix
@@ -0,0 +1,79 @@
+{ config, lib, ... }:
+let
+ cfg = config.os.srv.vector;
+in
+{
+ options.os.srv.vector = {
+ enable = lib.mkEnableOption "Vector observability data framework";
+ agent.enable = lib.mkEnableOption "local client daemon to pull journals & stream upstream";
+ aggregator.enable = lib.mkEnableOption "central receiver role to bundle, parse, and push to Loki";
+ };
+
+ config = lib.mkIf cfg.enable {
+ services.vector = {
+ enable = true;
+ journaldAccess = lib.mkIf cfg.agent.enable true;
+ validateConfig = true;
+
+ settings = lib.mkMerge [
+ (lib.mkIf cfg.agent.enable {
+ sources.systemd_journal = {
+ type = "journald";
+ exclude_units = [ "vector.service" ];
+ };
+
+ transforms.filter_logs = {
+ type = "filter";
+ inputs = [ "systemd_journal" ];
+ condition = ''.status != "debug" && .status != "trace"'';
+ };
+
+ sinks.to_aggregator = {
+ type = "vector";
+ inputs = [ "filter_logs" ];
+ address = "${config.os.core.network.ips.vm3-monitor}:9000";
+ };
+ })
+
+ (lib.mkIf cfg.aggregator.enable {
+ sources.upstream_agents = {
+ type = "vector";
+ address = "0.0.0.0:9000";
+ version = "2";
+ };
+
+ sources.opnsense_syslog = {
+ type = "syslog";
+ address = "${cfg.aggregator.listenAddress}:5140";
+ mode = "udp";
+ };
+
+ sinks.loki_backend = {
+ type = "loki";
+ inputs = [
+ "upstream_agents"
+ "opnsense_syslog"
+ ];
+ endpoint = "http://127.0.0.1:3100";
+ labels = {
+ host = "{{ host }}";
+ unit = "{{`{{_SYSTEMD_UNIT}}`}}";
+ source_type = "{{ type }}";
+ };
+ buffer = {
+ type = "disk";
+ max_size = 5 * (1024 * 1024 * 1024);
+ when_full = "block";
+ };
+ };
+ encoding.codec = "json";
+ })
+ ];
+ };
+
+ networking.firewall = lib.mkIf cfg.aggregator.enable {
+ allowedTCPPorts = [ 9000 ];
+ allowedUDPPorts = [ 5140 ];
+ };
+ };
+}
diff --git a/os/vms/net-core.nix b/os/vms/net-core.nix
index 392aaf5..a9a1c47 100644
--- a/os/vms/net-core.nix
+++ b/os/vms/net-core.nix
@@ -1,8 +1,4 @@
-{
- pkgs,
- inputs,
- ...
-}:
+{ pkgs, inputs, ... }:
{
system.stateVersion = "26.11";
generated by cgit v1.3 (git 2.53.0) at 2026-08-17 02:28:23 +0000