From 30f34740891096471b5663704fbbd9bf67ebe885 Mon Sep 17 00:00:00 2001 From: adikro Date: Sun, 21 Jun 2026 22:37:42 +0200 Subject: updates and pinning omnisearch --- flake.lock | 84 ++++++++++++++----------------------- flake.nix | 3 +- hm/soft/browser.nix | 4 ++ hosts/desktop/configuration.nix | 10 ++--- hosts/desktop/home.nix | 1 + os/core/networking.nix | 78 +++++++++++++++++++++++++--------- os/srv/default.nix | 1 - os/srv/firewall.nix | 16 ------- os/srv/grafana.nix | 85 ++++++++++++++++++++++++++++++------- os/srv/loki.nix | 93 ++++++++++++++++++++++------------------- os/srv/netdata.nix | 23 ++++++---- os/srv/nginx.nix | 1 + os/srv/prometheus.nix | 50 +++++++++++----------- os/srv/vector.nix | 79 ++++++++++++++++++++++++++++++++++ os/vms/net-core.nix | 6 +-- 15 files changed, 340 insertions(+), 194 deletions(-) delete mode 100644 os/srv/firewall.nix create mode 100644 os/srv/vector.nix diff --git a/flake.lock b/flake.lock index a6b0dff..481872c 100644 --- a/flake.lock +++ b/flake.lock @@ -374,11 +374,11 @@ ] }, "locked": { - "lastModified": 1781642113, - "narHash": "sha256-mAR7KTS9rjreTcXCNqfCbN96mnhJO8lDQq1vl7GviBQ=", + "lastModified": 1782051614, + "narHash": "sha256-xBRAhYLEXcjp8hM2tkkTTLb6PWU7VDxDoogl25g7Ezs=", "owner": "nix-community", "repo": "home-manager", - "rev": "df4e0465717a2d34f05b8ccd967275aaf3ceaa01", + "rev": "d1ccd0721ec599866622665f3651e19e6e2d4c6a", "type": "github" }, "original": { @@ -417,11 +417,11 @@ "spectrum": "spectrum" }, "locked": { - "lastModified": 1781389237, - "narHash": "sha256-Ne1/E5XNUq0gleaQz0vW5R4xf/0h/uEZ+bOW1aNjeQk=", + "lastModified": 1781738058, + "narHash": "sha256-wgKY6pbZbFpBXae+8bjvJtW1Z9qekZergGly44n2qZw=", "owner": "microvm-nix", "repo": "microvm.nix", - "rev": "6ad601df0a07d9855c5e8f9b81135ecaf7c287eb", + "rev": "225b35c204e29efb5bbe9b55b1a38b07b3fca2af", "type": "github" }, "original": { @@ -480,28 +480,6 @@ "type": "github" } }, - "ndg": { - "inputs": { - "nixpkgs": [ - "nvf", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1779233504, - "narHash": "sha256-YIKEyzh0NFQlD0O92LQQNMoVCDwV8yw1Xz0Iu+4ZC5U=", - "owner": "feel-co", - "repo": "ndg", - "rev": "86f6644411a64d5413711895b7cf6e0e1be465b6", - "type": "github" - }, - "original": { - "owner": "feel-co", - "ref": "refs/tags/v2.8.0", - "repo": "ndg", - "type": "github" - } - }, "niri": { "inputs": { "niri-stable": "niri-stable", @@ -514,11 +492,11 @@ "xwayland-satellite-unstable": "xwayland-satellite-unstable" }, "locked": { - "lastModified": 1781610921, - "narHash": "sha256-PXyfDFGyW+UYteu3uHJgp49sFHRU16iocf5K2ltqn3M=", + "lastModified": 1781795508, + "narHash": "sha256-VKrApQ3WCkEe9D8DbaeFjGqLAh7zqYGYjbQYtY5ikxc=", "owner": "sodiboo", "repo": "niri-flake", - "rev": "e5857dc58304b3d5bbac6340820f7d4450688538", + "rev": "493ce1e33e72f86312584f331c8cf52b3432ec99", "type": "github" }, "original": { @@ -547,11 +525,11 @@ "niri-unstable": { "flake": false, "locked": { - "lastModified": 1781588278, - "narHash": "sha256-Fw/Zo0hwgn9ulgY5duQy51WHtqpNoLjNDZYLdEI1SS4=", + "lastModified": 1781781064, + "narHash": "sha256-Ii/koEm/sRyg65qbAQWqEgboSEIhdH0EL4KglAc14p0=", "owner": "YaLTeR", "repo": "niri", - "rev": "fdb6d85fc78355762bcf3cf71fe4037681a766f9", + "rev": "49fc6117fd6c043adaa2ead316b82db5ed735d36", "type": "github" }, "original": { @@ -589,11 +567,11 @@ ] }, "locked": { - "lastModified": 1781300555, - "narHash": "sha256-anhcFNgXdTEe1KPBAHvxLxDzjEbrt+YZ2O4tfq3WiRA=", + "lastModified": 1781892035, + "narHash": "sha256-e46EhlHo0jupcYCLE4QJRitd3+y+RgIQYNcfcCdLbKg=", "owner": "simple-nixos-mailserver", "repo": "nixos-mailserver", - "rev": "51726d7b7fd94aa69829fd42749a803914cbf3b7", + "rev": "c37fd9c40877450716692b6478e6dda330dfc46a", "type": "gitlab" }, "original": { @@ -720,11 +698,11 @@ "systems": "systems_2" }, "locked": { - "lastModified": 1781637822, - "narHash": "sha256-6Fwwt8BBGF5rqwGPhj/9ZMyyjXeJQzeHHJQfPuqJP3I=", + "lastModified": 1782062554, + "narHash": "sha256-v2J6/S33H2ms6jz3qr6in0UUlGFqUW46+iB3hMJDuD4=", "owner": "nix-community", "repo": "nixvim", - "rev": "d43c763fd9fae0912bdb4103cd842f26fea5b0ed", + "rev": "b3e7b2d2e568f29becae04217242ed18a90febc4", "type": "github" }, "original": { @@ -738,18 +716,17 @@ "flake-compat": "flake-compat_2", "flake-parts": "flake-parts_2", "mnw": "mnw", - "ndg": "ndg", "nixpkgs": [ "nixpkgs" ], "systems": "systems_3" }, "locked": { - "lastModified": 1781534482, - "narHash": "sha256-d3UIqXuigQhsc7amQkZ7F+SWnaJFAxIROE2f2X+pzUs=", + "lastModified": 1781997110, + "narHash": "sha256-6D6xtYN5t1kZGNd69eMZsRBkgX5Df1roErn/kFR1C+A=", "owner": "NotAShelf", "repo": "nvf", - "rev": "63d8fc82d652c23419a837e2b2934dd4bead04f3", + "rev": "320f60b97075a58d38b90fc5e39f478421dbd38a", "type": "github" }, "original": { @@ -776,6 +753,7 @@ "url": "https://git.bwaaa.monster/omnisearch" }, "original": { + "rev": "24f9909badd4e7aa1f3aeef717b93e9b71c20a4e", "shallow": false, "type": "git", "url": "https://git.bwaaa.monster/omnisearch" @@ -931,11 +909,11 @@ "rust-overlay": "rust-overlay" }, "locked": { - "lastModified": 1781585488, - "narHash": "sha256-NrD3WYckzuQ2oH4t5td4TWzzUtTF0SVrrIhKdU9IgLM=", + "lastModified": 1781902199, + "narHash": "sha256-VD/bm9ZinziQdfUZDeTXd4H+T+TQ5WHwWXK9FpOniUs=", "owner": "gabm", "repo": "Satty", - "rev": "1199a4417000b14105cf61e0b4ee2189a00796b4", + "rev": "32b2be3618a5617b196942b8fc023f998b44beca", "type": "github" }, "original": { @@ -994,11 +972,11 @@ ] }, "locked": { - "lastModified": 1780547341, - "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=", + "lastModified": 1781943681, + "narHash": "sha256-NFHmA7H47adqiyp+0iEOyZOQhmigDqA/NBAlf4imB6U=", "owner": "Mic92", "repo": "sops-nix", - "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a", + "rev": "420f8d2e9882911f65cfac15cc706f639ba96cca", "type": "github" }, "original": { @@ -1177,11 +1155,11 @@ "rust-overlay": "rust-overlay_2" }, "locked": { - "lastModified": 1781438303, - "narHash": "sha256-cBw2N3U0hoZO33s24Z/022AthIJtTnZk1jwgnxObfBY=", + "lastModified": 1781971032, + "narHash": "sha256-lxliQTpjaN1iF2ntK2gJ4UO55HM4w47Hcqwe6gBo85o=", "owner": "sxyazi", "repo": "yazi", - "rev": "f1e93d7f528b22fdeaf66b198c73e32a7040a90c", + "rev": "4f45ddb514c3db558da0c5fffabaaa44f18cc18e", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 7ea91e0..f925335 100644 --- a/flake.nix +++ b/flake.nix @@ -68,8 +68,7 @@ # Other omnisearch = { - # url = "git+https://git.bwaaa.monster/omnisearch"; - url = "git+https://git.bwaaa.monster/omnisearch?shallow=0"; + url = "git+https://git.bwaaa.monster/omnisearch?shallow=0&rev=24f9909badd4e7aa1f3aeef717b93e9b71c20a4e"; inputs.nixpkgs.follows = "nixpkgs"; }; diff --git a/hm/soft/browser.nix b/hm/soft/browser.nix index b53804e..1a87fe4 100644 --- a/hm/soft/browser.nix +++ b/hm/soft/browser.nix @@ -1,16 +1,20 @@ { config, lib, + inputs, + pkgs, ... }: let cfg = config.hm.soft.browser; + pkgs-stable = import inputs.nixpkgs-stable { inherit (pkgs) system; }; in { options.hm.soft.browser.librewolf.enable = lib.mkEnableOption "Enables the librewolf browser"; config = lib.mkIf cfg.librewolf.enable { programs.librewolf = { enable = true; + package = pkgs-stable.librewolf; # policies = { # DisableTelemetry = true; # DisableFirefoxStudies = true; diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix index d14cc88..7e78c91 100644 --- a/hosts/desktop/configuration.nix +++ b/hosts/desktop/configuration.nix @@ -43,7 +43,10 @@ size = 16; }; }; - network.enable = true; + network = { + enable = true; + enableFirewall = true; + }; security = { enable = true; sandboxing.enable = true; @@ -62,7 +65,6 @@ }; enableSigning = true; }; - firewall.enable = true; yggdrasil.enable = true; i2p.enable = true; tor = { @@ -116,8 +118,4 @@ config.boot.kernelPackages.nct6687d ]; }; - nixpkgs.config.permittedInsecurePackages = [ - "librewolf-151.0.2-1" - "librewolf-unwrapped-151.0.2-1" - ]; } diff --git a/hosts/desktop/home.nix b/hosts/desktop/home.nix index e4461cd..38f1469 100644 --- a/hosts/desktop/home.nix +++ b/hosts/desktop/home.nix @@ -97,5 +97,6 @@ tmux gimp stow + antigravity-cli ]; } diff --git a/os/core/networking.nix b/os/core/networking.nix index 6cfe4ad..638ecd4 100644 --- a/os/core/networking.nix +++ b/os/core/networking.nix @@ -10,22 +10,29 @@ in { options.os.core.network = { enable = lib.mkEnableOption "system-wide networking setup"; + enableFirewall = lib.mkEnableOption "integrated zero-trust nftables firewall layers"; + + isVM = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Set to true if this configuration is running inside a guest VM. Set to false for the bare-metal host."; + }; ips = lib.mkOption { type = lib.types.attrsOf lib.types.str; - default = { - router = "10.0.0.1"; + default = rec { + router = vm1-opnsense; host = "10.0.0.2"; - vm1-opnsense = "10.0.0.3"; - vm2-gateway = "10.0.0.4"; - vm3-monitor = "10.0.0.5"; - vm4-media = "10.0.0.6"; - vm5-sandbox = "10.0.0.7"; - vm6-storage = "10.0.0.8"; - vm7-web = "10.0.0.9"; - vm8-mail = "10.0.0.10"; - vm9-relays = "10.0.0.11"; - vm10-mc = "10.0.0.12"; + vm1-opnsense = "10.0.0.1"; + vm2-gateway = "10.0.0.3"; + vm3-monitor = "10.0.0.4"; + vm4-media = "10.0.0.5"; + vm5-sandbox = "10.0.0.6"; + vm6-storage = "10.0.0.7"; + vm7-web = "10.0.0.8"; + vm8-mail = "10.0.0.9"; + vm9-relays = "10.0.0.10"; + vm10-mc = "10.0.0.11"; }; description = "Central registry of static IP allocations for the cluster."; }; @@ -50,7 +57,7 @@ in }; range = lib.mkOption { type = lib.types.str; - default = "10.0.0.0/8"; + default = "10.0.0.0/24"; description = "The broader subnet block representing the physical home network."; }; }; @@ -116,6 +123,13 @@ in ]; }) + (lib.mkIf (cfg.profile == "client" && cfg.enableFirewall) { + networking = { + firewall.enable = true; + nftables.enable = true; + }; + }) + (lib.mkIf (cfg.profile == "server") { networking = { useNetworkd = true; @@ -123,24 +137,48 @@ in }; systemd.network = { enable = true; + wait-online.enable = lib.mkIf (!cfg.isVM) false; - netdevs."10-br-srv" = { - netdevConfig = { - Name = "br-srv"; - Kind = "bridge"; + netdevs = lib.mkIf (!cfg.isVM) { + "10-br-srv" = { + netdevConfig = { + Name = "br-srv"; + Kind = "bridge"; + }; }; }; networks."20-host-management" = { - matchConfig.Name = "br-srv"; - address = [ "10.0.0.2/24" ]; - gateway = [ "10.0.0.1" ]; + matchConfig.Name = if cfg.isVM then "eth0" else "br-srv"; + address = [ "${cfg.lan.ip}/24" ]; + gateway = [ cfg.ips.router ]; networkConfig.LinkLocalAddressing = "no"; }; }; boot.kernel.sysctl = { "net.ipv4.ip_nonlocal_bind" = 1; + "net.ipv4.ip_forward" = 1; }; }) + (lib.mkIf + ( + cfg.profile == "server" + && cfg.enableFirewall + && cfg.isVM + && config.networking.hostName != "vm2-gateway" + ) + { + networking.nftables.enable = true; + networking.firewall = { + enable = true; + extraCommands = '' + nft add table ip nat 2>/dev/null || true + nft flush table ip nat + nft add chain ip nat PREROUTING { type nat hook prerouting priority dstnat \; } + nft add rule ip nat PREROUTING ip saddr ${cfg.ips.vm2-gateway} ip daddr ${cfg.lan.ip} redirect + ''; + }; + } + ) ] ); } diff --git a/os/srv/default.nix b/os/srv/default.nix index a808328..34aa179 100644 --- a/os/srv/default.nix +++ b/os/srv/default.nix @@ -9,7 +9,6 @@ ./crowdsec.nix ./dns.nix ./files.nix - ./firewall.nix ./gaming.nix ./grafana.nix ./headscale.nix diff --git a/os/srv/firewall.nix b/os/srv/firewall.nix deleted file mode 100644 index bc06ffe..0000000 --- a/os/srv/firewall.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.os.srv.firewall; -in -{ - options.os.srv.firewall = { - enable = lib.mkEnableOption "enables the nixos firewall and nftables"; - }; - - config = lib.mkIf cfg.enable { - networking = { - firewall.enable = true; - nftables.enable = true; - }; - }; -} diff --git a/os/srv/grafana.nix b/os/srv/grafana.nix index 3e1333b..5428818 100644 --- a/os/srv/grafana.nix +++ b/os/srv/grafana.nix @@ -19,26 +19,80 @@ in config = lib.mkIf cfg.enable { services.grafana = { enable = true; - settings.server = { - http_addr = "127.0.0.1"; - http_port = 3000; + openFirewall = true; + + # Might use later + # declarativePlugins = [ ]; + + settings = { + server = { + protocol = "http"; + http_port = 3000; + http_addr = "0.0.0.0"; + domain = "grafana.${masterDomain}"; + root_url = "https://grafana.${masterDomain}"; + enforceDomain = true; + enable_gzip = true; + }; + database = { + wal = true; + }; + security = { + admin_user = "opc"; + # TODO: Generate password to use in sops-nix + # admin_password = "sops" + admin_email = "adikro@disroot.org"; + # TODO generate secret key and put it in sops-nix + # secret_key = "sops"; + disable_gravatar = true; + cookie_secure = true; + cookie_samesite = "lax"; + # security + allow_embedding = false; + strict_transport_security = true; + + disable_initial_admin_creation = false; + disable_brute_force_login_protection = false; + }; + # TODO setup mailing + # smtp = { enabled = true; }; + analytics.feedback_links_enabled = false; }; provision = { enable = true; - datasources.settings.datasources = [ - { - name = "Prometheus"; - type = "prometheus"; - url = "http://127.0.0.1:9090"; - } - { - name = "Loki"; - type = "loki"; - url = "http://127.0.0.1:3100"; - } - ]; + datasources.settings = { + prune = true; + + datasources = [ + { + name = "Prometheus"; + type = "prometheus"; + url = "http://127.0.0.1:9090"; + access = "proxy"; + isDefault = true; + editable = false; + } + { + name = "Loki"; + type = "loki"; + url = "http://127.0.0.1:3100"; + access = "proxy"; + editable = false; + } + ]; + }; }; + # dashboards.settings = { + # providers = [ + # { + # name = "default"; + # type = "file"; + # options.path = "/var/lib/grafana/dashboards"; + # } + # ]; + # }; }; + os.srv.grafana.proxyConfig = { "grafana.${masterDomain}" = { enableACME = true; @@ -46,6 +100,7 @@ in locations."/" = { proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000"; + proxyWebsockets = true; extraConfig = securityTemplates.restrictToInternal; }; }; diff --git a/os/srv/loki.nix b/os/srv/loki.nix index 2388432..84b94d8 100644 --- a/os/srv/loki.nix +++ b/os/srv/loki.nix @@ -1,9 +1,4 @@ -{ - config, - lib, - pkgs, - ... -}: +{ config, lib, ... }: let cfg = config.os.srv.loki; in @@ -12,46 +7,56 @@ in config = lib.mkIf cfg.enable { services.loki = { enable = true; - configFile = pkgs.writeText "loki-config.yaml" ( - builtins.toJSON { - auth_enabled = false; - server = { - http_listen_port = 3100; - }; - common = { - ring = { - kvstore = { - store = "inmemory"; - }; - }; - instance_interface_names = [ "lo" ]; + configuration = { + server = { + http_listen_address = "0.0.0.0"; + http_compress_responses = true; + }; + + common = { + instance_addr = "127.0.0.1"; + path_prefix = "/var/lib/loki"; + replication_factor = 1; + + storage.filesystem = { + chunks_directory = "/var/lib/loki/chunks"; + rules_directory = "/var/lib/loki/rules"; }; - ingester = { - lifecycler = { - address = "127.0.0.1"; + }; + + schema_config.configs = [ + { + from = "2026-01-01"; + store = "tsdb"; + object_store = "filesystem"; + schema = "v13"; + index = { + prefix = "loki_index_"; + period = "24h"; }; - }; - storage_config = { - filesystem = { - directory = "/var/lib/loki/chunks"; - }; - }; - schema_config = { - configs = [ - { - from = "2020-10-24"; - store = "tsdb"; - object_store = "filesystem"; - schema = "v13"; - index = { - prefix = "index_"; - period = "24h"; - }; - } - ]; - }; - } - ); + } + ]; + + ingester.wal.enabled = true; + + limits_config = { + max_entries_limit_per_query = 10000; + reject_old_samples_max_age = "720h"; + retention_period = "90d"; + volume_enabled = true; + }; + + compactor = { + enabled = true; + retention_enabled = true; + retention_delete_delay = "1h"; + compactor_window = "168h"; + }; + + querier.query_timeout = "5m"; + query_range.out_of_order_time_shifting = "5m"; + analytics.reporting_enabled = false; + }; }; }; } diff --git a/os/srv/netdata.nix b/os/srv/netdata.nix index 87854d4..a7b4300 100644 --- a/os/srv/netdata.nix +++ b/os/srv/netdata.nix @@ -9,7 +9,14 @@ let cfg = config.os.srv.netdata; in { - options.os.srv.netdata.enable = lib.mkEnableOption "enables netdata monitoring"; + options.os.srv.netdata = { + enable = lib.mkEnableOption "enables netdata monitoring"; + proxyConfig = lib.mkOption { + type = lib.types.attrs; + default = { }; + }; + }; + config = lib.mkIf cfg.enable { services.netdata = { enable = true; @@ -21,13 +28,15 @@ in }; }; - services.nginx.virtualHosts."netdata.${masterDomain}" = { - enableACME = true; - forceSSL = true; + os.srv.netdata.proxyConfig = { + "netdata.${masterDomain}" = { + enableACME = true; + forceSSL = true; - locations."/" = { - proxyPass = "http://127.0.0.1:19999"; - extraConfig = securityTemplates.restrictToInternal; + locations."/" = { + proxyPass = "http://${config.os.core.network.ips.host}:19999"; + extraConfig = securityTemplates.restrictToInternal; + }; }; }; }; diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix index a38b703..5161920 100644 --- a/os/srv/nginx.nix +++ b/os/srv/nginx.nix @@ -26,6 +26,7 @@ in allow ::1; allow ${config.os.core.network.lan.range}; + allow 10.1.0.0/24; allow ${config.os.core.network.wg.range}; allow ${config.os.core.network.hs.range}; diff --git a/os/srv/prometheus.nix b/os/srv/prometheus.nix index afccef4..5b133be 100644 --- a/os/srv/prometheus.nix +++ b/os/srv/prometheus.nix @@ -1,4 +1,9 @@ -{ config, lib, ... }: +{ + config, + lib, + masterDomain, + ... +}: let cfg = config.os.srv.prometheus; in @@ -9,26 +14,39 @@ in enable = true; port = 9090; - alertmanagers = [ - { - static_configs = [ { targets = [ "127.0.0.1:9093" ]; } ]; - } - ]; - scrapeConfigs = [ { job_name = "prometheus"; static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ]; } + { + job_name = "node-hardware"; + static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; + } { job_name = "node_exporter"; static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ]; } + { + job_name = "bare_metal_host_netdata"; + scheme = "https"; + metrics_path = "/api/v1/allmetrics"; + params = { + format = [ "prometheus" ]; + }; + static_configs = [ + { targets = [ "netdata.${masterDomain}" ]; } + ]; + } { job_name = "uptime_kuma"; metrics_path = "/metrics"; static_configs = [ { targets = [ "127.0.0.1:3001" ]; } ]; } + { + job_name = "network-latency"; + static_configs = [ { targets = [ "127.0.0.1:9374" ]; } ]; + } ]; exporters = { node = { @@ -37,28 +55,10 @@ in port = 9100; }; - alertmanager = { - enable = true; - port = 9093; - configuration = { - route = { - receiver = "default-receiver"; - group_by = [ "alertname" ]; - }; - receivers = [ - { - name = "default-receiver"; - } - ]; - }; - }; - smokeping = { enable = true; listenAddress = "127.0.0.1"; - pingInterval = "1s"; - hosts = [ "10.0.0.1" # Personal Router "192.168.0.1" # ISP Modem Box diff --git a/os/srv/vector.nix b/os/srv/vector.nix new file mode 100644 index 0000000..a216a19 --- /dev/null +++ b/os/srv/vector.nix @@ -0,0 +1,79 @@ +{ config, lib, ... }: +let + cfg = config.os.srv.vector; +in +{ + options.os.srv.vector = { + enable = lib.mkEnableOption "Vector observability data framework"; + agent.enable = lib.mkEnableOption "local client daemon to pull journals & stream upstream"; + aggregator.enable = lib.mkEnableOption "central receiver role to bundle, parse, and push to Loki"; + }; + + config = lib.mkIf cfg.enable { + services.vector = { + enable = true; + journaldAccess = lib.mkIf cfg.agent.enable true; + validateConfig = true; + + settings = lib.mkMerge [ + (lib.mkIf cfg.agent.enable { + sources.systemd_journal = { + type = "journald"; + exclude_units = [ "vector.service" ]; + }; + + transforms.filter_logs = { + type = "filter"; + inputs = [ "systemd_journal" ]; + condition = ''.status != "debug" && .status != "trace"''; + }; + + sinks.to_aggregator = { + type = "vector"; + inputs = [ "filter_logs" ]; + address = "${config.os.core.network.ips.vm3-monitor}:9000"; + }; + }) + + (lib.mkIf cfg.aggregator.enable { + sources.upstream_agents = { + type = "vector"; + address = "0.0.0.0:9000"; + version = "2"; + }; + + sources.opnsense_syslog = { + type = "syslog"; + address = "${cfg.aggregator.listenAddress}:5140"; + mode = "udp"; + }; + + sinks.loki_backend = { + type = "loki"; + inputs = [ + "upstream_agents" + "opnsense_syslog" + ]; + endpoint = "http://127.0.0.1:3100"; + labels = { + host = "{{ host }}"; + unit = "{{`{{_SYSTEMD_UNIT}}`}}"; + source_type = "{{ type }}"; + }; + buffer = { + type = "disk"; + max_size = 5 * (1024 * 1024 * 1024); + when_full = "block"; + }; + }; + encoding.codec = "json"; + }) + ]; + }; + + networking.firewall = lib.mkIf cfg.aggregator.enable { + allowedTCPPorts = [ 9000 ]; + allowedUDPPorts = [ 5140 ]; + }; + }; +} diff --git a/os/vms/net-core.nix b/os/vms/net-core.nix index 392aaf5..a9a1c47 100644 --- a/os/vms/net-core.nix +++ b/os/vms/net-core.nix @@ -1,8 +1,4 @@ -{ - pkgs, - inputs, - ... -}: +{ pkgs, inputs, ... }: { system.stateVersion = "26.11"; -- cgit v1.3