blob: 542881876d7fa5376369b596be2d93fbe4a451e9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
{
config,
lib,
masterDomain,
securityTemplates,
...
}:
let
cfg = config.os.srv.grafana;
in
{
options.os.srv.grafana = {
enable = lib.mkEnableOption "enables grafana";
proxyConfig = lib.mkOption {
type = lib.types.attrs;
default = { };
};
};
config = lib.mkIf cfg.enable {
services.grafana = {
enable = true;
openFirewall = true;
# Might use later
# declarativePlugins = [ ];
settings = {
server = {
protocol = "http";
http_port = 3000;
http_addr = "0.0.0.0";
domain = "grafana.${masterDomain}";
root_url = "https://grafana.${masterDomain}";
enforceDomain = true;
enable_gzip = true;
};
database = {
wal = true;
};
security = {
admin_user = "opc";
# TODO: Generate password to use in sops-nix
# admin_password = "sops"
admin_email = "adikro@disroot.org";
# TODO generate secret key and put it in sops-nix
# secret_key = "sops";
disable_gravatar = true;
cookie_secure = true;
cookie_samesite = "lax";
# security
allow_embedding = false;
strict_transport_security = true;
disable_initial_admin_creation = false;
disable_brute_force_login_protection = false;
};
# TODO setup mailing
# smtp = { enabled = true; };
analytics.feedback_links_enabled = false;
};
provision = {
enable = true;
datasources.settings = {
prune = true;
datasources = [
{
name = "Prometheus";
type = "prometheus";
url = "http://127.0.0.1:9090";
access = "proxy";
isDefault = true;
editable = false;
}
{
name = "Loki";
type = "loki";
url = "http://127.0.0.1:3100";
access = "proxy";
editable = false;
}
];
};
};
# dashboards.settings = {
# providers = [
# {
# name = "default";
# type = "file";
# options.path = "/var/lib/grafana/dashboards";
# }
# ];
# };
};
os.srv.grafana.proxyConfig = {
"grafana.${masterDomain}" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://${config.os.core.network.ips.vm2-gateway}:3000";
proxyWebsockets = true;
extraConfig = securityTemplates.restrictToInternal;
};
};
};
};
}
|
