blob: a216a1934604c01dc70d358b16550dd70e3c8c51 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
{ config, lib, ... }:
let
cfg = config.os.srv.vector;
in
{
options.os.srv.vector = {
enable = lib.mkEnableOption "Vector observability data framework";
agent.enable = lib.mkEnableOption "local client daemon to pull journals & stream upstream";
aggregator.enable = lib.mkEnableOption "central receiver role to bundle, parse, and push to Loki";
};
config = lib.mkIf cfg.enable {
services.vector = {
enable = true;
journaldAccess = lib.mkIf cfg.agent.enable true;
validateConfig = true;
settings = lib.mkMerge [
(lib.mkIf cfg.agent.enable {
sources.systemd_journal = {
type = "journald";
exclude_units = [ "vector.service" ];
};
transforms.filter_logs = {
type = "filter";
inputs = [ "systemd_journal" ];
condition = ''.status != "debug" && .status != "trace"'';
};
sinks.to_aggregator = {
type = "vector";
inputs = [ "filter_logs" ];
address = "${config.os.core.network.ips.vm3-monitor}:9000";
};
})
(lib.mkIf cfg.aggregator.enable {
sources.upstream_agents = {
type = "vector";
address = "0.0.0.0:9000";
version = "2";
};
sources.opnsense_syslog = {
type = "syslog";
address = "${cfg.aggregator.listenAddress}:5140";
mode = "udp";
};
sinks.loki_backend = {
type = "loki";
inputs = [
"upstream_agents"
"opnsense_syslog"
];
endpoint = "http://127.0.0.1:3100";
labels = {
host = "{{ host }}";
unit = "{{`{{_SYSTEMD_UNIT}}`}}";
source_type = "{{ type }}";
};
buffer = {
type = "disk";
max_size = 5 * (1024 * 1024 * 1024);
when_full = "block";
};
};
encoding.codec = "json";
})
];
};
networking.firewall = lib.mkIf cfg.aggregator.enable {
allowedTCPPorts = [ 9000 ];
allowedUDPPorts = [ 5140 ];
};
};
}
|
