Kyren223/server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Extracted grafana-alloy to it's own module

Browse Source
This commit is contained in:
Kyren223
2025-08-03 18:45:41 +03:00
parent a233e376e8
commit 0f515f99c9
2 changed files with 62 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files

124
nixosModules/eko.nix
View File

@@ -1,135 +1,30 @@
{ pkgs, lib, config, ... }: {
{ lib, config, ... }: {
options = {
eko.enable = lib.mkEnableOption "enables eko";
};
config = lib.mkIf config.eko.enable {
users.groups.eko = { };
users.users.eko = {
createHome = false;
isNormalUser = true;
group = "eko";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7P9K9D5RkBk+JCRRS6AtHuTAc6cRpXfRfRMg/Kyren"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbntLELS9l2auPVZtCtQ6KYQNka72qDbTdkDtX9rkyJ"
];
};
# Open port 7223 for eko protocol, 443 for website
networking.firewall.allowedTCPPorts = [ 7223 443 ];
sops.secrets.eko-server-cert-key = { owner = "eko"; };
services.eko.enable = true;
services.eko.certFile = config.sops.secrets.eko-server-cert-key.path;
services.eko.openFirewall = true;
environment.etc = {
"eko/tos.md".text = builtins.readFile ./eko-tos.md;
"eko/privacy.md".text = builtins.readFile ./eko-privacy.md;
};
# systemd.services.eko = {
# description = "Eko - a secure terminal-based social media";
#
# wants = [ "network-online.target" ];
# after = [ "network-online.target" ];
# wantedBy = [ "multi-user.target" ];
#
# # restartTriggers = [ "/var/lib/eko/eko-server" ];
# reloadTriggers = lib.mapAttrsToList (_: v: v.source or null) (
# lib.filterAttrs (n: _: lib.hasPrefix "eko/" n) config.environment.etc
# );
#
# environment = {
# EKO_SERVER_CERT_FILE = config.sops.secrets.eko-server-cert-key.path;
# EKO_SERVER_LOG_DIR = "/var/log/eko";
# EKO_SERVER_TOS_FILE = "/etc/eko/tos.md";
# EKO_SERVER_PRIVACY_FILE = "/etc/eko/privacy.md";
# };
#
# serviceConfig = {
# Restart = "on-failure";
# RestartSec = "10s";
#
# ExecStart = "%S/eko/eko-server";
# ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
#
# ConfigurationDirectory = "eko";
# StateDirectory = "eko";
# LogsDirectory = "eko";
# WorkingDirectory = "%S/eko";
# Type = "simple";
#
# User = "eko";
# Group = "eko";
#
# # Hardening
# ProtectHostname = true;
# ProtectKernelLogs = true;
# ProtectKernelModules = true;
# ProtectKernelTunables = true;
# ProtectProc = "invisible";
# RestrictAddressFamilies = [
# "AF_INET"
# "AF_INET6"
# "AF_UNIX"
# ];
# RestrictNamespaces = true;
# RestrictRealtime = true;
# RestrictSUIDSGID = true;
# };
# };
# Enable metrics/logging
grafana.enable = true;
loki.enable = true;
environment.systemPackages = with pkgs; [
grafana-alloy
# Add my ssh key
users.users.eko.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7P9K9D5RkBk+JCRRS6AtHuTAc6cRpXfRfRMg/Kyren"
];
systemd.services.alloy = {
description = "Alloy";
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
reloadTriggers = lib.mapAttrsToList (_: v: v.source or null) (
lib.filterAttrs (n: _: lib.hasPrefix "alloy/" n && lib.hasSuffix ".alloy" n) config.environment.etc
);
serviceConfig = {
Restart = "always";
RestartSec = "2s";
User = "root"; # TODO: make these not root?
Group = "root";
SupplementaryGroups = [
# allow to read the systemd journal for loki log forwarding
"systemd-journal"
];
ConfigurationDirectory = "alloy";
StateDirectory = "alloy";
WorkingDirectory = "%S/alloy";
Type = "simple";
ExecStart = "${lib.getExe pkgs.grafana-alloy} run /etc/alloy/";
ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
};
};
environment.etc = {
"alloy/eko-config.alloy".text = builtins.readFile ./eko-config.alloy;
};
# Make sure acme module is active for the "kyren.codes" ssl cert
acme.enable = true;
# Website
# Configure reverse proxy for the website
services.nginx.enable = true;
services.nginx.virtualHosts."eko.kyren.codes" = {
useACMEHost = "kyren.codes";
@@ -137,5 +32,12 @@
locations."/".proxyPass = "http://localhost:7443/";
};
# Monitoring/observibility
grafana.enable = true; # dashboard
loki.enable = true; # logging
services.prometheus.enable = true; # metrics
services.prometheus.configText = builtins.readFile ./eko-prometheus.yml;
grafana-alloy.enable = true; # collector
};
}

49
nixosModules/grafana-alloy.nix Normal file
View File

@@ -0,0 +1,49 @@
{ pkgs, lib, config, ... }: {
options = {
grafana-alloy.enable = lib.mkEnableOption "enables grafana-alloy";
};
config = lib.mkIf config.grafana-alloy.enable {
environment.systemPackages = with pkgs; [
grafana-alloy
];
systemd.services.alloy = {
description = "Alloy";
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
reloadTriggers = lib.mapAttrsToList (_: v: v.source or null) (
lib.filterAttrs (n: _: lib.hasPrefix "alloy/" n && lib.hasSuffix ".alloy" n) config.environment.etc
);
serviceConfig = {
Restart = "always";
RestartSec = "2s";
User = "root"; # TODO: make these not root?
Group = "root";
SupplementaryGroups = [
# allow to read the systemd journal for loki log forwarding
"systemd-journal"
];
ConfigurationDirectory = "alloy";
StateDirectory = "alloy";
WorkingDirectory = "%S/alloy";
Type = "simple";
ExecStart = "${lib.getExe pkgs.grafana-alloy} run /etc/alloy/";
ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
};
};
environment.etc = {
"alloy/eko-config.alloy".text = builtins.readFile ./eko-config.alloy;
};
};
}