From 0f515f99c9887b856535f107f03ba33f1ef79a88 Mon Sep 17 00:00:00 2001 From: Kyren223 Date: Sun, 3 Aug 2025 18:45:41 +0300 Subject: [PATCH] Extracted grafana-alloy to it's own module --- nixosModules/eko.nix | 124 ++++----------------------------- nixosModules/grafana-alloy.nix | 49 +++++++++++++ 2 files changed, 62 insertions(+), 111 deletions(-) create mode 100644 nixosModules/grafana-alloy.nix diff --git a/nixosModules/eko.nix b/nixosModules/eko.nix index 99fd91f..3d9bd22 100644 --- a/nixosModules/eko.nix +++ b/nixosModules/eko.nix @@ -1,135 +1,30 @@ -{ pkgs, lib, config, ... }: { +{ lib, config, ... }: { options = { eko.enable = lib.mkEnableOption "enables eko"; }; config = lib.mkIf config.eko.enable { - users.groups.eko = { }; - users.users.eko = { - createHome = false; - isNormalUser = true; - group = "eko"; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7P9K9D5RkBk+JCRRS6AtHuTAc6cRpXfRfRMg/Kyren" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbntLELS9l2auPVZtCtQ6KYQNka72qDbTdkDtX9rkyJ" - ]; - }; - - # Open port 7223 for eko protocol, 443 for website - networking.firewall.allowedTCPPorts = [ 7223 443 ]; - sops.secrets.eko-server-cert-key = { owner = "eko"; }; services.eko.enable = true; services.eko.certFile = config.sops.secrets.eko-server-cert-key.path; + services.eko.openFirewall = true; environment.etc = { "eko/tos.md".text = builtins.readFile ./eko-tos.md; "eko/privacy.md".text = builtins.readFile ./eko-privacy.md; }; - # systemd.services.eko = { - # description = "Eko - a secure terminal-based social media"; - # - # wants = [ "network-online.target" ]; - # after = [ "network-online.target" ]; - # wantedBy = [ "multi-user.target" ]; - # - # # restartTriggers = [ "/var/lib/eko/eko-server" ]; - # reloadTriggers = lib.mapAttrsToList (_: v: v.source or null) ( - # lib.filterAttrs (n: _: lib.hasPrefix "eko/" n) config.environment.etc - # ); - # - # environment = { - # EKO_SERVER_CERT_FILE = config.sops.secrets.eko-server-cert-key.path; - # EKO_SERVER_LOG_DIR = "/var/log/eko"; - # EKO_SERVER_TOS_FILE = "/etc/eko/tos.md"; - # EKO_SERVER_PRIVACY_FILE = "/etc/eko/privacy.md"; - # }; - # - # serviceConfig = { - # Restart = "on-failure"; - # RestartSec = "10s"; - # - # ExecStart = "%S/eko/eko-server"; - # ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID"; - # - # ConfigurationDirectory = "eko"; - # StateDirectory = "eko"; - # LogsDirectory = "eko"; - # WorkingDirectory = "%S/eko"; - # Type = "simple"; - # - # User = "eko"; - # Group = "eko"; - # - # # Hardening - # ProtectHostname = true; - # ProtectKernelLogs = true; - # ProtectKernelModules = true; - # ProtectKernelTunables = true; - # ProtectProc = "invisible"; - # RestrictAddressFamilies = [ - # "AF_INET" - # "AF_INET6" - # "AF_UNIX" - # ]; - # RestrictNamespaces = true; - # RestrictRealtime = true; - # RestrictSUIDSGID = true; - # }; - # }; - - # Enable metrics/logging - grafana.enable = true; - loki.enable = true; - - environment.systemPackages = with pkgs; [ - grafana-alloy + # Add my ssh key + users.users.eko.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7P9K9D5RkBk+JCRRS6AtHuTAc6cRpXfRfRMg/Kyren" ]; - systemd.services.alloy = { - description = "Alloy"; - - wants = [ "network-online.target" ]; - after = [ "network-online.target" ]; - wantedBy = [ "multi-user.target" ]; - - reloadTriggers = lib.mapAttrsToList (_: v: v.source or null) ( - lib.filterAttrs (n: _: lib.hasPrefix "alloy/" n && lib.hasSuffix ".alloy" n) config.environment.etc - ); - - serviceConfig = { - Restart = "always"; - RestartSec = "2s"; - - User = "root"; # TODO: make these not root? - Group = "root"; - - SupplementaryGroups = [ - # allow to read the systemd journal for loki log forwarding - "systemd-journal" - ]; - - ConfigurationDirectory = "alloy"; - StateDirectory = "alloy"; - WorkingDirectory = "%S/alloy"; - Type = "simple"; - - ExecStart = "${lib.getExe pkgs.grafana-alloy} run /etc/alloy/"; - ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID"; - }; - }; - - environment.etc = { - "alloy/eko-config.alloy".text = builtins.readFile ./eko-config.alloy; - }; - # Make sure acme module is active for the "kyren.codes" ssl cert acme.enable = true; - # Website + # Configure reverse proxy for the website services.nginx.enable = true; services.nginx.virtualHosts."eko.kyren.codes" = { useACMEHost = "kyren.codes"; @@ -137,5 +32,12 @@ locations."/".proxyPass = "http://localhost:7443/"; }; + # Monitoring/observibility + grafana.enable = true; # dashboard + loki.enable = true; # logging + services.prometheus.enable = true; # metrics + services.prometheus.configText = builtins.readFile ./eko-prometheus.yml; + grafana-alloy.enable = true; # collector + }; } diff --git a/nixosModules/grafana-alloy.nix b/nixosModules/grafana-alloy.nix new file mode 100644 index 0000000..5ffd901 --- /dev/null +++ b/nixosModules/grafana-alloy.nix @@ -0,0 +1,49 @@ +{ pkgs, lib, config, ... }: { + + options = { + grafana-alloy.enable = lib.mkEnableOption "enables grafana-alloy"; + }; + + config = lib.mkIf config.grafana-alloy.enable { + environment.systemPackages = with pkgs; [ + grafana-alloy + ]; + + systemd.services.alloy = { + description = "Alloy"; + + wants = [ "network-online.target" ]; + after = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + + reloadTriggers = lib.mapAttrsToList (_: v: v.source or null) ( + lib.filterAttrs (n: _: lib.hasPrefix "alloy/" n && lib.hasSuffix ".alloy" n) config.environment.etc + ); + + serviceConfig = { + Restart = "always"; + RestartSec = "2s"; + + User = "root"; # TODO: make these not root? + Group = "root"; + + SupplementaryGroups = [ + # allow to read the systemd journal for loki log forwarding + "systemd-journal" + ]; + + ConfigurationDirectory = "alloy"; + StateDirectory = "alloy"; + WorkingDirectory = "%S/alloy"; + Type = "simple"; + + ExecStart = "${lib.getExe pkgs.grafana-alloy} run /etc/alloy/"; + ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID"; + }; + }; + + environment.etc = { + "alloy/eko-config.alloy".text = builtins.readFile ./eko-config.alloy; + }; + }; +}