102 lines
2.7 KiB
Nix
102 lines
2.7 KiB
Nix
|
{
|
||
|
|
config,
|
||
|
|
pkgs,
|
||
|
|
lib,
|
||
|
|
...
|
||
|
|
}: let
|
||
|
|
yaml = pkgs.formats.yaml {};
|
||
|
|
in {
|
||
|
|
services.prometheus = {
|
||
|
|
exporters = {
|
||
|
|
# Periodically check domain registration status
|
||
|
|
domain = {
|
||
|
|
enable = true;
|
||
|
|
listenAddress = "127.0.0.1";
|
||
|
|
extraFlags = let
|
||
|
|
conf.domains = [
|
||
|
|
"tlater.net"
|
||
|
|
"tlater.com"
|
||
|
|
];
|
||
|
|
in [
|
||
|
|
"--config=${yaml.generate "domains.yml" conf}"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
# System statistics
|
||
|
|
node = {
|
||
|
|
enable = true;
|
||
|
|
listenAddress = "127.0.0.1";
|
||
|
|
};
|
||
|
|
systemd = {
|
||
|
|
enable = true;
|
||
|
|
listenAddress = "127.0.0.1";
|
||
|
|
extraFlags = [
|
||
|
|
# Disabled by default because only supported from systemd 235+
|
||
|
|
"--systemd.collector.enable-restart-count"
|
||
|
|
"--systemd.collector.enable-ip-accounting"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
# Various nginx metrics
|
||
|
|
nginx = {
|
||
|
|
enable = true;
|
||
|
|
listenAddress = "127.0.0.1";
|
||
|
|
};
|
||
|
|
|
||
|
|
nginxlog = {
|
||
|
|
enable = true;
|
||
|
|
listenAddress = "127.0.0.1";
|
||
|
|
group = "nginx";
|
||
|
|
|
||
|
|
settings.namespaces =
|
||
|
|
lib.mapAttrsToList (name: virtualHost: {
|
||
|
|
inherit name;
|
||
|
|
metrics_override.prefix = "nginxlog";
|
||
|
|
namespace_label = "vhost";
|
||
|
|
|
||
|
|
format = lib.concatStringsSep " " [
|
||
|
|
"$remote_addr - $remote_user [$time_local]"
|
||
|
|
''"$request" $status $body_bytes_sent''
|
||
|
|
''"$http_referer" "$http_user_agent"''
|
||
|
|
''rt=$request_time uct="$upstream_connect_time"''
|
||
|
|
''uht="$upstream_header_time" urt="$upstream_response_time"''
|
||
|
|
];
|
||
|
|
|
||
|
|
source.files = [
|
||
|
|
"/var/log/nginx/${name}/access.log"
|
||
|
|
];
|
||
|
|
})
|
||
|
|
config.services.nginx.virtualHosts;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
extraExporters = {
|
||
|
|
fail2ban = let
|
||
|
|
cfg = config.services.prometheus.extraExporters.fail2ban;
|
||
|
|
in {
|
||
|
|
port = 9191;
|
||
|
|
serviceOpts = {
|
||
|
|
after = ["fail2ban.service"];
|
||
|
|
requires = ["fail2ban.service"];
|
||
|
|
serviceConfig = {
|
||
|
|
Group = "fail2ban";
|
||
|
|
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
|
||
|
|
ExecStart = lib.concatStringsSep " " [
|
||
|
|
"${pkgs.local.prometheus-fail2ban-exporter}/bin/fail2ban-prometheus-exporter"
|
||
|
|
"--collector.f2b.socket=/var/run/fail2ban/fail2ban.sock"
|
||
|
|
"--web.listen-address='${cfg.listenAddress}:${toString cfg.port}'"
|
||
|
|
"--collector.f2b.exit-on-socket-connection-error=true"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
# TODO(tlater):
|
||
|
|
# - wireguard (?)
|
||
|
|
# - postgres (?)
|
||
|
|
# - blackbox (?) (curl to see if http and similar is up)
|
||
|
|
# - ssl_exporter (?)
|
||
|
|
};
|
||
|
|
}
|