tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 10 Pull requests Activity

gitea: Add monitoring

Browse source
This commit is contained in:
Tristan Daniël Maat 2023-10-07 04:15:52 +02:00
parent c373911a1b
commit 345159601e
Signed by: tlater
GPG key ID: 49670FD774E43268
4 changed files with 54 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
configuration/services/gitea.nix
View file

@ -1,6 +1,7 @@
{
pkgs,
config,
lib,
...
}: let
domain = "gitea.${config.services.nginx.domain}";
@ -19,11 +20,23 @@ in {
SSH_PORT = 2222;
};
metrics = {
ENABLED = true;
TOKEN = "#metricstoken#";
};
service.DISABLE_REGISTRATION = true;
session.COOKIE_SECURE = true;
};
};
systemd.services.gitea.serviceConfig.ExecStartPre = let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
secretPath = config.sops.secrets."gitea/metrics-token".path;
runConfig = "${config.services.gitea.customDir}/conf/app.ini";
in [
"+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
];
# Set up SSL
services.nginx.virtualHosts."${domain}" = let
httpAddress = config.services.gitea.settings.server.HTTP_ADDR;
@ -37,6 +50,14 @@ in {
'';
locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}";
locations."/metrics" = {
extraConfig = ''
access_log off;
allow 127.0.0.1;
${lib.optionalString config.networking.enableIPv6 "allow ::1;"}
deny all;
'';
};
};
# Block repeated failed login attempts

29
configuration/services/metrics/default.nix
View file

@ -138,12 +138,29 @@ in {
job_name = "tlater.net";
static_configs = [
{
targets =
lib.mapAttrsToList (name: exporter: "${exporter.listenAddress}:${toString exporter.port}")
(lib.filterAttrs (name: exporter: (builtins.isAttrs exporter) && exporter.enable)
(config.services.prometheus.exporters // config.services.prometheus.local-exporters))
++ [
"127.0.0.1:9641" # coturn
targets = let
exporters = config.services.prometheus.exporters;
localExporters = config.services.prometheus.local-exporters;
in
map (exporter: "${exporter.listenAddress}:${toString exporter.port}") [
exporters.domain
exporters.node
exporters.nginx
exporters.nginxlog
exporters.systemd
localExporters.prometheus-fail2ban-exporter
{
# coturn
listenAddress = "127.0.0.1";
port = "9641";
}
{
# gitea
listenAddress = "127.0.0.1";
port = "3000";
}
];
}
];