diff --git a/configuration/default.nix b/configuration/default.nix
index 5d491af..81e7241 100644
--- a/configuration/default.nix
+++ b/configuration/default.nix
@@ -16,8 +16,10 @@
./services/backups.nix
./services/conduit.nix
+ ./services/fail2ban.nix
./services/foundryvtt.nix
./services/gitea.nix
+ ./services/metrics
./services/nextcloud.nix
./services/webserver.nix
./services/wireguard.nix
@@ -136,34 +138,45 @@
recommendedProxySettings = true;
clientMaxBodySize = "10G";
domain = "tlater.net";
+
+ statusPage = true; # For metrics, should be accessible only from localhost
+
+ commonHttpConfig = ''
+ log_format upstream_time '$remote_addr - $remote_user [$time_local] '
+ '"$request" $status $body_bytes_sent '
+ '"$http_referer" "$http_user_agent" '
+ 'rt=$request_time uct="$upstream_connect_time" '
+ 'uht="$upstream_header_time" urt="$upstream_response_time"';
+ '';
};
+ services.logrotate = {
+ enable = true;
+
+ settings = lib.mapAttrs' (virtualHost: _:
+ lib.nameValuePair "/var/log/nginx/${virtualHost}/access.log" {
+ frequency = "daily";
+ rotate = 2;
+ compress = true;
+ delaycompress = true;
+ su = "${config.services.nginx.user} ${config.services.nginx.group}";
+ postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
+ })
+ config.services.nginx.virtualHosts;
+ };
+ systemd.tmpfiles.rules =
+ lib.mapAttrsToList (
+ virtualHost: _:
+ #
+ "d /var/log/nginx/${virtualHost} 0750 ${config.services.nginx.user} ${config.services.nginx.group}"
+ )
+ config.services.nginx.virtualHosts;
+
security.acme = {
defaults.email = "tm@tlater.net";
acceptTerms = true;
};
- services.fail2ban = {
- enable = true;
- extraPackages = [pkgs.ipset];
- banaction = "iptables-ipset-proto6-allports";
- bantime-increment.enable = true;
-
- jails = {
- nginx-botsearch = ''
- enabled = true
- logpath = /var/log/nginx/access.log
- '';
- };
-
- ignoreIP = [
- "127.0.0.0/8"
- "10.0.0.0/8"
- "172.16.0.0/12"
- "192.168.0.0/16"
- ];
- };
-
# Remove some unneeded packages
environment.defaultPackages = [];
diff --git a/configuration/services/conduit.nix b/configuration/services/conduit.nix
index 3f8fd40..8257592 100644
--- a/configuration/services/conduit.nix
+++ b/configuration/services/conduit.nix
@@ -173,6 +173,9 @@ in {
# Various other security settings
no-tlsv1
no-tlsv1_1
+
+ # Monitoring
+ prometheus
'';
};
@@ -205,6 +208,7 @@ in {
addSSL = true;
extraConfig = ''
merge_slashes off;
+ access_log /var/log/nginx/${domain}/access.log upstream_time;
'';
locations = {
diff --git a/configuration/services/fail2ban.nix b/configuration/services/fail2ban.nix
new file mode 100644
index 0000000..ace3219
--- /dev/null
+++ b/configuration/services/fail2ban.nix
@@ -0,0 +1,42 @@
+{pkgs, ...}: {
+ services.fail2ban = {
+ enable = true;
+ extraPackages = [pkgs.ipset];
+ banaction = "iptables-ipset-proto6-allports";
+ bantime-increment.enable = true;
+
+ jails = {
+ nginx-botsearch = ''
+ enabled = true
+ logpath = /var/log/nginx/access.log
+ '';
+ };
+
+ ignoreIP = [
+ "127.0.0.0/8"
+ "10.0.0.0/8"
+ "172.16.0.0/12"
+ "192.168.0.0/16"
+ ];
+ };
+
+ # Allow metrics services to connect to the socket as well
+ users.groups.fail2ban = {};
+ systemd.services.fail2ban.serviceConfig = {
+ ExecStartPost =
+ "+"
+ + (pkgs.writeShellScript "fail2ban-post-start" ''
+ while ! [ -S /var/run/fail2ban/fail2ban.sock ]; do
+ sleep 1
+ done
+
+ while ! ${pkgs.netcat}/bin/nc -zU /var/run/fail2ban/fail2ban.sock; do
+ sleep 1
+ done
+
+ ${pkgs.coreutils}/bin/chown root:fail2ban /var/run/fail2ban /var/run/fail2ban/fail2ban.sock
+ ${pkgs.coreutils}/bin/chmod 660 /var/run/fail2ban/fail2ban.sock
+ ${pkgs.coreutils}/bin/chmod 710 /var/run/fail2ban
+ '');
+ };
+}
diff --git a/configuration/services/foundryvtt.nix b/configuration/services/foundryvtt.nix
index 7bb2286..d573480 100644
--- a/configuration/services/foundryvtt.nix
+++ b/configuration/services/foundryvtt.nix
@@ -25,6 +25,7 @@ in {
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+ access_log /var/log/nginx/${domain}/access.log upstream_time;
'';
locations."/" = {
diff --git a/configuration/services/gitea.nix b/configuration/services/gitea.nix
index 27353f6..013842e 100644
--- a/configuration/services/gitea.nix
+++ b/configuration/services/gitea.nix
@@ -1,6 +1,7 @@
{
pkgs,
config,
+ lib,
...
}: let
domain = "gitea.${config.services.nginx.domain}";
@@ -19,11 +20,23 @@ in {
SSH_PORT = 2222;
};
+ metrics = {
+ ENABLED = true;
+ TOKEN = "#metricstoken#";
+ };
service.DISABLE_REGISTRATION = true;
session.COOKIE_SECURE = true;
};
};
+ systemd.services.gitea.serviceConfig.ExecStartPre = let
+ replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
+ secretPath = config.sops.secrets."gitea/metrics-token".path;
+ runConfig = "${config.services.gitea.customDir}/conf/app.ini";
+ in [
+ "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
+ ];
+
# Set up SSL
services.nginx.virtualHosts."${domain}" = let
httpAddress = config.services.gitea.settings.server.HTTP_ADDR;
@@ -33,9 +46,18 @@ in {
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+ access_log /var/log/nginx/${domain}/access.log upstream_time;
'';
locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}";
+ locations."/metrics" = {
+ extraConfig = ''
+ access_log off;
+ allow 127.0.0.1;
+ ${lib.optionalString config.networking.enableIPv6 "allow ::1;"}
+ deny all;
+ '';
+ };
};
# Block repeated failed login attempts
diff --git a/configuration/services/metrics/default.nix b/configuration/services/metrics/default.nix
new file mode 100644
index 0000000..4b163d3
--- /dev/null
+++ b/configuration/services/metrics/default.nix
@@ -0,0 +1,186 @@
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}: let
+ domain = "metrics.${config.services.nginx.domain}";
+ yaml = pkgs.formats.yaml {};
+in {
+ imports = [
+ ./exporters.nix
+ ];
+
+ services.victoriametrics.enable = true;
+
+ services.grafana = {
+ enable = true;
+ settings = {
+ server.http_port = 3001; # Default overlaps with gitea
+
+ security = {
+ admin_user = "tlater";
+ admin_password = "$__file{${config.sops.secrets."grafana/adminPassword".path}}";
+ secret_key = "$__file{${config.sops.secrets."grafana/secretKey".path}}";
+ cookie_secure = true;
+ cookie_samesite = "strict";
+ content_security_policy = true;
+ };
+
+ database = {
+ user = "grafana";
+ name = "grafana";
+ type = "postgres";
+ host = "/run/postgresql";
+ };
+ };
+
+ provision = {
+ enable = true;
+
+ datasources.settings.datasources = [
+ {
+ name = "Victoriametrics - tlater.net";
+ url = "http://localhost:8428";
+ type = "prometheus";
+ }
+ ];
+ };
+ };
+
+ services.prometheus.exporters = {
+ domain = {
+ enable = true;
+ listenAddress = "127.0.0.1";
+ extraFlags = let
+ conf.domains = [
+ "tlater.net"
+ "tlater.com"
+ ];
+ in [
+ "--config=${yaml.generate "domains.yml" conf}"
+ ];
+ };
+
+ node = {
+ enable = true;
+ listenAddress = "127.0.0.1";
+ };
+
+ nginx = {
+ enable = true;
+ listenAddress = "127.0.0.1";
+ };
+
+ nginxlog = {
+ enable = true;
+ listenAddress = "127.0.0.1";
+ group = "nginx";
+
+ settings.namespaces =
+ lib.mapAttrsToList (name: virtualHost: {
+ inherit name;
+ metrics_override.prefix = "nginxlog";
+ namespace_label = "vhost";
+
+ format = lib.concatStringsSep " " [
+ "$remote_addr - $remote_user [$time_local]"
+ ''"$request" $status $body_bytes_sent''
+ ''"$http_referer" "$http_user_agent"''
+ ''rt=$request_time uct="$upstream_connect_time"''
+ ''uht="$upstream_header_time" urt="$upstream_response_time"''
+ ];
+
+ source.files = [
+ "/var/log/nginx/${name}/access.log"
+ ];
+ })
+ config.services.nginx.virtualHosts;
+ };
+
+ systemd = {
+ enable = true;
+ listenAddress = "127.0.0.1";
+ extraFlags = [
+ # Disabled by default because only supported from systemd 235+
+ "--systemd.collector.enable-restart-count"
+ "--systemd.collector.enable-ip-accounting"
+ ];
+ };
+ };
+
+ services.prometheus.local-exporters = {
+ prometheus-fail2ban-exporter = rec {
+ enable = true;
+ after = ["fail2ban.service"];
+
+ port = 9191;
+ listenAddress = "127.0.0.1";
+
+ serviceConfig = {
+ Group = "fail2ban";
+
+ RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
+
+ ExecStart = lib.concatStringsSep " " [
+ "${pkgs.local.prometheus-fail2ban-exporter}/bin/fail2ban-prometheus-exporter"
+ "--collector.f2b.socket=/var/run/fail2ban/fail2ban.sock"
+ "--web.listen-address='${listenAddress}:${toString port}'"
+ ];
+ };
+ };
+ };
+
+ systemd.services.export-to-victoriametrics = let
+ promscrape = yaml.generate "prometheus.yml" {
+ scrape_configs = [
+ {
+ job_name = "tlater.net";
+ static_configs = [
+ {
+ targets = let
+ exporters = config.services.prometheus.exporters;
+ localExporters = config.services.prometheus.local-exporters;
+ in
+ map (exporter: "${exporter.listenAddress}:${toString exporter.port}") [
+ exporters.domain
+ exporters.node
+ exporters.nginx
+ exporters.nginxlog
+ exporters.systemd
+
+ localExporters.prometheus-fail2ban-exporter
+
+ {
+ # coturn
+ listenAddress = "127.0.0.1";
+ port = "9641";
+ }
+ {
+ # gitea
+ listenAddress = "127.0.0.1";
+ port = "3000";
+ }
+ ];
+ }
+ ];
+ }
+ ];
+ };
+ in {
+ enable = true;
+ path = [pkgs.victoriametrics];
+ wantedBy = ["multi-user.target"];
+ script = "vmagent -promscrape.config=${promscrape} -remoteWrite.url=http://localhost:8428/api/v1/write";
+ };
+
+ services.nginx.virtualHosts."${domain}" = {
+ forceSSL = true;
+ enableACME = true;
+ extraConfig = ''
+ add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+ access_log /var/log/nginx/${domain}/access.log upstream_time;
+ '';
+ locations."/".proxyPass = "http://localhost:3001";
+ };
+}
diff --git a/configuration/services/metrics/exporters.nix b/configuration/services/metrics/exporters.nix
new file mode 100644
index 0000000..fc56316
--- /dev/null
+++ b/configuration/services/metrics/exporters.nix
@@ -0,0 +1,45 @@
+{
+ config,
+ lib,
+ ...
+}: {
+ options.services.prometheus.local-exporters = lib.mkOption {
+ type = lib.types.anything;
+ };
+
+ config.systemd.services = lib.mapAttrs (_: exporter:
+ lib.mkMerge [
+ {
+ wantedBy = ["multi-user.target"];
+ after = ["network.target"];
+
+ serviceConfig = {
+ Restart = "always";
+ PrivateTmp = true;
+ WorkingDirectory = "/tmp";
+ DynamicUser = true;
+ LockPersonality = true;
+ MemoryDenyWriteExecute = true;
+ NonNewPrivileges = true;
+ PrivateDevices = true;
+ ProtectClock = true;
+ ProtectControlGroups = true;
+ ProtectHome = true;
+ ProtectHostname = true;
+ ProtectKernelLogs = true;
+ ProtectKernelModules = true;
+ ProtectKernelTunables = true;
+ ProtectSystem = "strict";
+ RemoveIPC = true;
+ RestrictAddressFamilies = lib.mkDefault ["AF_INET" "AF_INET6"];
+ RestrictNamespaces = true;
+ RestrictRealtime = true;
+ RestrictSUIDSGID = true;
+ SystemCallArchitectures = "native";
+ UMask = "0077";
+ };
+ }
+ (removeAttrs exporter ["port" "listenAddress"])
+ ])
+ config.services.prometheus.local-exporters;
+}
diff --git a/configuration/services/nextcloud.nix b/configuration/services/nextcloud.nix
index fbca607..81f38a3 100644
--- a/configuration/services/nextcloud.nix
+++ b/configuration/services/nextcloud.nix
@@ -50,6 +50,9 @@ in {
services.nginx.virtualHosts."${hostName}" = {
forceSSL = true;
enableACME = true;
+ extraConfig = ''
+ access_log /var/log/nginx/${hostName}/access.log upstream_time;
+ '';
};
# Block repeated failed login attempts
diff --git a/configuration/services/postgres.nix b/configuration/services/postgres.nix
index 6c584bb..923007d 100644
--- a/configuration/services/postgres.nix
+++ b/configuration/services/postgres.nix
@@ -16,6 +16,12 @@
# that operation needs to be performed manually on the system as
# well.
ensureUsers = [
+ {
+ name = "grafana";
+ ensurePermissions = {
+ "DATABASE grafana" = "ALL PRIVILEGES";
+ };
+ }
{
name = "nextcloud";
ensurePermissions = {
@@ -25,6 +31,7 @@
];
ensureDatabases = [
+ "grafana"
"nextcloud"
];
};
diff --git a/configuration/services/webserver.nix b/configuration/services/webserver.nix
index 4a8bee4..085b1f7 100644
--- a/configuration/services/webserver.nix
+++ b/configuration/services/webserver.nix
@@ -19,6 +19,7 @@ in {
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+ access_log /var/log/nginx/${domain}/access.log upstream_time;
'';
locations."/".proxyPass = "http://${addr}:${toString port}";
diff --git a/configuration/sops.nix b/configuration/sops.nix
index bf98433..190dd95 100644
--- a/configuration/sops.nix
+++ b/configuration/sops.nix
@@ -3,6 +3,22 @@
defaultSopsFile = ../keys/production.yaml;
secrets = {
+ # Gitea
+ "gitea/metrics-token" = {
+ owner = "gitea";
+ group = "gitea";
+ };
+
+ # Grafana
+ "grafana/adminPassword" = {
+ owner = "grafana";
+ group = "grafana";
+ };
+ "grafana/secretKey" = {
+ owner = "grafana";
+ group = "grafana";
+ };
+
# Heisenbridge
"heisenbridge/as-token" = {};
"heisenbridge/hs-token" = {};
diff --git a/flake.nix b/flake.nix
index b6db610..d8ff1a8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -78,7 +78,7 @@
# Utility scripts #
###################
packages.${system} = let
- inherit (nixpkgs.legacyPackages.${system}) writeShellScript;
+ inherit (nixpkgs.legacyPackages.${system}) writeShellScript writeShellScriptBin;
vm = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs.flake-inputs = inputs;
@@ -106,6 +106,14 @@
"${vm.config.system.build.vm}/bin/run-tlaternet-vm"
'';
+ update-pkgs = let
+ nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
+ in
+ writeShellScriptBin "update-pkgs" ''
+ cd "$(git rev-parse --show-toplevel)/pkgs"
+ ${nvfetcher-bin} -o _sources_pkgs -c nvfetcher.toml
+ '';
+
update-nextcloud-apps = let
nvfetcher-bin = "${nvfetcher.packages.${system}.default}/bin/nvfetcher";
in
diff --git a/keys/production.yaml b/keys/production.yaml
index f8d259d..87ef3c4 100644
--- a/keys/production.yaml
+++ b/keys/production.yaml
@@ -1,3 +1,5 @@
+metrics:
+ tlater: ENC[AES256_GCM,data:4nB0H45nlongb0x1OOKzNXIk96PovZ7OwENovnBZUwMl9ncfYwTHT30OlLsPA75w1govH0jyBRkn1Pe/qHzY1Zt53B8=,iv:AfZ4So6HnjOXzqiHM3WpOsQZJs2CEckuxGfyDxc4TNA=,tag:fIXOKJSVDLpLbiLd2zAu9w==,type:str]
nextcloud:
tlater: ENC[AES256_GCM,data:zNsPm4uFaIRe3LjcwmayRg==,iv:5wam6bP5zP708jC9UrLV0s8qspl3Pm4fPzbMFYBUyPQ=,tag:apnJUMeJwMn9q0NhO4ptmA==,type:str]
steam:
@@ -21,8 +23,8 @@ sops:
azure_kv: []
hc_vault: []
age: []
- lastmodified: "2023-09-23T18:55:44Z"
- mac: ENC[AES256_GCM,data:psqgXozY9L7nduZ11GF+mbIrZ4RUySqBixkWL5z0cYeoLA3URb/dr028LCmNgQS9l8aJVsjVkyLBJIU/8wmiUNqRy/VI5iqV5mu+sxXhUVwFL0dAAWP1lOKwwT5uGK89/ioqkphgzuWD37vGe2vYddKkJF0M+zlz12fqkMjaisU=,iv:UyRoJbfuGU3K/Mp5DQ1kY0Z+nKSSo46BGNAcxt+vAvc=,tag:HkP6+qxQ8J/xAYJXYoG/6g==,type:str]
+ lastmodified: "2023-09-25T00:42:25Z"
+ mac: ENC[AES256_GCM,data:28o/elUKslgn5auYfr34N9fE7B6EoZ6njL6yT0emjfoTjsCADJOLcHfUDNWb3AMP3Z5e/w8WsxI7MpwuwUXRvZ6u9Kui1IBcQu/V6GEzpBVw7JkLHZvsUFHOj/uEBcPvON7pKfXtG3vdH8FF1cxeenFm1Z0cX4C0WrNaxumGknA=,iv:GYK0/JZtCkbVorus+9HQbtxAnIXviiNkoC9dMqTHflM=,tag:R3N5hf/UV2nqyOI50Imr6g==,type:str]
pgp:
- created_at: "2022-10-12T00:46:51Z"
enc: |
diff --git a/keys/staging.yaml b/keys/staging.yaml
index a6b0849..73f0f94 100644
--- a/keys/staging.yaml
+++ b/keys/staging.yaml
@@ -1,3 +1,8 @@
+gitea:
+ metrics-token: ENC[AES256_GCM,data:J4QdfI1wKyM=,iv:8fqCbftyhj90eIVFxjEp9RXKC1y1IaLnV1r2MOdY15M=,tag:8W/juv1OZh4hJco02qXO6g==,type:str]
+grafana:
+ adminPassword: ENC[AES256_GCM,data:dYfaxUpQpzA=,iv:j5wSem8C5+V4c5qRzXQJhsU7/FOtpvrnaEyFBmW6zJ4=,tag:oc8n3TkEbjF2gjuOobZuLA==,type:str]
+ secretKey: ENC[AES256_GCM,data:Atruvh2MsNY=,iv:y2MaCUCEzGIydHp6G0DJHfk289S1is0twKm2oUYwDhM=,tag:nAWeg+YqaYqk6k22oBkAhQ==,type:str]
nextcloud:
tlater: ENC[AES256_GCM,data:91kDcO4hpng=,iv:ayuILRmRru4ZxTCur9H2xHuLjkDzwPdS/4lEog/tesU=,tag:qYhJxnNDcCwUM7xe7Tlcjw==,type:str]
steam:
@@ -21,8 +26,8 @@ sops:
azure_kv: []
hc_vault: []
age: []
- lastmodified: "2023-09-22T21:07:02Z"
- mac: ENC[AES256_GCM,data:gItC41S8MInLmikdH1okhPs+FVf8sCF/iQeJ5reigBunHkOngoc6nOFANyAcNZETszzhgTLXXtmVNEjW46v6K7D6nmoi/zwpedUxwzMwDC5I28VTMDHVMAThYSGtdo6kig8i2pi8rzEQd1DStxMv3TWML5y6DDTlFsd3lfudaHA=,iv:zXebvIVPR76GwUhpactwRgF/eEmx2OBkT18E8lkwzRA=,tag:6HyISACbFCGlpIIgkFeA/A==,type:str]
+ lastmodified: "2023-10-07T02:17:50Z"
+ mac: ENC[AES256_GCM,data:vZDq33YIn0Nf1FQ2+ySezox6igiw6zNFCu3l3kaIsBKo1797pohmAxj2Lcc+OmlBjj98khaBIlbQuA5ULM+uPN5ILaz3NuXD5PZtsV+rL2PsLNMW9FBSmJ0m0YQrt0nZ0tpzifn12XghcSK2IXv+FnxlfrAJCxDvr5tRm90uUwU=,iv:ct8CzIWjaoJ1UjZcdFSr8lZ626vA0RvM883V6H5plWc=,tag:waJNtp/UbRDOfyzNElrung==,type:str]
pgp:
- created_at: "2022-10-12T16:48:23Z"
enc: |
diff --git a/pkgs/_sources_pkgs/generated.json b/pkgs/_sources_pkgs/generated.json
new file mode 100644
index 0000000..b3faf9a
--- /dev/null
+++ b/pkgs/_sources_pkgs/generated.json
@@ -0,0 +1,21 @@
+{
+ "prometheus-fail2ban-exporter": {
+ "cargoLocks": null,
+ "date": null,
+ "extract": null,
+ "name": "prometheus-fail2ban-exporter",
+ "passthru": null,
+ "pinned": false,
+ "src": {
+ "deepClone": false,
+ "fetchSubmodules": false,
+ "leaveDotGit": false,
+ "name": null,
+ "rev": "v0.10.0",
+ "sha256": "sha256-8nIW1XaHCBqQCoLkV1ZYE3NTbVZ6c+UOqYD08XQiv+4=",
+ "type": "git",
+ "url": "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter"
+ },
+ "version": "v0.10.0"
+ }
+}
\ No newline at end of file
diff --git a/pkgs/_sources_pkgs/generated.nix b/pkgs/_sources_pkgs/generated.nix
new file mode 100644
index 0000000..bb015b4
--- /dev/null
+++ b/pkgs/_sources_pkgs/generated.nix
@@ -0,0 +1,16 @@
+# This file was generated by nvfetcher, please do not modify it manually.
+{ fetchgit, fetchurl, fetchFromGitHub, dockerTools }:
+{
+ prometheus-fail2ban-exporter = {
+ pname = "prometheus-fail2ban-exporter";
+ version = "v0.10.0";
+ src = fetchgit {
+ url = "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter";
+ rev = "v0.10.0";
+ fetchSubmodules = false;
+ deepClone = false;
+ leaveDotGit = false;
+ sha256 = "sha256-8nIW1XaHCBqQCoLkV1ZYE3NTbVZ6c+UOqYD08XQiv+4=";
+ };
+ };
+}
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 3818a26..3130ae0 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -7,6 +7,9 @@
in
{
starbound = callPackage ./starbound {};
+ prometheus-fail2ban-exporter = callPackage ./prometheus/fail2ban-exporter.nix {
+ sources = pkgs.callPackage ./_sources_pkgs/generated.nix {};
+ };
}
// (
# Add nextcloud apps
diff --git a/pkgs/nvfetcher.toml b/pkgs/nvfetcher.toml
new file mode 100644
index 0000000..8c53200
--- /dev/null
+++ b/pkgs/nvfetcher.toml
@@ -0,0 +1,3 @@
+[prometheus-fail2ban-exporter]
+src.manual = "v0.10.0" # No gitlab support in nvfetcher
+fetch.git = "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter"
diff --git a/pkgs/prometheus/fail2ban-exporter.nix b/pkgs/prometheus/fail2ban-exporter.nix
new file mode 100644
index 0000000..50b4973
--- /dev/null
+++ b/pkgs/prometheus/fail2ban-exporter.nix
@@ -0,0 +1,8 @@
+{
+ buildGoModule,
+ sources,
+}:
+buildGoModule {
+ inherit (sources.prometheus-fail2ban-exporter) pname src version;
+ vendorHash = "sha256-qU6opwhhvzbQOhfGVyiVgKhfCSB0Z4eSRAJnv6ht2I0=";
+}