Compare commits

..

No commits in common. "6f8d95781c7e963e0b3c319277f15164264c095b" and "3de03a32aca4f691e9a42336be8e4af0c7cfa523" have entirely different histories.

3 changed files with 5 additions and 71 deletions

View file

@ -173,9 +173,6 @@ in {
# Various other security settings # Various other security settings
no-tlsv1 no-tlsv1
no-tlsv1_1 no-tlsv1_1
# Monitoring
prometheus
''; '';
}; };

View file

@ -1,7 +1,6 @@
{ {
pkgs, pkgs,
config, config,
lib,
... ...
}: let }: let
domain = "gitea.${config.services.nginx.domain}"; domain = "gitea.${config.services.nginx.domain}";
@ -20,23 +19,11 @@ in {
SSH_PORT = 2222; SSH_PORT = 2222;
}; };
metrics = {
ENABLED = true;
TOKEN = "#metricstoken#";
};
service.DISABLE_REGISTRATION = true; service.DISABLE_REGISTRATION = true;
session.COOKIE_SECURE = true; session.COOKIE_SECURE = true;
}; };
}; };
systemd.services.gitea.serviceConfig.ExecStartPre = let
replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
secretPath = config.sops.secrets."gitea/metrics-token".path;
runConfig = "${config.services.gitea.customDir}/conf/app.ini";
in [
"${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
];
# Set up SSL # Set up SSL
services.nginx.virtualHosts."${domain}" = let services.nginx.virtualHosts."${domain}" = let
httpAddress = config.services.gitea.settings.server.HTTP_ADDR; httpAddress = config.services.gitea.settings.server.HTTP_ADDR;
@ -50,14 +37,6 @@ in {
''; '';
locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}"; locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}";
locations."/metrics" = {
extraConfig = ''
access_log off;
allow 127.0.0.1;
${lib.optionalString config.networking.enableIPv6 "allow ::1;"}
deny all;
'';
};
}; };
# Block repeated failed login attempts # Block repeated failed login attempts

View file

@ -49,21 +49,9 @@ in {
}; };
services.prometheus.exporters = { services.prometheus.exporters = {
domain = {
enable = true;
listenAddress = "127.0.0.1";
extraFlags = let
conf.domains = [
"tlater.net"
"tlater.com"
];
in [
"--config=${yaml.generate "domains.yml" conf}"
];
};
node = { node = {
enable = true; enable = true;
enabledCollectors = ["systemd"];
listenAddress = "127.0.0.1"; listenAddress = "127.0.0.1";
}; };
@ -97,16 +85,6 @@ in {
}) })
config.services.nginx.virtualHosts; config.services.nginx.virtualHosts;
}; };
systemd = {
enable = true;
listenAddress = "127.0.0.1";
extraFlags = [
# Disabled by default because only supported from systemd 235+
"--systemd.collector.enable-restart-count"
"--systemd.collector.enable-ip-accounting"
];
};
}; };
services.prometheus.local-exporters = { services.prometheus.local-exporters = {
@ -138,30 +116,10 @@ in {
job_name = "tlater.net"; job_name = "tlater.net";
static_configs = [ static_configs = [
{ {
targets = let targets =
exporters = config.services.prometheus.exporters; lib.mapAttrsToList (name: exporter: "${exporter.listenAddress}:${toString exporter.port}")
localExporters = config.services.prometheus.local-exporters; (lib.filterAttrs (name: exporter: (builtins.isAttrs exporter) && exporter.enable)
in (config.services.prometheus.exporters // config.services.prometheus.local-exporters));
map (exporter: "${exporter.listenAddress}:${toString exporter.port}") [
exporters.domain
exporters.node
exporters.nginx
exporters.nginxlog
exporters.systemd
localExporters.prometheus-fail2ban-exporter
{
# coturn
listenAddress = "127.0.0.1";
port = "9641";
}
{
# gitea
listenAddress = "127.0.0.1";
port = "3000";
}
];
} }
]; ];
} }