tlaternet/tlaternet-server
1
0
Fork 0
Code Issues11 Pull requests Releases Activity

Compare commits

...

3 commits
ee760bfa1b ... 90809ec826

Author SHA1 Message Date
Tristan Daniël Maat 90809ec826
fix(victorialogs): Use new upstream module 2025-04-04 21:37:19 +08:00
Tristan Daniël Maat e37c589654
bump(crowdsec-hub): Update hub 2025-04-04 21:21:32 +08:00
Tristan Daniël Maat b396835f88
flake.lock: Update 
Flake lock file updates:

• Updated input 'conduwuit':
    'github:girlbossceo/conduwuit/0f81c1e1ccdcb0c5c6d5a27e82f16eb37b1e61c8' (2025-04-01)
  → 'github:girlbossceo/conduwuit/00f7745ec4ebcea5f892376c5de5db1299f71696' (2025-04-04)
• Updated input 'disko':
    'github:nix-community/disko/15dbf8cebd8e2655a883b74547108e089f051bf0' (2025-02-18)
  → 'github:nix-community/disko/329d3d7e8bc63dd30c39e14e6076db590a6eabe6' (2025-04-02)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/11415c7ae8539d6292f2928317ee7a8410b28bb9' (2025-02-21)
  → 'github:nixos/nixpkgs/bdb91860de2f719b57eef819b5617762f7120c70' (2025-04-03)
• Updated input 'nixpkgs-unstable':
    'github:nixos/nixpkgs/8465e233b0668cf162c608a92e62e8d78c1ba7e4' (2025-02-22)
  → 'github:nixos/nixpkgs/a462b946265ed006720d02153882780b12a8376d' (2025-04-04)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/07af005bb7d60c7f118d9d9f5530485da5d1e975' (2025-02-11)
  → 'github:Mic92/sops-nix/cff8437c5fe8c68fc3a840a21bf1f4dc801da40d' (2025-04-04)
 2025-04-04 21:21:31 +08:00
5 changed files with 34 additions and 122 deletions
configuration/services/metrics
grafana.nixvictorialogs.nix
flake.lock
pkgs/crowdsec/_sources
generated.jsongenerated.nix

2
configuration/services/metrics/grafana.nix
View file

@ -52,7 +52,7 @@ in
{
name = "Victorialogs - tlater.net";
url = "http://${config.services.victorialogs.bindAddress}";
url = "http://127.0.0.1::9428";
type = "victoriametrics-logs-datasource";
access = "proxy";
}

108
configuration/services/metrics/victorialogs.nix
View file

@ -1,110 +1,22 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.victorialogs;
pkg = pkgs.victoriametrics;
dirname = "victorialogs";
listenAddress = config.services.victorialogs.listenAddress;
bindAddress = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
in
{
options.services.victorialogs =
let
inherit (lib.types) str;
in
{
listenAddress = lib.mkOption {
default = ":9428";
type = str;
};
services.victorialogs.enable = true;
bindAddress = lib.mkOption {
readOnly = true;
type = str;
description = ''
Final address on which victorialogs listens.
'';
};
};
config = {
services.victorialogs.bindAddress =
(lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
services.journald.upload = {
enable = true;
settings.Upload = {
URL = "http://${cfg.bindAddress}/insert/journald";
NetworkTimeoutSec = "20s";
};
};
systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ];
systemd.services.victorialogs = {
description = "VictoriaLogs log database";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
startLimitBurst = 5;
serviceConfig = {
ExecStart = lib.escapeShellArgs [
"${pkg}/bin/victoria-logs"
"-storageDataPath=/var/lib/${dirname}"
"-httpListenAddr=${cfg.listenAddress}"
];
DynamicUser = true;
RestartSec = 1;
Restart = "on-failure";
RuntimeDirectory = dirname;
RuntimeDirectoryMode = "0700";
StateDirectory = dirname;
StateDirectoryMode = "0700";
LimitNOFILE = 1048576;
# Hardening
DeviceAllow = [ "/dev/null rw" ];
DevicePolicy = "strict";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
};
postStart = lib.mkBefore ''
until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${cfg.bindAddress}/ping; do
sleep 1;
done
'';
services.journald.upload = {
enable = true;
settings.Upload = {
URL = "http://${bindAddress}/insert/journald";
NetworkTimeoutSec = "20s";
};
};
systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ];
}

30
flake.lock
View file

@ -216,11 +216,11 @@
"rocksdb": "rocksdb"
},
"locked": {
"lastModified": 1743473828,
"narHash": "sha256-x/sfh6LCHGAz8rL23GHhH7dac1LtHBbRRJi1p8gOdtI=",
"lastModified": 1743735594,
"narHash": "sha256-aaP8OjY4fkpxk2JdSggx9S3Rk+P+VhuivT6aRpLxoj0=",
"owner": "girlbossceo",
"repo": "conduwuit",
"rev": "0f81c1e1ccdcb0c5c6d5a27e82f16eb37b1e61c8",
"rev": "00f7745ec4ebcea5f892376c5de5db1299f71696",
"type": "github"
},
"original": {
@ -499,11 +499,11 @@
]
},
"locked": {
"lastModified": 1739841949,
"narHash": "sha256-lSOXdgW/1zi/SSu7xp71v+55D5Egz8ACv0STkj7fhbs=",
"lastModified": 1743598667,
"narHash": "sha256-ViE7NoFWytYO2uJONTAX35eGsvTYXNHjWALeHAg8OQY=",
"owner": "nix-community",
"repo": "disko",
"rev": "15dbf8cebd8e2655a883b74547108e089f051bf0",
"rev": "329d3d7e8bc63dd30c39e14e6076db590a6eabe6",
"type": "github"
},
"original": {
@ -1278,11 +1278,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1740215764,
"narHash": "sha256-wzBbGGZ6i1VVBA/cDJaLfuuGYCUriD7fwsLgJJHRVRk=",
"lastModified": 1743732435,
"narHash": "sha256-RrWgOj3F1N6kDG0xatvZzP0p1Zq00yhcTMlaj4bWi5E=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "8465e233b0668cf162c608a92e62e8d78c1ba7e4",
"rev": "a462b946265ed006720d02153882780b12a8376d",
"type": "github"
},
"original": {
@ -1400,11 +1400,11 @@
},
"nixpkgs_6": {
"locked": {
"lastModified": 1740162160,
"narHash": "sha256-SSYxFhqCOb3aiPb6MmN68yEzBIltfom8IgRz7phHscM=",
"lastModified": 1743703532,
"narHash": "sha256-s1KLDALEeqy+ttrvqV3jx9mBZEvmthQErTVOAzbjHZs=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "11415c7ae8539d6292f2928317ee7a8410b28bb9",
"rev": "bdb91860de2f719b57eef819b5617762f7120c70",
"type": "github"
},
"original": {
@ -1727,11 +1727,11 @@
]
},
"locked": {
"lastModified": 1739262228,
"narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
"lastModified": 1743756170,
"narHash": "sha256-2b11EYa08oqDmF3zEBLkG1AoNn9rB1k39ew/T/mSvbU=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
"rev": "cff8437c5fe8c68fc3a840a21bf1f4dc801da40d",
"type": "github"
},
"original": {

8
pkgs/crowdsec/_sources/generated.json
View file

@ -21,7 +21,7 @@
},
"crowdsec-hub": {
"cargoLocks": null,
"date": "2025-02-22",
"date": "2025-04-04",
"extract": null,
"name": "crowdsec-hub",
"passthru": null,
@ -33,10 +33,10 @@
"name": null,
"owner": "crowdsecurity",
"repo": "hub",
"rev": "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df",
"sha256": "sha256-45pUln7Qj5luY9I9BE2qhzjH7kv4IbYvNoEX3/4AVVg=",
"rev": "eebc5f71379ea8f4de4a26f6695e0340444c719c",
"sha256": "sha256-/jhsqumekdOHDbHjBP8KvAICsSNhCg5ejMT3jSRiROo=",
"type": "github"
},
"version": "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df"
"version": "eebc5f71379ea8f4de4a26f6695e0340444c719c"
}
}

8
pkgs/crowdsec/_sources/generated.nix
View file

@ -14,14 +14,14 @@
};
crowdsec-hub = {
pname = "crowdsec-hub";
version = "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df";
version = "eebc5f71379ea8f4de4a26f6695e0340444c719c";
src = fetchFromGitHub {
owner = "crowdsecurity";
repo = "hub";
rev = "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df";
rev = "eebc5f71379ea8f4de4a26f6695e0340444c719c";
fetchSubmodules = false;
sha256 = "sha256-45pUln7Qj5luY9I9BE2qhzjH7kv4IbYvNoEX3/4AVVg=";
sha256 = "sha256-/jhsqumekdOHDbHjBP8KvAICsSNhCg5ejMT3jSRiROo=";
};
date = "2025-02-22";
date = "2025-04-04";
};
}