Compare commits
1 commit
master
...
tlater/stu
| Author | SHA1 | Date | |
|---|---|---|---|
 Tristan Daniël Maat
|
79786fc5d9
|
|
|
@ -22,6 +22,7 @@
|
|||
./services/foundryvtt.nix
|
||||
./services/gitea.nix
|
||||
./services/metrics
|
||||
./services/minecraft.nix
|
||||
./services/nextcloud.nix
|
||||
./services/webserver.nix
|
||||
./services/wireguard.nix
|
||||
|
|
@ -70,8 +71,6 @@
|
|||
8448
|
||||
# starbound
|
||||
21025
|
||||
# Minecraft
|
||||
25565
|
||||
|
||||
config.services.coturn.listening-port
|
||||
config.services.coturn.tls-listening-port
|
||||
|
|
@ -80,9 +79,6 @@
|
|||
];
|
||||
|
||||
allowedUDPPorts = [
|
||||
# More minecraft
|
||||
25565
|
||||
|
||||
config.services.coturn.listening-port
|
||||
config.services.coturn.tls-listening-port
|
||||
config.services.coturn.alt-listening-port
|
||||
|
|
|
|||
|
|
@ -5,6 +5,5 @@
|
|||
./exporters.nix
|
||||
./grafana.nix
|
||||
./victoriametrics.nix
|
||||
./victorialogs.nix
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,9 +1,4 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
flake-inputs,
|
||||
...
|
||||
}:
|
||||
{ config, ... }:
|
||||
let
|
||||
domain = "metrics.${config.services.nginx.domain}";
|
||||
in
|
||||
|
|
@ -33,11 +28,6 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
declarativePlugins = [
|
||||
pkgs.grafanaPlugins.victoriametrics-metrics-datasource
|
||||
flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.grafanaPlugins.victoriametrics-logs-datasource
|
||||
];
|
||||
|
||||
provision = {
|
||||
enable = true;
|
||||
|
||||
|
|
@ -45,16 +35,7 @@ in
|
|||
{
|
||||
name = "Victoriametrics - tlater.net";
|
||||
url = "http://localhost:8428";
|
||||
type = "victoriametrics-metrics-datasource";
|
||||
access = "proxy";
|
||||
isDefault = true;
|
||||
}
|
||||
|
||||
{
|
||||
name = "Victorialogs - tlater.net";
|
||||
url = "http://${config.services.victorialogs.bindAddress}";
|
||||
type = "victoriametrics-logs-datasource";
|
||||
access = "proxy";
|
||||
type = "prometheus";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,110 +0,0 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.victorialogs;
|
||||
pkg = pkgs.victoriametrics;
|
||||
dirname = "victorialogs";
|
||||
in
|
||||
{
|
||||
options.services.victorialogs =
|
||||
let
|
||||
inherit (lib.types) str;
|
||||
in
|
||||
{
|
||||
listenAddress = lib.mkOption {
|
||||
default = ":9428";
|
||||
type = str;
|
||||
};
|
||||
|
||||
bindAddress = lib.mkOption {
|
||||
readOnly = true;
|
||||
type = str;
|
||||
description = ''
|
||||
Final address on which victorialogs listens.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
services.victorialogs.bindAddress =
|
||||
(lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
|
||||
|
||||
services.journald.upload = {
|
||||
enable = true;
|
||||
settings.Upload = {
|
||||
URL = "http://${cfg.bindAddress}/insert/journald";
|
||||
NetworkTimeoutSec = "20s";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ];
|
||||
|
||||
systemd.services.victorialogs = {
|
||||
description = "VictoriaLogs log database";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
startLimitBurst = 5;
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = lib.escapeShellArgs [
|
||||
"${pkg}/bin/victoria-logs"
|
||||
"-storageDataPath=/var/lib/${dirname}"
|
||||
"-httpListenAddr=${cfg.listenAddress}"
|
||||
];
|
||||
|
||||
DynamicUser = true;
|
||||
RestartSec = 1;
|
||||
Restart = "on-failure";
|
||||
RuntimeDirectory = dirname;
|
||||
RuntimeDirectoryMode = "0700";
|
||||
StateDirectory = dirname;
|
||||
StateDirectoryMode = "0700";
|
||||
|
||||
LimitNOFILE = 1048576;
|
||||
|
||||
# Hardening
|
||||
DeviceAllow = [ "/dev/null rw" ];
|
||||
DevicePolicy = "strict";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "full";
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
};
|
||||
|
||||
postStart = lib.mkBefore ''
|
||||
until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${cfg.bindAddress}/ping; do
|
||||
sleep 1;
|
||||
done
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
83
configuration/services/minecraft.nix
Normal file
83
configuration/services/minecraft.nix
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
services.minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
# jvmOpts are set using a file for forge
|
||||
# jvmOpts = "-Xmx8G -Xms8G";
|
||||
openFirewall = true;
|
||||
|
||||
declarative = true;
|
||||
|
||||
whitelist = {
|
||||
tlater = "140d177a-966f-41b8-a4c0-e305babd291b";
|
||||
romino25 = "59cd1648-14a4-4bcf-8f5a-2e1bde678f2c";
|
||||
lasi25 = "0ab6e3d1-544a-47e7-8538-2e6c248e49a4";
|
||||
};
|
||||
|
||||
serverProperties = {
|
||||
allow-flight = true;
|
||||
difficulty = "hard";
|
||||
motd = "tlater.net";
|
||||
spawn-protection = 1;
|
||||
white-list = true;
|
||||
enable-query = true;
|
||||
enable-status = true;
|
||||
|
||||
# Allows the server to write chunks without hogging the main
|
||||
# thread...
|
||||
sync-chunk-writes = false;
|
||||
# Disables chat reporting, because we don't need any of that
|
||||
# drama on a lil' friends-only server.
|
||||
enforce-secure-profile = false;
|
||||
};
|
||||
|
||||
package = pkgs.writeShellApplication {
|
||||
name = "minecraft-server";
|
||||
runtimeInputs = with pkgs; [ jdk17_headless ];
|
||||
|
||||
text = ''
|
||||
exec /var/lib/minecraft/run.sh $@
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.minecraft-server = {
|
||||
path = with pkgs; [ jdk17_headless ];
|
||||
|
||||
# Since we read from our own HTTP server, we need to wait for it
|
||||
# to be up
|
||||
after = [ "nginx.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
# Use packwiz to install mods
|
||||
ExecStartPre = [
|
||||
"${pkgs.jdk17_headless}/bin/java -jar ${config.services.minecraft-server.dataDir}/packwiz-installer-bootstrap.jar -g -s server 'https://minecraft.${config.services.nginx.domain}/cobblemon-pack/pack.toml'"
|
||||
];
|
||||
# Forge requires some bonus JVM options, which they include in a
|
||||
# little `run.sh` script
|
||||
ExecStart = lib.mkForce "${config.services.minecraft-server.dataDir}/run.sh --nogui";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.settings."10-minecraft" = {
|
||||
"/srv/minecraft".d = {
|
||||
user = "nginx";
|
||||
group = "minecraft";
|
||||
mode = "0775";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."minecraft.${config.services.nginx.domain}" = {
|
||||
forceSSL = true;
|
||||
useACMEHost = "tlater.net";
|
||||
enableHSTS = true;
|
||||
|
||||
root = "/srv/minecraft";
|
||||
};
|
||||
}
|
||||
27
flake.lock
27
flake.lock
|
|
@ -300,11 +300,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739841949,
|
||||
"narHash": "sha256-lSOXdgW/1zi/SSu7xp71v+55D5Egz8ACv0STkj7fhbs=",
|
||||
"lastModified": 1739634831,
|
||||
"narHash": "sha256-xFnU+uUl48Icas2wPQ+ZzlL2O3n8f6J2LrzNK9f2nng=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "15dbf8cebd8e2655a883b74547108e089f051bf0",
|
||||
"rev": "fa5746ecea1772cf59b3f34c5816ab3531478142",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -595,11 +595,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739712626,
|
||||
"narHash": "sha256-u3m+awbdL+0BKk8IWidsWMr+R0ian3GZMUlH7623kd8=",
|
||||
"lastModified": 1737076827,
|
||||
"narHash": "sha256-vM9C1gFiQGa3nTYqmTBI8MoiUfprkQdepUBbxV7ECMQ=",
|
||||
"owner": "reckenrode",
|
||||
"repo": "nix-foundryvtt",
|
||||
"rev": "a7fa493ba2c623cf90e83756b62285b3b58f18d2",
|
||||
"rev": "0a72a4bf64224c6584fd1b9e9f0012dd09af979a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -746,11 +746,11 @@
|
|||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1740215764,
|
||||
"narHash": "sha256-wzBbGGZ6i1VVBA/cDJaLfuuGYCUriD7fwsLgJJHRVRk=",
|
||||
"lastModified": 1739611738,
|
||||
"narHash": "sha256-3bnOIZz8KXtzcaXGuH9Eriv0HiQyr1EIfcye+VHLQZE=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "8465e233b0668cf162c608a92e62e8d78c1ba7e4",
|
||||
"rev": "31ff66eb77d02e9ac34b7256a02edb1c43fb9998",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -762,11 +762,11 @@
|
|||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1740162160,
|
||||
"narHash": "sha256-SSYxFhqCOb3aiPb6MmN68yEzBIltfom8IgRz7phHscM=",
|
||||
"lastModified": 1739578539,
|
||||
"narHash": "sha256-jGiez5BtGGJUB/LXzRa+4AQurMO9acc1B69kBfgQhJc=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "11415c7ae8539d6292f2928317ee7a8410b28bb9",
|
||||
"rev": "30d4471a8a2a13b716530d3aad60b9846ea5ff83",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -1078,13 +1078,14 @@
|
|||
"locked": {
|
||||
"lastModified": 1740082109,
|
||||
"narHash": "sha256-WdRNkwsIotFOSymee/yQyH46RmYtuxd1FENhvGL4KRc=",
|
||||
"ref": "refs/heads/main",
|
||||
"ref": "tlater/rust-rewrite",
|
||||
"rev": "a1b48cf2ba194054e2d8816c94a84cebc4fb5de0",
|
||||
"revCount": 23,
|
||||
"type": "git",
|
||||
"url": "ssh://git@github.com/sonnenshift/battery-manager"
|
||||
},
|
||||
"original": {
|
||||
"ref": "tlater/rust-rewrite",
|
||||
"type": "git",
|
||||
"url": "ssh://git@github.com/sonnenshift/battery-manager"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@
|
|||
};
|
||||
|
||||
sonnenshift = {
|
||||
url = "git+ssh://git@github.com/sonnenshift/battery-manager";
|
||||
url = "git+ssh://git@github.com/sonnenshift/battery-manager?ref=tlater/rust-rewrite";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@
|
|||
},
|
||||
"crowdsec-hub": {
|
||||
"cargoLocks": null,
|
||||
"date": "2025-02-22",
|
||||
"date": "2025-02-16",
|
||||
"extract": null,
|
||||
"name": "crowdsec-hub",
|
||||
"passthru": null,
|
||||
|
|
@ -33,10 +33,10 @@
|
|||
"name": null,
|
||||
"owner": "crowdsecurity",
|
||||
"repo": "hub",
|
||||
"rev": "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df",
|
||||
"sha256": "sha256-45pUln7Qj5luY9I9BE2qhzjH7kv4IbYvNoEX3/4AVVg=",
|
||||
"rev": "f7d7f476f88a4af05e1cfb3994536990adecfb57",
|
||||
"sha256": "sha256-m78uipryHDKixJzrF4K59ioAJ3WJN1JlXEC0DNVMCJ8=",
|
||||
"type": "github"
|
||||
},
|
||||
"version": "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df"
|
||||
"version": "f7d7f476f88a4af05e1cfb3994536990adecfb57"
|
||||
}
|
||||
}
|
||||
|
|
@ -14,14 +14,14 @@
|
|||
};
|
||||
crowdsec-hub = {
|
||||
pname = "crowdsec-hub";
|
||||
version = "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df";
|
||||
version = "f7d7f476f88a4af05e1cfb3994536990adecfb57";
|
||||
src = fetchFromGitHub {
|
||||
owner = "crowdsecurity";
|
||||
repo = "hub";
|
||||
rev = "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df";
|
||||
rev = "f7d7f476f88a4af05e1cfb3994536990adecfb57";
|
||||
fetchSubmodules = false;
|
||||
sha256 = "sha256-45pUln7Qj5luY9I9BE2qhzjH7kv4IbYvNoEX3/4AVVg=";
|
||||
sha256 = "sha256-m78uipryHDKixJzrF4K59ioAJ3WJN1JlXEC0DNVMCJ8=";
|
||||
};
|
||||
date = "2025-02-22";
|
||||
date = "2025-02-16";
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue