Compare commits

...

3 commits

Author SHA1 Message Date
Tristan Daniël Maat a398790ef4
feat(metrics): Add victorialogs 2025-02-28 02:11:39 +08:00
Tristan Daniël Maat e4a7fa8764
feat(grafana): Use the victoriametrics metrics plugin 2025-02-28 02:01:54 +08:00
Tristan Daniël Maat be1d739b40
bump: Update inputs
Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/fa5746ecea1772cf59b3f34c5816ab3531478142?narHash=sha256-xFnU%2BuUl48Icas2wPQ%2BZzlL2O3n8f6J2LrzNK9f2nng%3D' (2025-02-15)
  → 'github:nix-community/disko/15dbf8cebd8e2655a883b74547108e089f051bf0?narHash=sha256-lSOXdgW/1zi/SSu7xp71v%2B55D5Egz8ACv0STkj7fhbs%3D' (2025-02-18)
• Updated input 'foundryvtt':
    'github:reckenrode/nix-foundryvtt/0a72a4bf64224c6584fd1b9e9f0012dd09af979a?narHash=sha256-vM9C1gFiQGa3nTYqmTBI8MoiUfprkQdepUBbxV7ECMQ%3D' (2025-01-17)
  → 'github:reckenrode/nix-foundryvtt/a7fa493ba2c623cf90e83756b62285b3b58f18d2?narHash=sha256-u3m%2BawbdL%2B0BKk8IWidsWMr%2BR0ian3GZMUlH7623kd8%3D' (2025-02-16)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/30d4471a8a2a13b716530d3aad60b9846ea5ff83?narHash=sha256-jGiez5BtGGJUB/LXzRa%2B4AQurMO9acc1B69kBfgQhJc%3D' (2025-02-15)
  → 'github:nixos/nixpkgs/11415c7ae8539d6292f2928317ee7a8410b28bb9?narHash=sha256-SSYxFhqCOb3aiPb6MmN68yEzBIltfom8IgRz7phHscM%3D' (2025-02-21)
• Updated input 'nixpkgs-unstable':
    'github:nixos/nixpkgs/31ff66eb77d02e9ac34b7256a02edb1c43fb9998?narHash=sha256-3bnOIZz8KXtzcaXGuH9Eriv0HiQyr1EIfcye%2BVHLQZE%3D' (2025-02-15)
  → 'github:nixos/nixpkgs/8465e233b0668cf162c608a92e62e8d78c1ba7e4?narHash=sha256-wzBbGGZ6i1VVBA/cDJaLfuuGYCUriD7fwsLgJJHRVRk%3D' (2025-02-22)
2025-02-23 01:45:11 +08:00
7 changed files with 154 additions and 25 deletions

View file

@ -5,5 +5,6 @@
./exporters.nix ./exporters.nix
./grafana.nix ./grafana.nix
./victoriametrics.nix ./victoriametrics.nix
./victorialogs.nix
]; ];
} }

View file

@ -1,4 +1,9 @@
{ config, ... }: {
pkgs,
config,
flake-inputs,
...
}:
let let
domain = "metrics.${config.services.nginx.domain}"; domain = "metrics.${config.services.nginx.domain}";
in in
@ -28,6 +33,11 @@ in
}; };
}; };
declarativePlugins = [
pkgs.grafanaPlugins.victoriametrics-metrics-datasource
flake-inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.grafanaPlugins.victoriametrics-logs-datasource
];
provision = { provision = {
enable = true; enable = true;
@ -35,7 +45,16 @@ in
{ {
name = "Victoriametrics - tlater.net"; name = "Victoriametrics - tlater.net";
url = "http://localhost:8428"; url = "http://localhost:8428";
type = "prometheus"; type = "victoriametrics-metrics-datasource";
access = "proxy";
isDefault = true;
}
{
name = "Victorialogs - tlater.net";
url = "http://${config.services.victorialogs.bindAddress}";
type = "victoriametrics-logs-datasource";
access = "proxy";
} }
]; ];
}; };

View file

@ -0,0 +1,110 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.services.victorialogs;
pkg = pkgs.victoriametrics;
dirname = "victorialogs";
in
{
options.services.victorialogs =
let
inherit (lib.types) str;
in
{
listenAddress = lib.mkOption {
default = ":9428";
type = str;
};
bindAddress = lib.mkOption {
readOnly = true;
type = str;
description = ''
Final address on which victorialogs listens.
'';
};
};
config = {
services.victorialogs.bindAddress =
(lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
services.journald.upload = {
enable = true;
settings.Upload = {
URL = "http://${cfg.bindAddress}/insert/journald";
NetworkTimeoutSec = "20s";
};
};
systemd.services."systemd-journal-upload".after = [ "victorialogs.service" ];
systemd.services.victorialogs = {
description = "VictoriaLogs log database";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
startLimitBurst = 5;
serviceConfig = {
ExecStart = lib.escapeShellArgs [
"${pkg}/bin/victoria-logs"
"-storageDataPath=/var/lib/${dirname}"
"-httpListenAddr=${cfg.listenAddress}"
];
DynamicUser = true;
RestartSec = 1;
Restart = "on-failure";
RuntimeDirectory = dirname;
RuntimeDirectoryMode = "0700";
StateDirectory = dirname;
StateDirectoryMode = "0700";
LimitNOFILE = 1048576;
# Hardening
DeviceAllow = [ "/dev/null rw" ];
DevicePolicy = "strict";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
};
postStart = lib.mkBefore ''
until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${cfg.bindAddress}/ping; do
sleep 1;
done
'';
};
};
}

View file

@ -300,11 +300,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1739634831, "lastModified": 1739841949,
"narHash": "sha256-xFnU+uUl48Icas2wPQ+ZzlL2O3n8f6J2LrzNK9f2nng=", "narHash": "sha256-lSOXdgW/1zi/SSu7xp71v+55D5Egz8ACv0STkj7fhbs=",
"owner": "nix-community", "owner": "nix-community",
"repo": "disko", "repo": "disko",
"rev": "fa5746ecea1772cf59b3f34c5816ab3531478142", "rev": "15dbf8cebd8e2655a883b74547108e089f051bf0",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -595,11 +595,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1737076827, "lastModified": 1739712626,
"narHash": "sha256-vM9C1gFiQGa3nTYqmTBI8MoiUfprkQdepUBbxV7ECMQ=", "narHash": "sha256-u3m+awbdL+0BKk8IWidsWMr+R0ian3GZMUlH7623kd8=",
"owner": "reckenrode", "owner": "reckenrode",
"repo": "nix-foundryvtt", "repo": "nix-foundryvtt",
"rev": "0a72a4bf64224c6584fd1b9e9f0012dd09af979a", "rev": "a7fa493ba2c623cf90e83756b62285b3b58f18d2",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -746,11 +746,11 @@
}, },
"nixpkgs-unstable": { "nixpkgs-unstable": {
"locked": { "locked": {
"lastModified": 1739611738, "lastModified": 1740215764,
"narHash": "sha256-3bnOIZz8KXtzcaXGuH9Eriv0HiQyr1EIfcye+VHLQZE=", "narHash": "sha256-wzBbGGZ6i1VVBA/cDJaLfuuGYCUriD7fwsLgJJHRVRk=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "31ff66eb77d02e9ac34b7256a02edb1c43fb9998", "rev": "8465e233b0668cf162c608a92e62e8d78c1ba7e4",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -762,11 +762,11 @@
}, },
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1739578539, "lastModified": 1740162160,
"narHash": "sha256-jGiez5BtGGJUB/LXzRa+4AQurMO9acc1B69kBfgQhJc=", "narHash": "sha256-SSYxFhqCOb3aiPb6MmN68yEzBIltfom8IgRz7phHscM=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "30d4471a8a2a13b716530d3aad60b9846ea5ff83", "rev": "11415c7ae8539d6292f2928317ee7a8410b28bb9",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1078,14 +1078,13 @@
"locked": { "locked": {
"lastModified": 1740082109, "lastModified": 1740082109,
"narHash": "sha256-WdRNkwsIotFOSymee/yQyH46RmYtuxd1FENhvGL4KRc=", "narHash": "sha256-WdRNkwsIotFOSymee/yQyH46RmYtuxd1FENhvGL4KRc=",
"ref": "tlater/rust-rewrite", "ref": "refs/heads/main",
"rev": "a1b48cf2ba194054e2d8816c94a84cebc4fb5de0", "rev": "a1b48cf2ba194054e2d8816c94a84cebc4fb5de0",
"revCount": 23, "revCount": 23,
"type": "git", "type": "git",
"url": "ssh://git@github.com/sonnenshift/battery-manager" "url": "ssh://git@github.com/sonnenshift/battery-manager"
}, },
"original": { "original": {
"ref": "tlater/rust-rewrite",
"type": "git", "type": "git",
"url": "ssh://git@github.com/sonnenshift/battery-manager" "url": "ssh://git@github.com/sonnenshift/battery-manager"
} }

View file

@ -23,7 +23,7 @@
}; };
sonnenshift = { sonnenshift = {
url = "git+ssh://git@github.com/sonnenshift/battery-manager?ref=tlater/rust-rewrite"; url = "git+ssh://git@github.com/sonnenshift/battery-manager";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
}; };

View file

@ -21,7 +21,7 @@
}, },
"crowdsec-hub": { "crowdsec-hub": {
"cargoLocks": null, "cargoLocks": null,
"date": "2025-02-16", "date": "2025-02-22",
"extract": null, "extract": null,
"name": "crowdsec-hub", "name": "crowdsec-hub",
"passthru": null, "passthru": null,
@ -33,10 +33,10 @@
"name": null, "name": null,
"owner": "crowdsecurity", "owner": "crowdsecurity",
"repo": "hub", "repo": "hub",
"rev": "f7d7f476f88a4af05e1cfb3994536990adecfb57", "rev": "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df",
"sha256": "sha256-m78uipryHDKixJzrF4K59ioAJ3WJN1JlXEC0DNVMCJ8=", "sha256": "sha256-45pUln7Qj5luY9I9BE2qhzjH7kv4IbYvNoEX3/4AVVg=",
"type": "github" "type": "github"
}, },
"version": "f7d7f476f88a4af05e1cfb3994536990adecfb57" "version": "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df"
} }
} }

View file

@ -14,14 +14,14 @@
}; };
crowdsec-hub = { crowdsec-hub = {
pname = "crowdsec-hub"; pname = "crowdsec-hub";
version = "f7d7f476f88a4af05e1cfb3994536990adecfb57"; version = "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df";
src = fetchFromGitHub { src = fetchFromGitHub {
owner = "crowdsecurity"; owner = "crowdsecurity";
repo = "hub"; repo = "hub";
rev = "f7d7f476f88a4af05e1cfb3994536990adecfb57"; rev = "f9883cd6c7d1913c13e4a3a69d9a0b887a7d57df";
fetchSubmodules = false; fetchSubmodules = false;
sha256 = "sha256-m78uipryHDKixJzrF4K59ioAJ3WJN1JlXEC0DNVMCJ8="; sha256 = "sha256-45pUln7Qj5luY9I9BE2qhzjH7kv4IbYvNoEX3/4AVVg=";
}; };
date = "2025-02-16"; date = "2025-02-22";
}; };
} }