145 lines
3.8 KiB
Nix
145 lines
3.8 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: let
|
|
domain = "metrics.${config.services.nginx.domain}";
|
|
yaml = pkgs.formats.yaml {};
|
|
in {
|
|
imports = [
|
|
./exporters.nix
|
|
];
|
|
|
|
services.victoriametrics.enable = true;
|
|
|
|
services.grafana = {
|
|
enable = true;
|
|
settings = {
|
|
server.http_port = 3001; # Default overlaps with gitea
|
|
|
|
security = {
|
|
admin_user = "tlater";
|
|
admin_password = "$__file{${config.sops.secrets."grafana/adminPassword".path}}";
|
|
secret_key = "$__file{${config.sops.secrets."grafana/secretKey".path}}";
|
|
cookie_secure = true;
|
|
cookie_samesite = "strict";
|
|
content_security_policy = true;
|
|
};
|
|
|
|
database = {
|
|
user = "grafana";
|
|
name = "grafana";
|
|
type = "postgres";
|
|
host = "/run/postgresql";
|
|
};
|
|
};
|
|
|
|
provision = {
|
|
enable = true;
|
|
|
|
datasources.settings.datasources = [
|
|
{
|
|
name = "Victoriametrics - tlater.net";
|
|
url = "http://localhost:8428";
|
|
type = "prometheus";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
services.prometheus.exporters = {
|
|
node = {
|
|
enable = true;
|
|
enabledCollectors = ["systemd"];
|
|
listenAddress = "127.0.0.1";
|
|
};
|
|
|
|
nginx = {
|
|
enable = true;
|
|
listenAddress = "127.0.0.1";
|
|
};
|
|
|
|
nginxlog = {
|
|
enable = true;
|
|
listenAddress = "127.0.0.1";
|
|
group = "nginx";
|
|
|
|
settings.namespaces =
|
|
lib.mapAttrsToList (name: virtualHost: {
|
|
inherit name;
|
|
metrics_override.prefix = "nginxlog";
|
|
namespace_label = "vhost";
|
|
|
|
format = lib.concatStringsSep " " [
|
|
"$remote_addr - $remote_user [$time_local]"
|
|
''"$request" $status $body_bytes_sent''
|
|
''"$http_referer" "$http_user_agent"''
|
|
''rt=$request_time uct="$upstream_connect_time"''
|
|
''uht="$upstream_header_time" urt="$upstream_response_time"''
|
|
];
|
|
|
|
source.files = [
|
|
"/var/log/nginx/${name}/access.log"
|
|
];
|
|
})
|
|
config.services.nginx.virtualHosts;
|
|
};
|
|
};
|
|
|
|
services.prometheus.local-exporters = {
|
|
prometheus-fail2ban-exporter = rec {
|
|
enable = true;
|
|
after = ["fail2ban.service"];
|
|
|
|
port = 9191;
|
|
listenAddress = "127.0.0.1";
|
|
|
|
serviceConfig = {
|
|
Group = "fail2ban";
|
|
|
|
RestrictAddressFamilies = ["AF_UNIX" "AF_INET" "AF_INET6"];
|
|
|
|
ExecStart = lib.concatStringsSep " " [
|
|
"${pkgs.local.prometheus-fail2ban-exporter}/bin/fail2ban-prometheus-exporter"
|
|
"--collector.f2b.socket=/var/run/fail2ban/fail2ban.sock"
|
|
"--web.listen-address='${listenAddress}:${toString port}'"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.export-to-victoriametrics = let
|
|
promscrape = yaml.generate "prometheus.yml" {
|
|
scrape_configs = [
|
|
{
|
|
job_name = "tlater.net";
|
|
static_configs = [
|
|
{
|
|
targets =
|
|
lib.mapAttrsToList (name: exporter: "${exporter.listenAddress}:${toString exporter.port}")
|
|
(lib.filterAttrs (name: exporter: (builtins.isAttrs exporter) && exporter.enable)
|
|
(config.services.prometheus.exporters // config.services.prometheus.local-exporters));
|
|
}
|
|
];
|
|
}
|
|
];
|
|
};
|
|
in {
|
|
enable = true;
|
|
path = [pkgs.victoriametrics];
|
|
wantedBy = ["multi-user.target"];
|
|
script = "vmagent -promscrape.config=${promscrape} -remoteWrite.url=http://localhost:8428/api/v1/write";
|
|
};
|
|
|
|
services.nginx.virtualHosts."${domain}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
extraConfig = ''
|
|
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
|
|
access_log /var/log/nginx/${domain}/access.log upstream_time;
|
|
'';
|
|
locations."/".proxyPass = "http://localhost:3001";
|
|
};
|
|
}
|