nyanloutre/nixos-config
1
1
Fork 1
Code Issues Pull Requests Releases Wiki Activity

LoutreOS: refactor services

Browse Source
This commit is contained in:
nyanloutre 2019-11-01 15:24:50 +01:00
parent 0d6653ed9b
commit edb891e224
4 changed files with 275 additions and 249 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
systems/LoutreOS/medias.nix Normal file
View File

@ -0,0 +1,42 @@
{ config, lib, pkgs, ... }:
{
services = {
transmission = {
enable = true;
home = "/var/lib/transmission";
settings = {
rpc-bind-address = "127.0.0.1";
rpc-host-whitelist = "*";
rpc-whitelist-enabled = false;
peer-port = 51413;
};
};
radarr.enable = true;
sonarr.enable = true;
jackett.enable = true;
jellyfin.enable = true;
slimserver = {
enable = true;
dataDir = "/var/lib/slimserver";
};
airsonic = {
enable = true;
maxMemory = 500;
};
};
networking = {
firewall.allowedTCPPorts = [
config.services.transmission.settings.peer-port
];
firewall.allowedUDPPorts = [
config.services.transmission.settings.peer-port
];
};
}

113
systems/LoutreOS/monitoring.nix Normal file
View File

@ -0,0 +1,113 @@
{ config, lib, pkgs, ... }:
let
domaine = "nyanlout.re";
in
{
services = {
smartd = {
enable = true;
defaults.monitored = "-a -o on -s (S/../.././02|L/../../1/04)";
notifications.mail = {
enable = true;
recipient = "paul@nyanlout.re";
};
};
influxdb = {
enable = true;
dataDir = "/var/db/influxdb";
};
telegraf = {
enable = true;
extraConfig = {
inputs = {
zfs = { poolMetrics = true; };
net = { interfaces = [ "eno1" "eno2" "eno3" "eno4" ]; };
netstat = {};
cpu = { totalcpu = true; };
kernel = {};
mem = {};
processes = {};
system = {};
disk = {};
ipmi_sensor = { path = "${pkgs.ipmitool}/bin/ipmitool"; };
smart = {
path = "${pkgs.writeShellScriptBin "smartctl" "/run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl $@"}/bin/smartctl";
};
exec= [
{ commands = [
"${pkgs.python}/bin/python ${
pkgs.fetchgit {
url = "https://gitlab.com/nyanloutre/tplink-smartplug.git";
rev = "a0996112fc451b76448589698de440ad5fd6ea79";
sha256 = "1f1625g7rfsddgk428g76p8fr7vz5gfhq3f452q17bjni3rf2pj3";
}
}/tplink_smartplug.py -t 10.30.50.7 -c energy"
];
data_format = "json";
name_suffix = "_tplink-smartplug";
}
{
commands = [
"${pkgs.python3}/bin/python ${pkgs.writeText "zpool.py" ''
import json
from subprocess import check_output
columns = ["NAME", "SIZE", "ALLOC", "FREE", "EXPANDSZ", "FRAG", "CAP", "DEDUP", "HEALTH", "ALTROOT"]
health = {'ONLINE':0, 'DEGRADED':11, 'OFFLINE':21, 'UNAVAIL':22, 'FAULTED':23, 'REMOVED':24}
stdout = check_output(["${pkgs.zfs}/bin/zpool", "list", "-Hp"],encoding='UTF-8').split('\n')
parsed_stdout = list(map(lambda x: dict(zip(columns,x.split('\t'))), stdout))[:-1]
for pool in parsed_stdout:
for item in pool:
if item in ["SIZE", "ALLOC", "FREE", "FRAG", "CAP"]:
pool[item] = int(pool[item])
if item in ["DEDUP"]:
pool[item] = float(pool[item])
if item == "HEALTH":
pool[item] = health[pool[item]]
print(json.dumps(parsed_stdout))
''}"
];
tag_keys = [ "NAME" ];
data_format = "json";
name_suffix = "_python_zpool";
}
];
};
outputs = {
influxdb = { database = "telegraf"; urls = [ "http://localhost:8086" ]; };
};
};
};
udev.extraRules = ''
KERNEL=="ipmi*", MODE="660", OWNER="telegraf"
'';
grafana = {
enable = true;
addr = "127.0.0.1";
dataDir = "/var/lib/grafana";
extraOptions = {
SERVER_ROOT_URL = "https://grafana.${domaine}";
SMTP_ENABLED = "true";
SMTP_FROM_ADDRESS = "grafana@${domaine}";
SMTP_SKIP_VERIFY = "true";
AUTH_DISABLE_LOGIN_FORM = "true";
AUTH_DISABLE_SIGNOUT_MENU = "true";
AUTH_ANONYMOUS_ENABLED = "true";
AUTH_ANONYMOUS_ORG_ROLE = "Admin";
AUTH_BASIC_ENABLED = "false";
};
};
};
security.sudo.extraRules = [
{ commands = [ { command = "${pkgs.smartmontools}/bin/smartctl"; options = [ "NOPASSWD" ]; } ]; users = [ "telegraf" ]; }
];
}

256
systems/LoutreOS/services.nix
View File

@ -5,25 +5,6 @@ with lib;
let
domaine = "nyanlout.re";
riot_port = 52345;
pgmanage_port = 52347;
max_port = 52348;
musique_port = 52349;
factorio_port = 52351;
airsonic_port = 4040;
wkd_port = 52352;
jellyfin_backend = ''
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
'';
sonarr_acl = ''
acl API path_beg /api
'';
sonarr_auth = ''
!AUTH_OK !API
'';
sendMail = to: subject: message: pkgs.writeShellScriptBin "mail.sh" ''
${pkgs.system-sendmail}/bin/sendmail ${to} <<EOF
From: root@nyanlout.re
@ -51,7 +32,10 @@ in
../../services/python-ci.nix
../../services/sdtdserver.nix
../../containers/vsftpd.nix
/mnt/secrets/factorio_secrets.nix
# /mnt/secrets/factorio_secrets.nix
./monitoring.nix
./medias.nix
./web.nix
];
nixpkgs.overlays = [
@ -62,144 +46,13 @@ in
fail2ban.enable = true;
smartd = {
enable = true;
defaults.monitored = "-a -o on -s (S/../.././02|L/../../1/04)";
notifications.mail = {
enable = true;
recipient = "paul@nyanlout.re";
};
};
fstrim.enable = true;
haproxy-acme = {
enable = true;
domaine = domaine;
services = {
"grafana.${domaine}" = { ip = "127.0.0.1"; port = 3000; auth = true; };
"emby.${domaine}" = { ip = "127.0.0.1"; port = 8096; auth = false; extraBackend = jellyfin_backend; };
"radarr.${domaine}" = { ip = "127.0.0.1"; port = 7878; auth = true; extraAcls = sonarr_acl; aclBool = sonarr_auth; };
"sonarr.${domaine}" = { ip = "127.0.0.1"; port = 8989; auth = true; extraAcls = sonarr_acl; aclBool = sonarr_auth; };
"transmission.${domaine}" = { ip = "127.0.0.1"; port = 9091; auth = true; };
"syncthing.${domaine}" = { ip = "127.0.0.1"; port = 8384; auth = true; };
"jackett.${domaine}" = { ip = "127.0.0.1"; port = 9117; auth = true; };
"searx.${domaine}" = { ip = "127.0.0.1"; port = 8888; auth = false; };
"riot.${domaine}" = { ip = "127.0.0.1"; port = riot_port; auth = false; };
"matrix.${domaine}" = { ip = "127.0.0.1"; port = 8008; auth = false; };
"pgmanage.${domaine}" = { ip = "127.0.0.1"; port = pgmanage_port; auth = true; };
"gitea.${domaine}" = { ip = "127.0.0.1"; port = 3001; auth = false; };
"ci.${domaine}" = { ip = "127.0.0.1"; port = 52350; auth = false; };
"factorio.${domaine}" = { ip = "127.0.0.1"; port = factorio_port; auth = false; };
"airsonic.${domaine}" = { ip = "127.0.0.1"; port = airsonic_port; auth = false; };
"${domaine}" = { ip = "127.0.0.1"; port = wkd_port; auth = false; };
};
};
mailserver = {
enable = true;
domaine = domaine;
};
influxdb = {
enable = true;
dataDir = "/var/db/influxdb";
};
telegraf = {
enable = true;
extraConfig = {
inputs = {
zfs = { poolMetrics = true; };
net = { interfaces = [ "eno1" "eno2" "eno3" "eno4" ]; };
netstat = {};
cpu = { totalcpu = true; };
kernel = {};
mem = {};
processes = {};
system = {};
disk = {};
ipmi_sensor = { path = "${pkgs.ipmitool}/bin/ipmitool"; };
smart = {
path = "${pkgs.writeShellScriptBin "smartctl" "/run/wrappers/bin/sudo ${pkgs.smartmontools}/bin/smartctl $@"}/bin/smartctl";
};
exec= [
{ commands = [
"${pkgs.python}/bin/python ${
pkgs.fetchgit {
url = "https://gitlab.com/nyanloutre/tplink-smartplug.git";
rev = "a0996112fc451b76448589698de440ad5fd6ea79";
sha256 = "1f1625g7rfsddgk428g76p8fr7vz5gfhq3f452q17bjni3rf2pj3";
}
}/tplink_smartplug.py -t 10.30.50.7 -c energy"
];
data_format = "json";
name_suffix = "_tplink-smartplug";
}
{
commands = [
"${pkgs.python3}/bin/python ${pkgs.writeText "zpool.py" ''
import json
from subprocess import check_output
columns = ["NAME", "SIZE", "ALLOC", "FREE", "EXPANDSZ", "FRAG", "CAP", "DEDUP", "HEALTH", "ALTROOT"]
health = {'ONLINE':0, 'DEGRADED':11, 'OFFLINE':21, 'UNAVAIL':22, 'FAULTED':23, 'REMOVED':24}
stdout = check_output(["${pkgs.zfs}/bin/zpool", "list", "-Hp"],encoding='UTF-8').split('\n')
parsed_stdout = list(map(lambda x: dict(zip(columns,x.split('\t'))), stdout))[:-1]
for pool in parsed_stdout:
for item in pool:
if item in ["SIZE", "ALLOC", "FREE", "FRAG", "CAP"]:
pool[item] = int(pool[item])
if item in ["DEDUP"]:
pool[item] = float(pool[item])
if item == "HEALTH":
pool[item] = health[pool[item]]
print(json.dumps(parsed_stdout))
''}"
];
tag_keys = [ "NAME" ];
data_format = "json";
name_suffix = "_python_zpool";
}
];
};
outputs = {
influxdb = { database = "telegraf"; urls = [ "http://localhost:8086" ]; };
};
};
};
udev.extraRules = ''
KERNEL=="ipmi*", MODE="660", OWNER="telegraf"
'';
grafana = {
enable = true;
addr = "127.0.0.1";
dataDir = "/var/lib/grafana";
extraOptions = {
SERVER_ROOT_URL = "https://grafana.${domaine}";
SMTP_ENABLED = "true";
SMTP_FROM_ADDRESS = "grafana@${domaine}";
SMTP_SKIP_VERIFY = "true";
AUTH_DISABLE_LOGIN_FORM = "true";
AUTH_DISABLE_SIGNOUT_MENU = "true";
AUTH_ANONYMOUS_ENABLED = "true";
AUTH_ANONYMOUS_ORG_ROLE = "Admin";
AUTH_BASIC_ENABLED = "false";
};
};
jellyfin.enable = true;
slimserver = {
enable = true;
dataDir = "/var/lib/slimserver";
};
syncthing = {
enable = true;
dataDir = "/var/lib/syncthing";
@ -218,47 +71,6 @@ in
mountdPort = 4002;
};
transmission = {
enable = true;
home = "/var/lib/transmission";
settings = {
rpc-bind-address = "127.0.0.1";
rpc-host-whitelist = "*";
rpc-whitelist-enabled = false;
};
};
radarr.enable = true;
sonarr.enable = true;
jackett.enable = true;
searx.enable = true;
nginx = {
enable = true;
virtualHosts = {
"riot" = {
listen = [ { addr = "127.0.0.1"; port = riot_port; } ];
locations = { "/" = { root = pkgs.riot-web; }; };
};
"factorio" = {
listen = [ { addr = "127.0.0.1"; port = factorio_port; } ];
locations = { "/" = { root = "/var/www/factorio"; }; };
};
"wkd" = {
listen = [ { addr = "127.0.0.1"; port = wkd_port; } ];
locations = { "/.well-known/openpgpkey/" = {
alias = "/var/lib/gnupg/wks/nyanlout.re";
extraConfig = ''
add_header Access-Control-Allow-Origin * always;
'';
}; };
};
};
};
postgresql.enable = true;
matrix-synapse = {
enable = true;
enable_registration = true;
@ -345,14 +157,6 @@ in
serviceDependencies = [ "matrix-synapse.service" ];
};
pgmanage = {
enable = true;
port = pgmanage_port;
connections = {
localhost = "hostaddr=127.0.0.1 port=5432 dbname=postgres";
};
};
borgbackup.jobs = {
loutre = {
paths = [
@ -405,57 +209,18 @@ in
};
};
gitea = {
enable = true;
cookieSecure = true;
httpPort = 3001;
rootUrl = "https://gitea.nyanlout.re/";
database = {
type = "postgres";
port = 5432;
passwordFile = "/var/lib/gitea/custom/conf/database_password";
};
log.level = "Warn";
extraConfig = ''
[ui]
DEFAULT_THEME = arc-green
[service]
DISABLE_REGISTRATION = true
'';
};
site-musique = {
enable = true;
port = musique_port;
domaine = "musique-meyenheim.fr";
};
site-max = {
enable = true;
port = max_port;
domaine = "maxspiegel.fr";
};
auto-pr.enable = true;
python-ci.enable = true;
sdtdserver.enable = false;
factorio = {
enable = true;
enable = false;
autosave-interval = 10;
game-name = "Shame";
public = true;
username = "nyanloutre";
};
airsonic = {
enable = true;
maxMemory = 500;
};
minecraft-server = {
enable = false;
jvmOpts = "-Xms512m -Xmx3072m";
@ -501,12 +266,7 @@ in
users.groups.acme.members = [ "matrix-synapse" ];
security = {
sudo.extraRules = [
{ commands = [ { command = "${pkgs.smartmontools}/bin/smartctl"; options = [ "NOPASSWD" ]; } ]; users = [ "telegraf" ]; }
];
pam.services.sshd.text = pkgs.lib.mkDefault( pkgs.lib.mkAfter "session optional ${pkgs.pam}/lib/security/pam_exec.so seteuid ${login_mail_alert}/bin/mail_alert.sh" );
};
security.pam.services.sshd.text = pkgs.lib.mkDefault( pkgs.lib.mkAfter "session optional ${pkgs.pam}/lib/security/pam_exec.so seteuid ${login_mail_alert}/bin/mail_alert.sh" );
networking = {
wireguard.interfaces = {
@ -528,7 +288,6 @@ in
nat.internalIPs = [ "192.168.20.0/24" ];
firewall.allowedTCPPorts = [
51413 # Transmission
8448 # Matrix federation
20 21 # FTP
];
@ -538,8 +297,7 @@ in
];
firewall.allowedUDPPorts = [
51413 # Transmission
51820 # Wireguard
config.networking.wireguard.interfaces.wg0.listenPort
];
};
}

113
systems/LoutreOS/web.nix Normal file
View File

@ -0,0 +1,113 @@
{ config, lib, pkgs, ... }:
with lib;
let
domaine = "nyanlout.re";
jellyfin_backend = ''
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
'';
sonarr_acl = ''
acl API path_beg /api
'';
sonarr_auth = ''
!AUTH_OK !API
'';
in
{
services = {
haproxy-acme = {
enable = true;
domaine = domaine;
services = {
"grafana.${domaine}" = { ip = "127.0.0.1"; port = config.services.grafana.port; auth = true; };
"emby.${domaine}" = { ip = "127.0.0.1"; port = 8096; auth = false; extraBackend = jellyfin_backend; };
"radarr.${domaine}" = { ip = "127.0.0.1"; port = 7878; auth = true; extraAcls = sonarr_acl; aclBool = sonarr_auth; };
"sonarr.${domaine}" = { ip = "127.0.0.1"; port = 8989; auth = true; extraAcls = sonarr_acl; aclBool = sonarr_auth; };
"transmission.${domaine}" = { ip = "127.0.0.1"; port = config.services.transmission.port; auth = true; };
"syncthing.${domaine}" = { ip = "127.0.0.1"; port = 8384; auth = true; };
"jackett.${domaine}" = { ip = "127.0.0.1"; port = 9117; auth = true; };
"searx.${domaine}" = { ip = "127.0.0.1"; port = 8888; auth = false; };
"riot.${domaine}" = { ip = "127.0.0.1"; port = (findFirst (x: x.addr == "127.0.0.1") "" config.services.nginx.virtualHosts.riot.listen).port; auth = false; };
"matrix.${domaine}" = { ip = "127.0.0.1"; port = 8008; auth = false; };
"pgmanage.${domaine}" = { ip = "127.0.0.1"; port = config.services.pgmanage.port; auth = true; };
"gitea.${domaine}" = { ip = "127.0.0.1"; port = config.services.gitea.httpPort; auth = false; };
"ci.${domaine}" = { ip = "127.0.0.1"; port = 52350; auth = false; };
"factorio.${domaine}" = { ip = "127.0.0.1"; port = (findFirst (x: x.addr == "127.0.0.1") "" config.services.nginx.virtualHosts.factorio.listen).port; auth = false; };
"airsonic.${domaine}" = { ip = "127.0.0.1"; port = 4040; auth = false; };
"${domaine}" = { ip = "127.0.0.1"; port = (findFirst (x: x.addr == "127.0.0.1") "" config.services.nginx.virtualHosts.wkd.listen).port; auth = false; };
};
};
searx.enable = true;
nginx = {
enable = true;
virtualHosts = {
"riot" = {
listen = [ { addr = "127.0.0.1"; port = 52345; } ];
locations = { "/" = { root = pkgs.riot-web; }; };
};
"factorio" = {
listen = [ { addr = "127.0.0.1"; port = 52351; } ];
locations = { "/" = { root = "/var/www/factorio"; }; };
};
"wkd" = {
listen = [ { addr = "127.0.0.1"; port = 52352; } ];
locations = { "/.well-known/openpgpkey/" = {
alias = "/var/lib/gnupg/wks/nyanlout.re";
extraConfig = ''
add_header Access-Control-Allow-Origin * always;
'';
}; };
};
};
};
postgresql.enable = true;
pgmanage = {
enable = true;
port = 52347;
connections = {
localhost = "hostaddr=127.0.0.1 port=5432 dbname=postgres";
};
};
gitea = {
enable = true;
cookieSecure = true;
httpPort = 3001;
rootUrl = "https://gitea.nyanlout.re/";
database = {
type = "postgres";
port = 5432;
passwordFile = "/var/lib/gitea/custom/conf/database_password";
};
log.level = "Warn";
extraConfig = ''
[ui]
DEFAULT_THEME = arc-green
[service]
DISABLE_REGISTRATION = true
'';
};
python-ci.enable = true;
site-musique = {
enable = true;
port = 52349;
domaine = "musique-meyenheim.fr";
};
site-max = {
enable = true;
port = 52348;
domaine = "maxspiegel.fr";
};
};
}