add grafana and victoria metrics and stuff

modules/nixos/custom/default.nix

@@ -5,5 +5,6 @@
     ./nvd-diff.nix
     ./nvk.nix
     ./remote-builders.nix
+    ./victorialogs.nix
   ];
 }

modules/nixos/custom/victorialogs.nix

@@ -0,0 +1,129 @@
+# From https://github.com/NixOS/nixpkgs/pull/376834
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  inherit (lib)
+    getBin
+    hasPrefix
+    literalExpression
+    mkBefore
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalString
+    types
+    ;
+
+  cfg = config.borealis.victorialogs;
+
+  startCLIList = [
+    "${cfg.package}/bin/victoria-logs"
+    "-storageDataPath=/var/lib/${cfg.stateDir}"
+    "-httpListenAddr=${cfg.listenAddress}"
+  ] ++ cfg.extraOptions;
+in
+
+{
+  options.borealis.victorialogs = {
+    enable = mkEnableOption "VictoriaLogs is an open source user-friendly database for logs from VictoriaMetrics";
+    package = mkPackageOption pkgs "victoriametrics" { };
+    listenAddress = lib.mkOption {
+      default = "127.0.0.1:9428";
+      type = types.str;
+      description = ''
+        TCP address to listen for incoming http requests.
+      '';
+    };
+    stateDir = mkOption {
+      type = types.str;
+      default = "victorialogs";
+      description = ''
+        Directory below `/var/lib` to store VictoriaLogs data.
+        This directory will be created automatically using systemd's StateDirectory mechanism.
+      '';
+    };
+    extraOptions = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = literalExpression ''
+        [
+          "-httpAuth.username=username"
+          "-httpAuth.password=file:///abs/path/to/file"
+          "-loggerLevel=WARN"
+        ]
+      '';
+      description = ''
+        Extra options to pass to VictoriaLogs. See {command}`victoria-logs -help` for
+        possible options.
+      '';
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd.services.victorialogs = {
+      description = "VictoriaLogs logs database";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      startLimitBurst = 5;
+
+      serviceConfig = {
+        ExecStart = lib.escapeShellArgs startCLIList;
+        DynamicUser = true;
+        RestartSec = 1;
+        Restart = "on-failure";
+        RuntimeDirectory = "victorialogs";
+        RuntimeDirectoryMode = "0700";
+        StateDirectory = cfg.stateDir;
+        StateDirectoryMode = "0700";
+
+        # Hardening
+        DeviceAllow = [ "/dev/null rw" ];
+        DevicePolicy = "strict";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+      };
+
+      postStart =
+        let
+          bindAddr = (optionalString (hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
+        in
+        mkBefore ''
+          until ${getBin pkgs.curl}/bin/curl -s -o /dev/null http://${bindAddr}/ping; do
+            sleep 1;
+          done
+        '';
+    };
+  };
+}

modules/nixos/mixins/default.nix

@@ -7,11 +7,14 @@
     ./comin.nix
     ./forgejo.nix
     ./gnome.nix
+    ./grafana.nix
     ./home-manager.nix
+    ./journal-upload.nix
     ./kanidm.nix
     ./lanzaboote.nix
     ./nginx.nix
     ./niri.nix
+    ./node-exporter.nix
     ./nvidia.nix
     ./pipewire.nix
     ./plasma.nix

modules/nixos/mixins/forgejo.nix

@@ -21,13 +21,17 @@ in
 
         settings = {
           server = {
-            PROTOCOL = "http+unix";
+            PROTOCOL = "http";
             DOMAIN = lib.mkDefault ("git." + config.networking.domain);
             ROOT_URL = "https://" + forgejoCfg.settings.server.DOMAIN + "/";
 
             DISABLE_SSH = lib.mkDefault true;
           };
 
+          metrics = {
+            ENABLED = true;
+          };
+
           oauth2_client = {
             ENABLE_AUTO_REGISTRATION = lib.mkDefault true;
           };
@@ -50,7 +54,7 @@ in
     (lib.mkIf forgejoCfg.enable {
       services.nginx.virtualHosts.${forgejoCfg.settings.server.DOMAIN} = {
         locations."/" = {
-          proxyPass = "http://unix:${forgejoCfg.settings.server.HTTP_ADDR}";
+          proxyPass = "http://${forgejoCfg.settings.server.HTTP_ADDR}:${toString forgejoCfg.settings.server.HTTP_PORT}";
         };
       };
 

modules/nixos/mixins/grafana.nix

@@ -0,0 +1,71 @@
+{
+  config,
+  lib,
+  secretsDir,
+  ...
+}:
+
+{
+  config = lib.mkMerge [
+    {
+      services.grafana = {
+        settings = {
+          analytics = {
+            feedback_links_enabled = false;
+            reporting_enabled = false;
+          };
+
+          "auth.anonymous" = {
+            enable = true;
+            org_role = "Viewer";
+          };
+
+          server = {
+            http_port = 6000;
+
+            domain = lib.mkDefault ("grafana." + config.networking.domain);
+            enable_gzip = true;
+            enforce_domain = true;
+            root_url = "https://" + config.services.grafana.settings.server.domain + "/";
+          };
+        };
+      };
+    }
+
+    (lib.mkIf config.services.kanidm.enableServer {
+      services.grafana = {
+        settings = {
+          "auth.basic".enabled = false;
+
+          "auth.generic_oauth" = {
+            enabled = true;
+
+            name = "Kanidm";
+            client_id = "grafana";
+            client_secret = "$__file{${config.age.secrets.grafanaKanidm.path}}";
+            scopes = "openid,profile,email,groups";
+            auth_url = config.services.kanidm.serverSettings.origin + "/ui/oauth2";
+            token_url = config.services.kanidm.serverSettings.origin + "/oauth2/token";
+            api_url = config.services.kanidm.serverSettings.origin + "/oauth2/openid/grafana/userinfo";
+            use_pkce = true;
+            use_refresh_token = true;
+
+            allow_assign_grafana_admin = true;
+            allow_sign_up = true;
+            groups_attribute_path = "groups";
+            login_attribute_path = "preferred_username";
+            role_attribute_path = "contains(grafana_role[*], 'GrafanaAdmin') && 'GrafanaAdmin' || contains(grafana_role[*], 'Admin') && 'Admin' || contains(grafana_role[*], 'Editor') && 'Editor' || 'Viewer'";
+          };
+        };
+      };
+    })
+
+    (lib.mkIf (config.services.grafana.enable && config.services.kanidm.enableServer) {
+      age.secrets.grafanaKanidm = {
+        file = secretsDir + "/grafanaKanidmSecret.age";
+        owner = config.users.users.grafana.name;
+        group = config.users.groups.grafana.name;
+      };
+    })
+  ];
+}

modules/nixos/mixins/journal-upload.nix

@@ -0,0 +1,7 @@
+{
+  services.journald.upload = {
+    settings = {
+      Upload.URL = "http://atlas:9428/insert/journald";
+    };
+  };
+}

modules/nixos/mixins/node-exporter.nix

@@ -0,0 +1,11 @@
+{ lib, ... }:
+
+{
+  services.prometheus.exporters.node = {
+    openFirewall = lib.mkDefault true;
+
+    enabledCollectors = [
+      "systemd"
+    ];
+  };
+}

secrets/atlas/grafanaKanidmSecret.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> X25519 WN8YTDxF+JY8a2W10sd4nFDPEOzQhVFWmMK0TC7BRCw
+2/au+k29lSsMZxMIj2+yGzJRt8PO9KnQ0snh/b8vkno
+-> X25519 RVgT9JDOzVBhsWE+tw1uWyvz3ECyAexSArI4avMyTFs
+iD/aHD+/w1dvyERSgqy8nu3KXC2I0xmWoMlJzLFBdNw
+--- PW47hPTW9nkWD4CBGgGBVgL2mc5/Lu7qDmchRt1NJ2U
+nÜrGæ{OE¹4ç6{ʇ„B8½ÛjU|W/1?>40ŒßV¶?½ùKyðP#&N$½­2—2P»¥³"…ñÅØ¢³Ïë1&†ù;ão9

systems/atlas/default.nix

@@ -4,10 +4,12 @@
     (modulesPath + "/profiles/minimal.nix")
     ./hardware-configuration.nix
     ./forgejo.nix
+    ./grafana.nix
     ./kanidm.nix
     ./miniflux.nix
     ./moyai.nix
     ./nixpkgs-tracker-bot.nix
+    ./victoria-metrics.nix
 
     inputs.self.nixosModules.default
   ];

systems/atlas/grafana.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+
+{
+  services = {
+    grafana = {
+      enable = true;
+    };
+
+    nginx.virtualHosts = {
+      "grafana.getchoo.com" = {
+        locations."/" = {
+          proxyPass = "http://${config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+}

systems/atlas/miniflux.nix

@@ -1,6 +1,5 @@
 {
   config,
-  lib,
   secretsDir,
   ...
 }:
@@ -14,28 +13,32 @@
       adminCredentialsFile = config.age.secrets.miniflux.path;
       config = {
         BASE_URL = "https://miniflux.${config.networking.domain}";
+        LISTEN_ADDR = "localhost:7000";
+        METRICS_COLLECTOR = 1;
       };
     };
 
     nginx.virtualHosts = {
       "miniflux.getchoo.com" = {
         locations."/" = {
-          proxyPass = "http://unix:${lib.head config.systemd.sockets.miniflux.listenStreams}";
+          proxyPass = "http://${config.services.miniflux.config.LISTEN_ADDR}";
         };
       };
     };
   };
 
-  # Create the socket manually to ensure NGINX has permission for the socket's parent directory
-  # ...since for some reason Miniflux will not give it the same `0777` permission as the socket itself
-  systemd = {
-    services.miniflux = {
-      requires = [ "miniflux.socket" ];
-    };
+  /*
+    # Create the socket manually to ensure NGINX has permission for the socket's parent directory
+    # ...since for some reason Miniflux will not give it the same `0777` permission as the socket itself
+    systemd = {
+      services.miniflux = {
+        requires = [ "miniflux.socket" ];
+      };
 
-    sockets.miniflux = {
-      wantedBy = [ "sockets.target" ];
-      listenStreams = [ "/run/miniflux.sock" ];
+      sockets.miniflux = {
+        wantedBy = [ "sockets.target" ];
+        listenStreams = [ "/run/miniflux.sock" ];
+      };
     };
-  };
+  */
 }