Begin moving openbao and authentik server to new setup
This commit is contained in:
parent
a996ba3083
commit
8cd2737aca
GPG key ID:
C7D890804F01E9F0
43 changed files with 1006 additions and 481 deletions
488
flake.lock
generated
488
flake.lock
generated
|
|
@ -16,6 +16,58 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"authentik-nix": {
|
||||||
|
"inputs": {
|
||||||
|
"authentik-src": "authentik-src",
|
||||||
|
"flake-compat": "flake-compat",
|
||||||
|
"flake-parts": [
|
||||||
|
"flake-parts"
|
||||||
|
],
|
||||||
|
"flake-utils": [
|
||||||
|
"flake-utils"
|
||||||
|
],
|
||||||
|
"napalm": "napalm",
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
],
|
||||||
|
"pyproject-build-systems": "pyproject-build-systems",
|
||||||
|
"pyproject-nix": "pyproject-nix",
|
||||||
|
"systems": [
|
||||||
|
"systems"
|
||||||
|
],
|
||||||
|
"uv2nix": "uv2nix"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1751033152,
|
||||||
|
"narHash": "sha256-0ANu9OLQJszcEyvnfDB7G957uqskZwCrTzRXz/yfAmE=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "authentik-nix",
|
||||||
|
"rev": "1a4d6a5dd6fef39b99eb7ea4db79c5d5c7d7f1bf",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "authentik-nix",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"authentik-src": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1751031262,
|
||||||
|
"narHash": "sha256-SNgRMQUjL3DTlWkMyRMan+pY1FfIV+DMeq5BiTM0N0k=",
|
||||||
|
"owner": "goauthentik",
|
||||||
|
"repo": "authentik",
|
||||||
|
"rev": "b34665fabd8d938d81ce871a4e86ca528c5f253b",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "goauthentik",
|
||||||
|
"ref": "version/2025.4.3",
|
||||||
|
"repo": "authentik",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"base16": {
|
"base16": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"fromYaml": "fromYaml"
|
"fromYaml": "fromYaml"
|
||||||
|
|
@ -83,41 +135,11 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"bats-assert": {
|
|
||||||
"flake": false,
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1636059754,
|
|
||||||
"narHash": "sha256-ewME0l27ZqfmAwJO4h5biTALc9bDLv7Bl3ftBzBuZwk=",
|
|
||||||
"owner": "bats-core",
|
|
||||||
"repo": "bats-assert",
|
|
||||||
"rev": "34551b1d7f8c7b677c1a66fc0ac140d6223409e5",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "bats-core",
|
|
||||||
"repo": "bats-assert",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"bats-support": {
|
|
||||||
"flake": false,
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1548869839,
|
|
||||||
"narHash": "sha256-Gr4ntadr42F2Ks8Pte2D4wNDbijhujuoJi4OPZnTAZU=",
|
|
||||||
"owner": "bats-core",
|
|
||||||
"repo": "bats-support",
|
|
||||||
"rev": "d140a65044b2d6810381935ae7f0c94c7023c8c3",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "bats-core",
|
|
||||||
"repo": "bats-support",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"cosmic-manager": {
|
"cosmic-manager": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-parts": "flake-parts",
|
"flake-parts": [
|
||||||
|
"flake-parts"
|
||||||
|
],
|
||||||
"home-manager": [
|
"home-manager": [
|
||||||
"home-manager"
|
"home-manager"
|
||||||
],
|
],
|
||||||
|
|
@ -174,28 +196,6 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"disko_2": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixos-anywhere",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1748225455,
|
|
||||||
"narHash": "sha256-AzlJCKaM4wbEyEpV3I/PUq5mHnib2ryEy32c+qfj6xk=",
|
|
||||||
"owner": "nix-community",
|
|
||||||
"repo": "disko",
|
|
||||||
"rev": "a894f2811e1ee8d10c50560551e50d6ab3c392ba",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nix-community",
|
|
||||||
"ref": "master",
|
|
||||||
"repo": "disko",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"firefox-gnome-theme": {
|
"firefox-gnome-theme": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
@ -218,7 +218,9 @@
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"snowfall-lib": "snowfall-lib",
|
"snowfall-lib": "snowfall-lib",
|
||||||
"treefmt-nix": "treefmt-nix"
|
"treefmt-nix": [
|
||||||
|
"treefmt-nix"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1751834884,
|
"lastModified": 1751834884,
|
||||||
|
|
@ -235,6 +237,22 @@
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-compat": {
|
"flake-compat": {
|
||||||
|
"flake": false,
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1747046372,
|
||||||
|
"narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
|
||||||
|
"owner": "edolstra",
|
||||||
|
"repo": "flake-compat",
|
||||||
|
"rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "edolstra",
|
||||||
|
"repo": "flake-compat",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-compat_2": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1650374568,
|
"lastModified": 1650374568,
|
||||||
|
|
@ -252,80 +270,14 @@
|
||||||
},
|
},
|
||||||
"flake-parts": {
|
"flake-parts": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs-lib": [
|
"nixpkgs-lib": "nixpkgs-lib"
|
||||||
"cosmic-manager",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1738453229,
|
"lastModified": 1751413152,
|
||||||
"narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
|
"narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
|
||||||
"owner": "hercules-ci",
|
"owner": "hercules-ci",
|
||||||
"repo": "flake-parts",
|
"repo": "flake-parts",
|
||||||
"rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
|
"rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "flake-parts",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-parts_2": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs-lib": [
|
|
||||||
"nixos-anywhere",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1743550720,
|
|
||||||
"narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "flake-parts",
|
|
||||||
"rev": "c621e8422220273271f52058f618c94e405bb0f5",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "flake-parts",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-parts_3": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs-lib": [
|
|
||||||
"stylix",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1749398372,
|
|
||||||
"narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "flake-parts",
|
|
||||||
"rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "flake-parts",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-parts_4": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs-lib": [
|
|
||||||
"terranix",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1736143030,
|
|
||||||
"narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
|
|
||||||
"owner": "hercules-ci",
|
|
||||||
"repo": "flake-parts",
|
|
||||||
"rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
|
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -372,27 +324,17 @@
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"flake-utils_2": {
|
"flake-utils_2": {
|
||||||
"locked": {
|
"inputs": {
|
||||||
"lastModified": 1634851050,
|
"systems": [
|
||||||
"narHash": "sha256-N83GlSGPJJdcqhUxSCS/WwW5pksYf3VP1M13cDRTSVA=",
|
"systems"
|
||||||
"owner": "numtide",
|
]
|
||||||
"repo": "flake-utils",
|
|
||||||
"rev": "c91f3de5adaf1de973b797ef7485e441a65b8935",
|
|
||||||
"type": "github"
|
|
||||||
},
|
},
|
||||||
"original": {
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "flake-utils",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"flake-utils_3": {
|
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1634851050,
|
"lastModified": 1731533236,
|
||||||
"narHash": "sha256-N83GlSGPJJdcqhUxSCS/WwW5pksYf3VP1M13cDRTSVA=",
|
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||||
"owner": "numtide",
|
"owner": "numtide",
|
||||||
"repo": "flake-utils",
|
"repo": "flake-utils",
|
||||||
"rev": "c91f3de5adaf1de973b797ef7485e441a65b8935",
|
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
@ -455,6 +397,32 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"napalm": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": [
|
||||||
|
"authentik-nix",
|
||||||
|
"flake-utils"
|
||||||
|
],
|
||||||
|
"nixpkgs": [
|
||||||
|
"authentik-nix",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1725806412,
|
||||||
|
"narHash": "sha256-lGZjkjds0p924QEhm/r0BhAxbHBJE1xMOldB/HmQH04=",
|
||||||
|
"owner": "willibutz",
|
||||||
|
"repo": "napalm",
|
||||||
|
"rev": "b492440d9e64ae20736d3bec5c7715ffcbde83f5",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "willibutz",
|
||||||
|
"ref": "avoid-foldl-stack-overflow",
|
||||||
|
"repo": "napalm",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"nix-vm-test": {
|
"nix-vm-test": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
|
|
@ -478,15 +446,21 @@
|
||||||
},
|
},
|
||||||
"nixos-anywhere": {
|
"nixos-anywhere": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"disko": "disko_2",
|
"disko": [
|
||||||
"flake-parts": "flake-parts_2",
|
"disko"
|
||||||
|
],
|
||||||
|
"flake-parts": [
|
||||||
|
"flake-parts"
|
||||||
|
],
|
||||||
"nix-vm-test": "nix-vm-test",
|
"nix-vm-test": "nix-vm-test",
|
||||||
"nixos-images": "nixos-images",
|
"nixos-images": "nixos-images",
|
||||||
"nixos-stable": "nixos-stable",
|
"nixos-stable": "nixos-stable",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"treefmt-nix": "treefmt-nix_2"
|
"treefmt-nix": [
|
||||||
|
"treefmt-nix"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1749105224,
|
"lastModified": 1749105224,
|
||||||
|
|
@ -560,18 +534,18 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs_2": {
|
"nixpkgs-lib": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1636273007,
|
"lastModified": 1751159883,
|
||||||
"narHash": "sha256-eb6HcZNacO9vIP/KcJ5CoCRYSGfD+VxzYs2cCafEo4Y=",
|
"narHash": "sha256-urW/Ylk9FIfvXfliA1ywh75yszAbiTEVgpPeinFyVZo=",
|
||||||
"owner": "nixos",
|
"owner": "nix-community",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs.lib",
|
||||||
"rev": "c69c6533c820c55c3f1d924b399d8f6925a1e41a",
|
"rev": "14a40a1d7fb9afa4739275ac642ed7301a9ba1ab",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
"owner": "nixos",
|
"owner": "nix-community",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs.lib",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
|
@ -585,7 +559,7 @@
|
||||||
"stylix",
|
"stylix",
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"treefmt-nix": "treefmt-nix_3"
|
"treefmt-nix": "treefmt-nix"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1751320053,
|
"lastModified": 1751320053,
|
||||||
|
|
@ -601,20 +575,75 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"pyproject-build-systems": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"authentik-nix",
|
||||||
|
"nixpkgs"
|
||||||
|
],
|
||||||
|
"pyproject-nix": [
|
||||||
|
"authentik-nix",
|
||||||
|
"pyproject-nix"
|
||||||
|
],
|
||||||
|
"uv2nix": [
|
||||||
|
"authentik-nix",
|
||||||
|
"uv2nix"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1749519371,
|
||||||
|
"narHash": "sha256-UJONN7mA2stweZCoRcry2aa1XTTBL0AfUOY84Lmqhos=",
|
||||||
|
"owner": "pyproject-nix",
|
||||||
|
"repo": "build-system-pkgs",
|
||||||
|
"rev": "7c06967eca687f3482624250428cc12f43c92523",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "pyproject-nix",
|
||||||
|
"repo": "build-system-pkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"pyproject-nix": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"authentik-nix",
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1750499893,
|
||||||
|
"narHash": "sha256-ThKBd8XSvITAh2JqU7enOp8AfKeQgf9u7zYC41cnBE4=",
|
||||||
|
"owner": "pyproject-nix",
|
||||||
|
"repo": "pyproject.nix",
|
||||||
|
"rev": "e824458bd917b44bf4c38795dea2650336b2f55d",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "pyproject-nix",
|
||||||
|
"repo": "pyproject.nix",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"root": {
|
"root": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"advisory-db": "advisory-db",
|
"advisory-db": "advisory-db",
|
||||||
|
"authentik-nix": "authentik-nix",
|
||||||
"cosmic-manager": "cosmic-manager",
|
"cosmic-manager": "cosmic-manager",
|
||||||
"crane": "crane",
|
"crane": "crane",
|
||||||
"disko": "disko",
|
"disko": "disko",
|
||||||
"flake-base": "flake-base",
|
"flake-base": "flake-base",
|
||||||
|
"flake-parts": "flake-parts",
|
||||||
|
"flake-utils": "flake-utils_2",
|
||||||
"home-manager": "home-manager",
|
"home-manager": "home-manager",
|
||||||
"nixos-anywhere": "nixos-anywhere",
|
"nixos-anywhere": "nixos-anywhere",
|
||||||
"nixpkgs": "nixpkgs",
|
"nixpkgs": "nixpkgs",
|
||||||
"rust-overlay": "rust-overlay",
|
"rust-overlay": "rust-overlay",
|
||||||
"stylix": "stylix",
|
"stylix": "stylix",
|
||||||
|
"systems": "systems_2",
|
||||||
"terranix": "terranix",
|
"terranix": "terranix",
|
||||||
"terranix-hcloud": "terranix-hcloud"
|
"terranix-hcloud": "terranix-hcloud",
|
||||||
|
"treefmt-nix": "treefmt-nix_2"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"rust-overlay": {
|
"rust-overlay": {
|
||||||
|
|
@ -639,7 +668,7 @@
|
||||||
},
|
},
|
||||||
"snowfall-lib": {
|
"snowfall-lib": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": "flake-compat",
|
"flake-compat": "flake-compat_2",
|
||||||
"flake-utils-plus": "flake-utils-plus",
|
"flake-utils-plus": "flake-utils-plus",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"flake-base",
|
"flake-base",
|
||||||
|
|
@ -667,13 +696,17 @@
|
||||||
"base16-helix": "base16-helix",
|
"base16-helix": "base16-helix",
|
||||||
"base16-vim": "base16-vim",
|
"base16-vim": "base16-vim",
|
||||||
"firefox-gnome-theme": "firefox-gnome-theme",
|
"firefox-gnome-theme": "firefox-gnome-theme",
|
||||||
"flake-parts": "flake-parts_3",
|
"flake-parts": [
|
||||||
|
"flake-parts"
|
||||||
|
],
|
||||||
"gnome-shell": "gnome-shell",
|
"gnome-shell": "gnome-shell",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"nur": "nur",
|
"nur": "nur",
|
||||||
"systems": "systems_2",
|
"systems": [
|
||||||
|
"systems"
|
||||||
|
],
|
||||||
"tinted-foot": "tinted-foot",
|
"tinted-foot": "tinted-foot",
|
||||||
"tinted-kitty": "tinted-kitty",
|
"tinted-kitty": "tinted-kitty",
|
||||||
"tinted-schemes": "tinted-schemes",
|
"tinted-schemes": "tinted-schemes",
|
||||||
|
|
@ -742,7 +775,9 @@
|
||||||
},
|
},
|
||||||
"terranix": {
|
"terranix": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-parts": "flake-parts_4",
|
"flake-parts": [
|
||||||
|
"flake-parts"
|
||||||
|
],
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
|
|
@ -762,28 +797,17 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"terranix-examples": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1633465925,
|
|
||||||
"narHash": "sha256-BfXRW1ZHpK5jh5CVcw7eFpGsWE1CyVxL8R+V7uXemaU=",
|
|
||||||
"owner": "terranix",
|
|
||||||
"repo": "terranix-examples",
|
|
||||||
"rev": "70bf5d5a1ad4eabef1e4e71c1eb101021decd5a4",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "terranix",
|
|
||||||
"repo": "terranix-examples",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"terranix-hcloud": {
|
"terranix-hcloud": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-utils": "flake-utils_2",
|
"flake-utils": [
|
||||||
|
"flake-utils"
|
||||||
|
],
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"terranix": "terranix_2"
|
"terranix": [
|
||||||
|
"terranix"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1745572802,
|
"lastModified": 1745572802,
|
||||||
|
|
@ -799,29 +823,6 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"terranix_2": {
|
|
||||||
"inputs": {
|
|
||||||
"bats-assert": "bats-assert",
|
|
||||||
"bats-support": "bats-support",
|
|
||||||
"flake-utils": "flake-utils_3",
|
|
||||||
"nixpkgs": "nixpkgs_2",
|
|
||||||
"terranix-examples": "terranix-examples"
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1636274023,
|
|
||||||
"narHash": "sha256-HDiyJGgyDUoLnpL8N+wDm3cM/vEfYYc/p4N1kKH/kLk=",
|
|
||||||
"owner": "terranix",
|
|
||||||
"repo": "terranix",
|
|
||||||
"rev": "342ec8490bc948c8589414eb89f26b265cbfd62a",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "terranix",
|
|
||||||
"ref": "develop",
|
|
||||||
"repo": "terranix",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"tinted-foot": {
|
"tinted-foot": {
|
||||||
"flake": false,
|
"flake": false,
|
||||||
"locked": {
|
"locked": {
|
||||||
|
|
@ -904,48 +905,6 @@
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"treefmt-nix": {
|
"treefmt-nix": {
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"flake-base",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1750931469,
|
|
||||||
"narHash": "sha256-0IEdQB1nS+uViQw4k3VGUXntjkDp7aAlqcxdewb/hAc=",
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "treefmt-nix",
|
|
||||||
"rev": "ac8e6f32e11e9c7f153823abc3ab007f2a65d3e1",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "treefmt-nix",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"treefmt-nix_2": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixos-anywhere",
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1748243702,
|
|
||||||
"narHash": "sha256-9YzfeN8CB6SzNPyPm2XjRRqSixDopTapaRsnTpXUEY8=",
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "treefmt-nix",
|
|
||||||
"rev": "1f3f7b784643d488ba4bf315638b2b0a4c5fb007",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "numtide",
|
|
||||||
"repo": "treefmt-nix",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"treefmt-nix_3": {
|
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"stylix",
|
"stylix",
|
||||||
|
|
@ -966,6 +925,51 @@
|
||||||
"repo": "treefmt-nix",
|
"repo": "treefmt-nix",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
|
},
|
||||||
|
"treefmt-nix_2": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"nixpkgs"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1752055615,
|
||||||
|
"narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "treefmt-nix",
|
||||||
|
"rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "treefmt-nix",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"uv2nix": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs": [
|
||||||
|
"authentik-nix",
|
||||||
|
"nixpkgs"
|
||||||
|
],
|
||||||
|
"pyproject-nix": [
|
||||||
|
"authentik-nix",
|
||||||
|
"pyproject-nix"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1750987094,
|
||||||
|
"narHash": "sha256-GujDElxLgYatnNvuL1U6qd18lcuG6anJMjpfYRScV08=",
|
||||||
|
"owner": "pyproject-nix",
|
||||||
|
"repo": "uv2nix",
|
||||||
|
"rev": "4b703d851b61e664a70238711a8ff0efa1aa2f52",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "pyproject-nix",
|
||||||
|
"repo": "uv2nix",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"root": "root",
|
"root": "root",
|
||||||
|
|
|
||||||
58
flake.nix
58
flake.nix
|
|
@ -2,26 +2,61 @@
|
||||||
description = "A very basic flake";
|
description = "A very basic flake";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
|
authentik-nix = {
|
||||||
|
url = "github:nix-community/authentik-nix";
|
||||||
|
inputs = {
|
||||||
|
flake-utils.follows = "flake-utils";
|
||||||
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
flake-parts.follows = "flake-parts";
|
||||||
|
systems.follows = "systems";
|
||||||
|
};
|
||||||
|
};
|
||||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
|
nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
|
||||||
flake-base = {
|
flake-base = {
|
||||||
url = "git+https://khs.codes/nix/flake-base";
|
url = "git+https://khs.codes/nix/flake-base";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs = {
|
||||||
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
treefmt-nix.follows = "treefmt-nix";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
flake-utils = {
|
||||||
|
url = "github:numtide/flake-utils";
|
||||||
|
inputs = {
|
||||||
|
systems.follows = "systems";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
flake-parts = {
|
||||||
|
url = "github:hercules-ci/flake-parts";
|
||||||
};
|
};
|
||||||
disko = {
|
disko = {
|
||||||
url = "github:nix-community/disko";
|
url = "github:nix-community/disko";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs = {
|
||||||
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
terranix = {
|
terranix = {
|
||||||
url = "github:terranix/terranix";
|
url = "github:terranix/terranix";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs = {
|
||||||
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
flake-parts.follows = "flake-parts";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
home-manager = {
|
home-manager = {
|
||||||
url = "github:nix-community/home-manager/release-25.05";
|
url = "github:nix-community/home-manager/release-25.05";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs = {
|
||||||
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
terranix-hcloud = {
|
terranix-hcloud = {
|
||||||
url = "github:terranix/terranix-hcloud";
|
url = "github:terranix/terranix-hcloud";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs = {
|
||||||
|
flake-utils.follows = "flake-utils";
|
||||||
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
terranix.follows = "terranix";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
systems = {
|
||||||
|
url = "github:nix-systems/default";
|
||||||
};
|
};
|
||||||
crane.url = "github:ipetkov/crane";
|
crane.url = "github:ipetkov/crane";
|
||||||
advisory-db = {
|
advisory-db = {
|
||||||
|
|
@ -34,16 +69,27 @@
|
||||||
nixpkgs.follows = "nixpkgs";
|
nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
treefmt-nix = {
|
||||||
|
url = "github:numtide/treefmt-nix";
|
||||||
|
inputs = {
|
||||||
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
};
|
||||||
|
};
|
||||||
nixos-anywhere = {
|
nixos-anywhere = {
|
||||||
url = "github:nix-community/nixos-anywhere/1.11.0";
|
url = "github:nix-community/nixos-anywhere/1.11.0";
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.follows = "nixpkgs";
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
flake-parts.follows = "flake-parts";
|
||||||
|
treefmt-nix.follows = "treefmt-nix";
|
||||||
|
disko.follows = "disko";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
stylix = {
|
stylix = {
|
||||||
url = "github:nix-community/stylix/release-25.05";
|
url = "github:nix-community/stylix/release-25.05";
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.follows = "nixpkgs";
|
nixpkgs.follows = "nixpkgs";
|
||||||
|
flake-parts.follows = "flake-parts";
|
||||||
|
systems.follows = "systems";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
cosmic-manager = {
|
cosmic-manager = {
|
||||||
|
|
@ -51,6 +97,7 @@
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.follows = "nixpkgs";
|
nixpkgs.follows = "nixpkgs";
|
||||||
home-manager.follows = "home-manager";
|
home-manager.follows = "home-manager";
|
||||||
|
flake-parts.follows = "flake-parts";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -61,6 +108,7 @@
|
||||||
inputNixosModules = [
|
inputNixosModules = [
|
||||||
inputs.disko.nixosModules.disko
|
inputs.disko.nixosModules.disko
|
||||||
inputs.stylix.nixosModules.stylix
|
inputs.stylix.nixosModules.stylix
|
||||||
|
inputs.authentik-nix.nixosModules.default
|
||||||
];
|
];
|
||||||
inputHomeModules = [
|
inputHomeModules = [
|
||||||
inputs.cosmic-manager.homeManagerModules.cosmic-manager
|
inputs.cosmic-manager.homeManagerModules.cosmic-manager
|
||||||
|
|
|
||||||
|
|
@ -1,3 +1,6 @@
|
||||||
|
{
|
||||||
|
...
|
||||||
|
}:
|
||||||
{
|
{
|
||||||
khscodes.khs.enable = true;
|
khscodes.khs.enable = true;
|
||||||
khscodes.khs.shell.oh-my-posh.enable = true;
|
khscodes.khs.shell.oh-my-posh.enable = true;
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
{
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
khscodes.khs.enable = true;
|
||||||
|
khscodes.khs.shell.oh-my-posh.enable = true;
|
||||||
|
}
|
||||||
10
nix/homes/x86_64-linux/khs/default.nix
Normal file
10
nix/homes/x86_64-linux/khs/default.nix
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
{
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
khscodes.khs.enable = true;
|
||||||
|
khscodes.khs.shell.oh-my-posh.enable = true;
|
||||||
|
imports = lib.lists.optional config.khscodes.desktop.enable ./desktop.nix;
|
||||||
|
}
|
||||||
9
nix/homes/x86_64-linux/khs/desktop.nix
Normal file
9
nix/homes/x86_64-linux/khs/desktop.nix
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
{ pkgs, lib, ... }:
|
||||||
|
{
|
||||||
|
imports = lib.lists.optional (lib.strings.hasSuffix "-linux" pkgs.system) ./linux-desktop.nix;
|
||||||
|
home.packages = [
|
||||||
|
pkgs.bitwarden-cli
|
||||||
|
pkgs.nerd-fonts.inconsolata
|
||||||
|
pkgs.google-chrome
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ pkgs, ... }:
|
{ pkgs, ... }:
|
||||||
{
|
{
|
||||||
imports = [ ./khs-desktop.nix ];
|
|
||||||
home.packages = [ pkgs.spotify ];
|
home.packages = [ pkgs.spotify ];
|
||||||
}
|
}
|
||||||
|
|
@ -1,4 +0,0 @@
|
||||||
{ inputs, ... }:
|
|
||||||
{
|
|
||||||
imports = [ "${inputs.self}/nix/profiles/home/khs-linux-desktop.nix" ];
|
|
||||||
}
|
|
||||||
|
|
@ -53,7 +53,7 @@ in
|
||||||
dnsNames = lib.mkOption {
|
dnsNames = lib.mkOption {
|
||||||
type = lib.types.listOf lib.types.str;
|
type = lib.types.listOf lib.types.str;
|
||||||
description = "DNS names for the server";
|
description = "DNS names for the server";
|
||||||
default = lib.lists.unique ([ fqdn ] ++ config.networking.aliases);
|
default = lib.lists.unique ([ fqdn ] ++ config.khscodes.networking.aliases);
|
||||||
};
|
};
|
||||||
bucket = {
|
bucket = {
|
||||||
key = lib.mkOption {
|
key = lib.mkOption {
|
||||||
|
|
@ -62,14 +62,6 @@ in
|
||||||
default = "${fqdn}.tfstate";
|
default = "${fqdn}.tfstate";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
secretsSource = lib.mkOption {
|
|
||||||
type = lib.types.enum [
|
|
||||||
"bitwarden"
|
|
||||||
"vault"
|
|
||||||
];
|
|
||||||
description = "Whether to load opentofu secrets from Bitwarden or Vault";
|
|
||||||
default = "vault";
|
|
||||||
};
|
|
||||||
datacenter = lib.mkOption {
|
datacenter = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
description = "The Hetzner datacenter to create a server in";
|
description = "The Hetzner datacenter to create a server in";
|
||||||
|
|
@ -159,7 +151,7 @@ in
|
||||||
inherit labels;
|
inherit labels;
|
||||||
name = fqdn;
|
name = fqdn;
|
||||||
initial_image = "debian-12";
|
initial_image = "debian-12";
|
||||||
rdns = fqdn;
|
rdns = lib.mkIf cfg.mapRdns fqdn;
|
||||||
ssh_keys = [ config.khscodes.hcloud.output.data.ssh_key.khs.id ];
|
ssh_keys = [ config.khscodes.hcloud.output.data.ssh_key.khs.id ];
|
||||||
user_data = provisioningUserData;
|
user_data = provisioningUserData;
|
||||||
};
|
};
|
||||||
|
|
@ -211,7 +203,6 @@ in
|
||||||
khscodes.services.read-vault-auth-from-userdata.url = "http://169.254.169.254/latest/user-data";
|
khscodes.services.read-vault-auth-from-userdata.url = "http://169.254.169.254/latest/user-data";
|
||||||
khscodes.infrastructure.provisioning.pre = {
|
khscodes.infrastructure.provisioning.pre = {
|
||||||
modules = modules;
|
modules = modules;
|
||||||
secretsSource = cfg.secretsSource;
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
|
|
|
||||||
9
nix/modules/nixos/infrastructure/openbao/default.nix
Normal file
9
nix/modules/nixos/infrastructure/openbao/default.nix
Normal file
|
|
@ -0,0 +1,9 @@
|
||||||
|
{ lib, ... }:
|
||||||
|
{
|
||||||
|
options.khscodes.infrastructure.openbao = {
|
||||||
|
domain = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "vault.kaareskovgaard.net";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -7,6 +7,8 @@ let
|
||||||
cfg = config.khscodes.infrastructure.vault-loki-sender;
|
cfg = config.khscodes.infrastructure.vault-loki-sender;
|
||||||
fqdn = config.khscodes.networking.fqdn;
|
fqdn = config.khscodes.networking.fqdn;
|
||||||
vaultRoleName = config.khscodes.infrastructure.vault-server-approle.role_name;
|
vaultRoleName = config.khscodes.infrastructure.vault-server-approle.role_name;
|
||||||
|
client_key = "/var/lib/alloy/loki.key";
|
||||||
|
client_cert = "/var/lib/alloy/loki.cert";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.khscodes.infrastructure.vault-loki-sender = {
|
options.khscodes.infrastructure.vault-loki-sender = {
|
||||||
|
|
@ -56,8 +58,8 @@ in
|
||||||
{{ .Key }}
|
{{ .Key }}
|
||||||
{{ .Cert }}
|
{{ .Cert }}
|
||||||
{{ .CA }}
|
{{ .CA }}
|
||||||
{{ .Key | writeToFile "${config.khscodes.services.alloy.loki.client_key}" "${config.khscodes.services.alloy.user}" "${config.khscodes.services.alloy.group}" "0600" }}
|
{{ .Key | writeToFile "${client_key}" "${config.khscodes.services.alloy.user}" "${config.khscodes.services.alloy.group}" "0600" }}
|
||||||
{{ .Cert | writeToFile "${config.khscodes.services.alloy.loki.client_cert}" "${config.khscodes.services.alloy.user}" "${config.khscodes.services.alloy.group}" "0644" }}
|
{{ .Cert | writeToFile "${client_cert}" "${config.khscodes.services.alloy.user}" "${config.khscodes.services.alloy.group}" "0644" }}
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
'';
|
'';
|
||||||
destination = "/var/lib/alloy/cache.key";
|
destination = "/var/lib/alloy/cache.key";
|
||||||
|
|
@ -69,10 +71,13 @@ in
|
||||||
];
|
];
|
||||||
khscodes.services.alloy = {
|
khscodes.services.alloy = {
|
||||||
enable = true;
|
enable = true;
|
||||||
loki = {
|
environment = {
|
||||||
client_key = "/var/lib/alloy/loki_cert.key";
|
LOKI_CLIENT_KEY = client_key;
|
||||||
client_cert = "/var/lib/alloy/loki_cert.pem";
|
LOKI_CLIENT_CERT = client_cert;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
environment.etc."alloy/loki.alloy" = {
|
||||||
|
source = ./loki.alloy;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,78 @@
|
||||||
|
// Collect logs from systemd journal for node_exporter integration
|
||||||
|
loki.source.journal "logs_integrations_integrations_node_exporter_journal_scrape" {
|
||||||
|
// Only collect logs from the last 24 hours
|
||||||
|
max_age = "24h0m0s"
|
||||||
|
// Apply relabeling rules to the logs
|
||||||
|
relabel_rules = discovery.relabel.logs_integrations_integrations_node_exporter_journal_scrape.rules
|
||||||
|
// Send logs to the local Loki instance
|
||||||
|
forward_to = [loki.write.local.receiver]
|
||||||
|
}
|
||||||
|
|
||||||
|
// Define which log files to collect for node_exporter
|
||||||
|
local.file_match "logs_integrations_integrations_node_exporter_direct_scrape" {
|
||||||
|
path_targets = [{
|
||||||
|
// Target localhost for log collection
|
||||||
|
__address__ = "localhost",
|
||||||
|
// Collect standard system logs
|
||||||
|
__path__ = "/var/log/{syslog,messages,*.log}",
|
||||||
|
// Add instance label with hostname
|
||||||
|
instance = constants.hostname,
|
||||||
|
// Add job label for logs
|
||||||
|
job = "integrations/node_exporter",
|
||||||
|
}]
|
||||||
|
}
|
||||||
|
|
||||||
|
// Define relabeling rules for systemd journal logs
|
||||||
|
discovery.relabel "logs_integrations_integrations_node_exporter_journal_scrape" {
|
||||||
|
targets = []
|
||||||
|
|
||||||
|
rule {
|
||||||
|
// Extract systemd unit information into a label
|
||||||
|
source_labels = ["__journal__systemd_unit"]
|
||||||
|
target_label = "unit"
|
||||||
|
}
|
||||||
|
|
||||||
|
rule {
|
||||||
|
// Extract boot ID information into a label
|
||||||
|
source_labels = ["__journal__boot_id"]
|
||||||
|
target_label = "boot_id"
|
||||||
|
}
|
||||||
|
|
||||||
|
rule {
|
||||||
|
// Extract transport information into a label
|
||||||
|
source_labels = ["__journal__transport"]
|
||||||
|
target_label = "transport"
|
||||||
|
}
|
||||||
|
|
||||||
|
rule {
|
||||||
|
// Extract log priority into a level label
|
||||||
|
source_labels = ["__journal_priority_keyword"]
|
||||||
|
target_label = "level"
|
||||||
|
}
|
||||||
|
|
||||||
|
rule {
|
||||||
|
// Set the instance label to the hostname of the machine
|
||||||
|
target_label = "instance"
|
||||||
|
replacement = constants.hostname
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Collect logs from files for node_exporter
|
||||||
|
loki.source.file "logs_integrations_integrations_node_exporter_direct_scrape" {
|
||||||
|
// Use targets defined in local.file_match
|
||||||
|
targets = local.file_match.logs_integrations_integrations_node_exporter_direct_scrape.targets
|
||||||
|
// Send logs to the local Loki instance
|
||||||
|
forward_to = [loki.write.local.receiver]
|
||||||
|
}
|
||||||
|
|
||||||
|
// Define where to send logs for storage
|
||||||
|
loki.write "local" {
|
||||||
|
endpoint {
|
||||||
|
// Send logs to a locally running Loki instance
|
||||||
|
url = "https://loki.kaareskovgaard.net/loki/api/v1/push"
|
||||||
|
tls_config {
|
||||||
|
cert_file = sys.env("LOKI_CLIENT_CERT")
|
||||||
|
key_file = sys.env("LOKI_CLIENT_KEY")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -7,13 +7,15 @@ let
|
||||||
cfg = config.khscodes.infrastructure.vault-prometheus-sender;
|
cfg = config.khscodes.infrastructure.vault-prometheus-sender;
|
||||||
fqdn = config.khscodes.networking.fqdn;
|
fqdn = config.khscodes.networking.fqdn;
|
||||||
vaultRoleName = config.khscodes.infrastructure.vault-server-approle.role_name;
|
vaultRoleName = config.khscodes.infrastructure.vault-server-approle.role_name;
|
||||||
|
client_key = "/var/lib/alloy/prometheus.key";
|
||||||
|
client_cert = "/var/lib/alloy/prometheus.cert";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.khscodes.infrastructure.vault-prometheus-sender = {
|
options.khscodes.infrastructure.vault-prometheus-sender = {
|
||||||
enable = lib.mkEnableOption "Configures the server approle to allow sending data to prometheus";
|
enable = lib.mkEnableOption "Configures the server approle to allow sending data to prometheus";
|
||||||
terranixBackendName = lib.mkOption {
|
terranixBackendName = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
description = "This should only be configured for the server hosting prometheus, to allow setting up dependencies in terraform";
|
description = "This should only be configured for the server hosting vault, to allow setting up dependencies in terraform";
|
||||||
default = "prometheus-mtls";
|
default = "prometheus-mtls";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -56,8 +58,8 @@ in
|
||||||
{{ .Key }}
|
{{ .Key }}
|
||||||
{{ .Cert }}
|
{{ .Cert }}
|
||||||
{{ .CA }}
|
{{ .CA }}
|
||||||
{{ .Key | writeToFile "${config.khscodes.services.alloy.prometheus.client_key}" "${config.khscodes.services.alloy.user}" "${config.khscodes.services.alloy.group}" "0600" }}
|
{{ .Key | writeToFile "${client_key}" "${config.khscodes.services.alloy.user}" "${config.khscodes.services.alloy.group}" "0600" }}
|
||||||
{{ .Cert | writeToFile "${config.khscodes.services.alloy.prometheus.client_cert}" "${config.khscodes.services.alloy.user}" "${config.khscodes.services.alloy.group}" "0644" }}
|
{{ .Cert | writeToFile "${client_cert}" "${config.khscodes.services.alloy.user}" "${config.khscodes.services.alloy.group}" "0644" }}
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
'';
|
'';
|
||||||
destination = "/var/lib/alloy/cache.key";
|
destination = "/var/lib/alloy/cache.key";
|
||||||
|
|
@ -69,10 +71,13 @@ in
|
||||||
];
|
];
|
||||||
khscodes.services.alloy = {
|
khscodes.services.alloy = {
|
||||||
enable = true;
|
enable = true;
|
||||||
prometheus = {
|
environment = {
|
||||||
client_key = "/var/lib/alloy/prometheus_cert.key";
|
PROMETHEUS_CLIENT_KEY = client_key;
|
||||||
client_cert = "/var/lib/alloy/prometheus_cert.pem";
|
PROMETHEUS_CLIENT_CERT = client_cert;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
environment.etc."alloy/prometheus.alloy" = {
|
||||||
|
source = ./prometheus.alloy;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,72 @@
|
||||||
|
// This block relabels metrics coming from node_exporter to add standard labels
|
||||||
|
discovery.relabel "integrations_node_exporter" {
|
||||||
|
targets = prometheus.exporter.unix.integrations_node_exporter.targets
|
||||||
|
|
||||||
|
rule {
|
||||||
|
// Set the instance label to the hostname of the machine
|
||||||
|
target_label = "instance"
|
||||||
|
replacement = constants.hostname
|
||||||
|
}
|
||||||
|
|
||||||
|
rule {
|
||||||
|
// Set a standard job name for all node_exporter metrics
|
||||||
|
target_label = "job"
|
||||||
|
replacement = "integrations/node_exporter"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
//
|
||||||
|
// Configure the node_exporter integration to collect system metrics
|
||||||
|
prometheus.exporter.unix "integrations_node_exporter" {
|
||||||
|
// Disable unnecessary collectors to reduce overhead
|
||||||
|
disable_collectors = ["ipvs", "btrfs", "infiniband", "xfs", "zfs"]
|
||||||
|
enable_collectors = ["meminfo"]
|
||||||
|
|
||||||
|
filesystem {
|
||||||
|
// Exclude filesystem types that aren't relevant for monitoring
|
||||||
|
fs_types_exclude = "^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|tmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$"
|
||||||
|
// Exclude mount points that aren't relevant for monitoring
|
||||||
|
mount_points_exclude = "^/(dev|proc|run/credentials/.+|sys|var/lib/docker/.+)($|/)"
|
||||||
|
// Timeout for filesystem operations
|
||||||
|
mount_timeout = "5s"
|
||||||
|
}
|
||||||
|
|
||||||
|
netclass {
|
||||||
|
// Ignore virtual and container network interfaces
|
||||||
|
ignored_devices = "^(veth.*|cali.*|[a-f0-9]{15})$"
|
||||||
|
}
|
||||||
|
|
||||||
|
netdev {
|
||||||
|
// Exclude virtual and container network interfaces from device metrics
|
||||||
|
device_exclude = "^(veth.*|cali.*|[a-f0-9]{15})$"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
// Define how to scrape metrics from the node_exporter
|
||||||
|
prometheus.scrape "integrations_node_exporter" {
|
||||||
|
scrape_interval = "15s"
|
||||||
|
// Use the targets with labels from the discovery.relabel component
|
||||||
|
targets = discovery.relabel.integrations_node_exporter.output
|
||||||
|
// Send the scraped metrics to the relabeling component
|
||||||
|
forward_to = [otelcol.receiver.prometheus.default.receiver]
|
||||||
|
}
|
||||||
|
|
||||||
|
otelcol.receiver.prometheus "default" {
|
||||||
|
output {
|
||||||
|
metrics = [otelcol.exporter.otlphttp.default.input]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
// Define where to send the metrics for storage
|
||||||
|
otelcol.exporter.otlphttp "default" {
|
||||||
|
client {
|
||||||
|
endpoint = "https://prometheus.kaareskovgaard.net/api/v1/otlp/"
|
||||||
|
tls {
|
||||||
|
cert_file = sys.env("PROMETHEUS_CLIENT_CERT")
|
||||||
|
key_file = sys.env("PROMETHEUS_CLIENT_KEY")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
encoding = "proto"
|
||||||
|
}
|
||||||
|
|
@ -6,6 +6,7 @@
|
||||||
}:
|
}:
|
||||||
let
|
let
|
||||||
cfg = config.khscodes.infrastructure.vault-server-approle;
|
cfg = config.khscodes.infrastructure.vault-server-approle;
|
||||||
|
vaultDomain = config.khscodes.infrastructure.openbao.domain;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.khscodes.infrastructure.vault-server-approle = {
|
options.khscodes.infrastructure.vault-server-approle = {
|
||||||
|
|
@ -18,6 +19,11 @@ in
|
||||||
description = "The provisioning stage that should include the provisioning. This should be pre for every server except the OpenBAO server itself";
|
description = "The provisioning stage that should include the provisioning. This should be pre for every server except the OpenBAO server itself";
|
||||||
default = "pre";
|
default = "pre";
|
||||||
};
|
};
|
||||||
|
path = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "approle";
|
||||||
|
description = "Sets the path, as a terraform expression, for the approle to get created in. Not useful for most instances, but useful when doing bootstrapping, to establish a dependency.";
|
||||||
|
};
|
||||||
role_name = lib.mkOption {
|
role_name = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
description = "Name of the role being created";
|
description = "Name of the role being created";
|
||||||
|
|
@ -52,18 +58,30 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
config = lib.mkIf cfg.enable {
|
config = lib.mkIf cfg.enable {
|
||||||
khscodes.services.read-vault-auth-from-userdata.enable = true;
|
khscodes.services.read-vault-auth-from-userdata.enable = cfg.stage == "pre";
|
||||||
khscodes.services.vault-agent.enable = true;
|
khscodes.services.vault-agent.enable = true;
|
||||||
khscodes.infrastructure.provisioning.${cfg.stage} = {
|
khscodes.infrastructure.provisioning.${cfg.stage} = {
|
||||||
modules = [
|
modules = [
|
||||||
(
|
(
|
||||||
{ config, ... }:
|
{ config, lib, ... }:
|
||||||
{
|
{
|
||||||
imports = [ inputs.self.terranixModules.vault ];
|
imports = [ inputs.self.terranixModules.vault ];
|
||||||
|
output = lib.mkIf (cfg.stage == "post") {
|
||||||
|
role-id = {
|
||||||
|
value = config.khscodes.vault.output.approle_auth_backend_role.${cfg.role_name}.role_id;
|
||||||
|
sensitive = false;
|
||||||
|
};
|
||||||
|
secret-id-wrapped = {
|
||||||
|
value =
|
||||||
|
config.khscodes.vault.output.approle_auth_backend_role_secret_id.${cfg.role_name}.wrapping_token;
|
||||||
|
sensitive = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
khscodes.vault = {
|
khscodes.vault = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
domain = vaultDomain;
|
||||||
approle_auth_backend_role.${cfg.role_name} = {
|
approle_auth_backend_role.${cfg.role_name} = {
|
||||||
backend = "approle";
|
backend = cfg.path;
|
||||||
role_name = cfg.role_name;
|
role_name = cfg.role_name;
|
||||||
# Secret IDs never expire, to allow vault agent to restart without issues.
|
# Secret IDs never expire, to allow vault agent to restart without issues.
|
||||||
# TODO: Look into doing this in a better way going forward, such that this won't
|
# TODO: Look into doing this in a better way going forward, such that this won't
|
||||||
|
|
@ -76,7 +94,7 @@ in
|
||||||
token_policies = [ cfg.role_name ];
|
token_policies = [ cfg.role_name ];
|
||||||
};
|
};
|
||||||
approle_auth_backend_role_secret_id.${cfg.role_name} = {
|
approle_auth_backend_role_secret_id.${cfg.role_name} = {
|
||||||
backend = "approle";
|
backend = cfg.path;
|
||||||
# Not hardcoding the role name here, as reading it like this will create a dependency
|
# Not hardcoding the role name here, as reading it like this will create a dependency
|
||||||
# on the role being created first, which is needed.
|
# on the role being created first, which is needed.
|
||||||
role_name = config.khscodes.vault.output.approle_auth_backend_role.${cfg.role_name}.role_name;
|
role_name = config.khscodes.vault.output.approle_auth_backend_role.${cfg.role_name}.role_name;
|
||||||
|
|
|
||||||
25
nix/modules/nixos/machine/default.nix
Normal file
25
nix/modules/nixos/machine/default.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
||||||
|
{ config, lib, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.khscodes.machine;
|
||||||
|
in
|
||||||
|
rec {
|
||||||
|
options.khscodes.machine = {
|
||||||
|
type = lib.mkOption {
|
||||||
|
type = lib.types.enum [
|
||||||
|
"server"
|
||||||
|
"desktop"
|
||||||
|
];
|
||||||
|
description = "The kind of machine that is running";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
config = {
|
||||||
|
home-manager.sharedModules = [
|
||||||
|
{
|
||||||
|
inherit options;
|
||||||
|
config = {
|
||||||
|
khscodes.desktop.enable = cfg.type == "desktop";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
15
nix/modules/nixos/nix/default.nix
Normal file
15
nix/modules/nixos/nix/default.nix
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
{ config, lib, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.khscodes.nix;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.khscodes.nix = {
|
||||||
|
nix-community.enable = lib.mkEnableOption "Enables nix-community substituters";
|
||||||
|
};
|
||||||
|
config = {
|
||||||
|
nix.settings = lib.mkIf cfg.nix-community.enable {
|
||||||
|
substituters = [ "https://nix-community.cachix.org" ];
|
||||||
|
trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
55
nix/modules/nixos/os/auto-update/default.nix
Normal file
55
nix/modules/nixos/os/auto-update/default.nix
Normal file
|
|
@ -0,0 +1,55 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
inputs,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
cfg = config.khscodes.os.auto-update;
|
||||||
|
upgradePath = "/var/lib/system-upgrade";
|
||||||
|
upgradeVersion = "/var/lib/system-upgrade.version";
|
||||||
|
prepareUpgrade = pkgs.writeShellApplication {
|
||||||
|
runtimeInputs = [
|
||||||
|
pkgs.uutils-coreutils-noprefix
|
||||||
|
pkgs.nix
|
||||||
|
];
|
||||||
|
name = "nixos-prepare-upgrade";
|
||||||
|
text = ''
|
||||||
|
|
||||||
|
|
||||||
|
current_version=""
|
||||||
|
if [[ -f ${upgradeVersion} ]]; then
|
||||||
|
current_version="$(cat ${upgradeVersion})"
|
||||||
|
fi
|
||||||
|
if [[ "$current_version" != "${inputs.self.outPath}" ]]; then
|
||||||
|
rm -rf ${upgradePath}
|
||||||
|
cp -r ${inputs.self.outPath} ${upgradePath}
|
||||||
|
echo -n ${inputs.self.outPath} > ${upgradeVersion}
|
||||||
|
fi
|
||||||
|
cd ${upgradePath}
|
||||||
|
NIX_CONFIG="extra-experimental-features=flake nix-command" nix flake update
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.khscodes.os.auto-update = {
|
||||||
|
enable = lib.mkEnableOption "Enables automatic OS updates";
|
||||||
|
dates = "02:00";
|
||||||
|
randomizedDelaySec = "45min";
|
||||||
|
};
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
system.autoUpgrade = {
|
||||||
|
enable = true;
|
||||||
|
flake = upgradePath;
|
||||||
|
};
|
||||||
|
systemd.services.nixos-upgrade-prepare-flake = {
|
||||||
|
wantedBy = [ "nixos-upgrade.service" ];
|
||||||
|
before = [ "nixos-upgrade.service" ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
ExecStart = lib.getExe prepareUpgrade;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,151 +0,0 @@
|
||||||
// This block relabels metrics coming from node_exporter to add standard labels
|
|
||||||
discovery.relabel "integrations_node_exporter" {
|
|
||||||
targets = prometheus.exporter.unix.integrations_node_exporter.targets
|
|
||||||
|
|
||||||
rule {
|
|
||||||
// Set the instance label to the hostname of the machine
|
|
||||||
target_label = "instance"
|
|
||||||
replacement = constants.hostname
|
|
||||||
}
|
|
||||||
|
|
||||||
rule {
|
|
||||||
// Set a standard job name for all node_exporter metrics
|
|
||||||
target_label = "job"
|
|
||||||
replacement = "integrations/node_exporter"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
//
|
|
||||||
// Configure the node_exporter integration to collect system metrics
|
|
||||||
prometheus.exporter.unix "integrations_node_exporter" {
|
|
||||||
// Disable unnecessary collectors to reduce overhead
|
|
||||||
disable_collectors = ["ipvs", "btrfs", "infiniband", "xfs", "zfs"]
|
|
||||||
enable_collectors = ["meminfo"]
|
|
||||||
|
|
||||||
filesystem {
|
|
||||||
// Exclude filesystem types that aren't relevant for monitoring
|
|
||||||
fs_types_exclude = "^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|tmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$"
|
|
||||||
// Exclude mount points that aren't relevant for monitoring
|
|
||||||
mount_points_exclude = "^/(dev|proc|run/credentials/.+|sys|var/lib/docker/.+)($|/)"
|
|
||||||
// Timeout for filesystem operations
|
|
||||||
mount_timeout = "5s"
|
|
||||||
}
|
|
||||||
|
|
||||||
netclass {
|
|
||||||
// Ignore virtual and container network interfaces
|
|
||||||
ignored_devices = "^(veth.*|cali.*|[a-f0-9]{15})$"
|
|
||||||
}
|
|
||||||
|
|
||||||
netdev {
|
|
||||||
// Exclude virtual and container network interfaces from device metrics
|
|
||||||
device_exclude = "^(veth.*|cali.*|[a-f0-9]{15})$"
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
// Define how to scrape metrics from the node_exporter
|
|
||||||
prometheus.scrape "integrations_node_exporter" {
|
|
||||||
scrape_interval = "15s"
|
|
||||||
// Use the targets with labels from the discovery.relabel component
|
|
||||||
targets = discovery.relabel.integrations_node_exporter.output
|
|
||||||
// Send the scraped metrics to the relabeling component
|
|
||||||
forward_to = [otelcol.receiver.prometheus.default.receiver]
|
|
||||||
}
|
|
||||||
|
|
||||||
otelcol.receiver.prometheus "default" {
|
|
||||||
output {
|
|
||||||
metrics = [otelcol.exporter.otlphttp.default.input]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
// Define where to send the metrics for storage
|
|
||||||
otelcol.exporter.otlphttp "default" {
|
|
||||||
client {
|
|
||||||
endpoint = "https://prometheus.kaareskovgaard.net/api/v1/otlp/"
|
|
||||||
tls {
|
|
||||||
cert_file = "$PROMETHEUS_CLIENT_CERT"
|
|
||||||
key_file = "$PROMETHEUS_CLIENT_KEY"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
encoding = "proto"
|
|
||||||
}
|
|
||||||
|
|
||||||
// Collect logs from systemd journal for node_exporter integration
|
|
||||||
loki.source.journal "logs_integrations_integrations_node_exporter_journal_scrape" {
|
|
||||||
// Only collect logs from the last 24 hours
|
|
||||||
max_age = "24h0m0s"
|
|
||||||
// Apply relabeling rules to the logs
|
|
||||||
relabel_rules = discovery.relabel.logs_integrations_integrations_node_exporter_journal_scrape.rules
|
|
||||||
// Send logs to the local Loki instance
|
|
||||||
forward_to = [loki.write.local.receiver]
|
|
||||||
}
|
|
||||||
|
|
||||||
// Define which log files to collect for node_exporter
|
|
||||||
local.file_match "logs_integrations_integrations_node_exporter_direct_scrape" {
|
|
||||||
path_targets = [{
|
|
||||||
// Target localhost for log collection
|
|
||||||
__address__ = "localhost",
|
|
||||||
// Collect standard system logs
|
|
||||||
__path__ = "/var/log/{syslog,messages,*.log}",
|
|
||||||
// Add instance label with hostname
|
|
||||||
instance = constants.hostname,
|
|
||||||
// Add job label for logs
|
|
||||||
job = "integrations/node_exporter",
|
|
||||||
}]
|
|
||||||
}
|
|
||||||
|
|
||||||
// Define relabeling rules for systemd journal logs
|
|
||||||
discovery.relabel "logs_integrations_integrations_node_exporter_journal_scrape" {
|
|
||||||
targets = []
|
|
||||||
|
|
||||||
rule {
|
|
||||||
// Extract systemd unit information into a label
|
|
||||||
source_labels = ["__journal__systemd_unit"]
|
|
||||||
target_label = "unit"
|
|
||||||
}
|
|
||||||
|
|
||||||
rule {
|
|
||||||
// Extract boot ID information into a label
|
|
||||||
source_labels = ["__journal__boot_id"]
|
|
||||||
target_label = "boot_id"
|
|
||||||
}
|
|
||||||
|
|
||||||
rule {
|
|
||||||
// Extract transport information into a label
|
|
||||||
source_labels = ["__journal__transport"]
|
|
||||||
target_label = "transport"
|
|
||||||
}
|
|
||||||
|
|
||||||
rule {
|
|
||||||
// Extract log priority into a level label
|
|
||||||
source_labels = ["__journal_priority_keyword"]
|
|
||||||
target_label = "level"
|
|
||||||
}
|
|
||||||
|
|
||||||
rule {
|
|
||||||
// Set the instance label to the hostname of the machine
|
|
||||||
target_label = "instance"
|
|
||||||
replacement = constants.hostname
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Collect logs from files for node_exporter
|
|
||||||
loki.source.file "logs_integrations_integrations_node_exporter_direct_scrape" {
|
|
||||||
// Use targets defined in local.file_match
|
|
||||||
targets = local.file_match.logs_integrations_integrations_node_exporter_direct_scrape.targets
|
|
||||||
// Send logs to the local Loki instance
|
|
||||||
forward_to = [loki.write.local.receiver]
|
|
||||||
}
|
|
||||||
|
|
||||||
// Define where to send logs for storage
|
|
||||||
loki.write "local" {
|
|
||||||
endpoint {
|
|
||||||
// Send logs to a locally running Loki instance
|
|
||||||
url = "https://loki.kaareskovgaard.net/loki/api/v1/push"
|
|
||||||
tls_config {
|
|
||||||
cert_file = "$LOKI_CLIENT_CERT"
|
|
||||||
key_file = "$LOKI_CLIENT_KEY"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,31 +1,10 @@
|
||||||
{ config, lib, ... }:
|
{ config, lib, ... }:
|
||||||
let
|
let
|
||||||
cfg = config.khscodes.services.alloy;
|
cfg = config.khscodes.services.alloy;
|
||||||
configFile =
|
|
||||||
lib.strings.replaceStrings
|
|
||||||
[ "$LOKI_CLIENT_KEY" "$LOKI_CLIENT_CERT" "$PROMETHEUS_CLIENT_KEY" "$PROMETHEUS_CLIENT_CERT" ]
|
|
||||||
[ cfg.loki.client_key cfg.loki.client_cert cfg.prometheus.client_key cfg.prometheus.client_cert ]
|
|
||||||
(builtins.readFile ./config.alloy);
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.khscodes.services.alloy = {
|
options.khscodes.services.alloy = {
|
||||||
enable = lib.mkEnableOption "Enables alloy";
|
enable = lib.mkEnableOption "Enables alloy";
|
||||||
loki = {
|
|
||||||
client_key = lib.mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
};
|
|
||||||
client_cert = lib.mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
prometheus = {
|
|
||||||
client_key = lib.mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
};
|
|
||||||
client_cert = lib.mkOption {
|
|
||||||
type = lib.types.str;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
user = lib.mkOption {
|
user = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
default = "alloy";
|
default = "alloy";
|
||||||
|
|
@ -34,6 +13,10 @@ in
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
default = "alloy";
|
default = "alloy";
|
||||||
};
|
};
|
||||||
|
environment = lib.mkOption {
|
||||||
|
type = lib.types.attrsOf lib.types.str;
|
||||||
|
default = { };
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
config = lib.mkIf cfg.enable {
|
config = lib.mkIf cfg.enable {
|
||||||
|
|
@ -44,6 +27,7 @@ in
|
||||||
User = "${cfg.user}";
|
User = "${cfg.user}";
|
||||||
Group = "${cfg.group}";
|
Group = "${cfg.group}";
|
||||||
};
|
};
|
||||||
|
environment = cfg.environment;
|
||||||
};
|
};
|
||||||
users.users.${cfg.user} = {
|
users.users.${cfg.user} = {
|
||||||
description = "Alloy service user";
|
description = "Alloy service user";
|
||||||
|
|
@ -51,8 +35,5 @@ in
|
||||||
group = cfg.group;
|
group = cfg.group;
|
||||||
};
|
};
|
||||||
users.groups.${cfg.group} = { };
|
users.groups.${cfg.group} = { };
|
||||||
environment.etc."alloy/config.alloy" = {
|
|
||||||
text = configFile;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -7,6 +7,10 @@ in
|
||||||
enable = lib.mkEnableOption "Enables openssh service for the instance";
|
enable = lib.mkEnableOption "Enables openssh service for the instance";
|
||||||
hostCertificate = {
|
hostCertificate = {
|
||||||
enable = lib.mkEnableOption "Enables getting host certificates from OpenBAO";
|
enable = lib.mkEnableOption "Enables getting host certificates from OpenBAO";
|
||||||
|
path = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "ssh-host";
|
||||||
|
};
|
||||||
hostNames = lib.mkOption {
|
hostNames = lib.mkOption {
|
||||||
type = lib.types.listOf lib.types.str;
|
type = lib.types.listOf lib.types.str;
|
||||||
description = "The list of host names to get certificates for";
|
description = "The list of host names to get certificates for";
|
||||||
|
|
@ -48,7 +52,7 @@ in
|
||||||
{
|
{
|
||||||
khscodes.vault.ssh_secret_backend_role.${vaultRoleName} = {
|
khscodes.vault.ssh_secret_backend_role.${vaultRoleName} = {
|
||||||
name = fqdn;
|
name = fqdn;
|
||||||
backend = sshHostBackend;
|
backend = cfg.hostCertificate.path;
|
||||||
key_type = "ca";
|
key_type = "ca";
|
||||||
allow_host_certificates = true;
|
allow_host_certificates = true;
|
||||||
allow_bare_domains = true;
|
allow_bare_domains = true;
|
||||||
|
|
|
||||||
|
|
@ -93,7 +93,7 @@ in
|
||||||
address = lib.mkOption {
|
address = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
description = "Address of the Vault/OpenBAO service";
|
description = "Address of the Vault/OpenBAO service";
|
||||||
default = "https://vault.kaareskovgaard.net";
|
default = "https://${config.khscodes.infrastructure.openbao.domain}";
|
||||||
};
|
};
|
||||||
roleIdFilePath = lib.mkOption {
|
roleIdFilePath = lib.mkOption {
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
|
|
|
||||||
|
|
@ -5,6 +5,9 @@ in
|
||||||
{
|
{
|
||||||
options.khscodes.vault = {
|
options.khscodes.vault = {
|
||||||
enable = lib.mkEnableOption "Enables the openbao provider";
|
enable = lib.mkEnableOption "Enables the openbao provider";
|
||||||
|
domain = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
};
|
||||||
policy = lib.mkOption {
|
policy = lib.mkOption {
|
||||||
type = lib.types.attrsOf (
|
type = lib.types.attrsOf (
|
||||||
lib.khscodes.mkSubmodule {
|
lib.khscodes.mkSubmodule {
|
||||||
|
|
@ -34,7 +37,7 @@ in
|
||||||
|
|
||||||
config = lib.mkIf cfg.enable {
|
config = lib.mkIf cfg.enable {
|
||||||
provider.vault = {
|
provider.vault = {
|
||||||
address = "https://vault.kaareskovgaard.net";
|
address = "https://${cfg.domain}";
|
||||||
};
|
};
|
||||||
terraform.required_providers.vault = {
|
terraform.required_providers.vault = {
|
||||||
source = "hashicorp/vault";
|
source = "hashicorp/vault";
|
||||||
|
|
|
||||||
|
|
@ -18,15 +18,25 @@ in
|
||||||
default = null;
|
default = null;
|
||||||
};
|
};
|
||||||
default_lease_ttl_seconds = lib.mkOption {
|
default_lease_ttl_seconds = lib.mkOption {
|
||||||
type = lib.types.int;
|
type = lib.types.nullOr lib.types.int;
|
||||||
description = "Default lease ttl in seconds";
|
description = "Default lease ttl in seconds";
|
||||||
default = null;
|
default = null;
|
||||||
};
|
};
|
||||||
max_lease_ttl_seconds = lib.mkOption {
|
max_lease_ttl_seconds = lib.mkOption {
|
||||||
type = lib.types.int;
|
type = lib.types.nullOr lib.types.int;
|
||||||
description = "Max lease ttl in seconds";
|
description = "Max lease ttl in seconds";
|
||||||
default = null;
|
default = null;
|
||||||
};
|
};
|
||||||
|
options = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.attrs;
|
||||||
|
description = "Options for the mount";
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
|
description = lib.mkOption {
|
||||||
|
type = lib.types.nullOr lib.types.str;
|
||||||
|
description = "Usage description for the mount";
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
description = "vault_mount";
|
description = "vault_mount";
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -13,11 +13,28 @@ in
|
||||||
type = lib.types.str;
|
type = lib.types.str;
|
||||||
description = "The name of the role. Can be used instead of hardcoding the role, to create a dependency in OpenTofu";
|
description = "The name of the role. Can be used instead of hardcoding the role, to create a dependency in OpenTofu";
|
||||||
};
|
};
|
||||||
|
role_id = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
description = "ID of the role";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
description = "vault_approle_auth_backend_role output";
|
description = "vault_approle_auth_backend_role output";
|
||||||
}
|
}
|
||||||
);
|
);
|
||||||
};
|
};
|
||||||
|
approle_auth_backend_role_secret_id = lib.mkOption {
|
||||||
|
type = lib.types.attrsOf (
|
||||||
|
lib.khscodes.mkSubmodule {
|
||||||
|
options = {
|
||||||
|
wrapping_token = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
description = "The generated wrapping token";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
description = "vault_approle_auth_backend_role_secret_id";
|
||||||
|
}
|
||||||
|
);
|
||||||
|
};
|
||||||
mount = lib.mkOption {
|
mount = lib.mkOption {
|
||||||
type = lib.types.attrsOf (
|
type = lib.types.attrsOf (
|
||||||
lib.khscodes.mkSubmodule {
|
lib.khscodes.mkSubmodule {
|
||||||
|
|
@ -41,8 +58,18 @@ in
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
role_name = "\${ vault_approle_auth_backend_role.${sanitizedName}.role_name }";
|
role_name = "\${ vault_approle_auth_backend_role.${sanitizedName}.role_name }";
|
||||||
|
role_id = "\${ vault_approle_auth_backend_role.${sanitizedName}.role_id }";
|
||||||
}
|
}
|
||||||
) cfg.approle_auth_backend_role;
|
) cfg.approle_auth_backend_role;
|
||||||
|
khscodes.vault.output.approle_auth_backend_role_secret_id = lib.mapAttrs (
|
||||||
|
name: value:
|
||||||
|
let
|
||||||
|
sanitizedName = lib.khscodes.sanitize-terraform-name name;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
wrapping_token = "\${ vault_approle_auth_backend_role_secret_id.${sanitizedName}.wrapping_token }";
|
||||||
|
}
|
||||||
|
) cfg.approle_auth_backend_role_secret_id;
|
||||||
khscodes.vault.output.mount = lib.mapAttrs (
|
khscodes.vault.output.mount = lib.mapAttrs (
|
||||||
name: value:
|
name: value:
|
||||||
let
|
let
|
||||||
|
|
|
||||||
|
|
@ -25,7 +25,7 @@
|
||||||
"AUTHENTIK_TOKEN" = "Admin API Token";
|
"AUTHENTIK_TOKEN" = "Admin API Token";
|
||||||
"TF_VAR_authentik_username" = "login.username";
|
"TF_VAR_authentik_username" = "login.username";
|
||||||
};
|
};
|
||||||
"vault.kaareskovgaard.net" = {
|
"vault-test.kaareskovgaard.net" = {
|
||||||
"VAULT_TOKEN" = "Initial root token";
|
"VAULT_TOKEN" = "Initial root token";
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
33
nix/packages/post-provisioning/default.nix
Normal file
33
nix/packages/post-provisioning/default.nix
Normal file
|
|
@ -0,0 +1,33 @@
|
||||||
|
{
|
||||||
|
inputs,
|
||||||
|
pkgs,
|
||||||
|
}:
|
||||||
|
pkgs.writeShellApplication {
|
||||||
|
name = "pre-provisioning";
|
||||||
|
runtimeInputs = [
|
||||||
|
pkgs.nix
|
||||||
|
pkgs.khscodes.bw-opentofu
|
||||||
|
pkgs.khscodes.instance-opentofu
|
||||||
|
pkgs.khscodes.openbao-helper
|
||||||
|
pkgs.jq
|
||||||
|
];
|
||||||
|
# TODO: Use secret source and required secrets to set up the correct env variables
|
||||||
|
text = ''
|
||||||
|
hostname="$1"
|
||||||
|
cmd="''${2:-apply}"
|
||||||
|
baseAttr='${inputs.self}#nixosConfigurations."'"$hostname"'".config.khscodes.infrastructure.provisioning'
|
||||||
|
config="$(nix build --no-link --print-out-paths "''${baseAttr}.postConfig")"
|
||||||
|
secretsSource="$(nix eval --raw "''${baseAttr}.post.secretsSource")"
|
||||||
|
endpoints="$(nix eval --show-trace --json "''${baseAttr}.postEndpoints")"
|
||||||
|
if [[ "$config" == "null" ]]; then
|
||||||
|
echo "No preprovisioning needed"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
if [[ "$secretsSource" == "vault" ]]; then
|
||||||
|
readarray -t endpoints_args < <(echo "$endpoints" | jq -cr 'map(["-e", .])[][]')
|
||||||
|
openbao-helper wrap-program "''${endpoints_args[@]}" -- instance-opentofu "$hostname" "$config" "$cmd"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
bw-opentofu "$hostname" "$config" "$cmd"
|
||||||
|
'';
|
||||||
|
}
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
{ pkgs, ... }:
|
|
||||||
{
|
|
||||||
imports = [ ./khs-base.nix ];
|
|
||||||
home.packages = [
|
|
||||||
pkgs.bitwarden-cli
|
|
||||||
pkgs.nerd-fonts.inconsolata
|
|
||||||
pkgs.google-chrome
|
|
||||||
];
|
|
||||||
khscodes = {
|
|
||||||
desktop.enable = true;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,8 +1,7 @@
|
||||||
{ ... }:
|
{ ... }:
|
||||||
{
|
{
|
||||||
imports = [ ./nix-base.nix ];
|
imports = [ ./khs-server.nix ];
|
||||||
config.khscodes = {
|
config.khscodes = {
|
||||||
hetzner.enable = true;
|
hetzner.enable = true;
|
||||||
services.openssh.enable = true;
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{ pkgs, ... }:
|
{ pkgs, config, ... }:
|
||||||
{
|
{
|
||||||
imports = [ ./nix-base.nix ];
|
imports = [ ./nix-base.nix ];
|
||||||
snowfallorg.users.khs.admin = true;
|
snowfallorg.users.khs.admin = true;
|
||||||
|
|
@ -12,7 +12,7 @@
|
||||||
environment = {
|
environment = {
|
||||||
systemPackages = [ pkgs.openbao ];
|
systemPackages = [ pkgs.openbao ];
|
||||||
variables = {
|
variables = {
|
||||||
BAO_ADDR = "https://vault.kaareskovgaard.net";
|
BAO_ADDR = "https://${config.khscodes.infrastructure.openbao.domain}";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -7,6 +7,7 @@
|
||||||
{
|
{
|
||||||
imports = [ ./khs-base.nix ];
|
imports = [ ./khs-base.nix ];
|
||||||
khscodes.virtualisation.qemu-guest.enableWhenVmTarget = true;
|
khscodes.virtualisation.qemu-guest.enableWhenVmTarget = true;
|
||||||
|
khscodes.machine.type = "desktop";
|
||||||
|
|
||||||
services.desktopManager.cosmic.enable = true;
|
services.desktopManager.cosmic.enable = true;
|
||||||
services.displayManager.cosmic-greeter.enable = true;
|
services.displayManager.cosmic-greeter.enable = true;
|
||||||
|
|
|
||||||
|
|
@ -1,11 +1,21 @@
|
||||||
{ lib, ... }:
|
{ lib, pkgs, ... }:
|
||||||
{
|
{
|
||||||
imports = [ ./nix-base.nix ];
|
imports = [ ./nix-base.nix ];
|
||||||
config.khscodes = {
|
config = {
|
||||||
services.openssh.enable = true;
|
khscodes = {
|
||||||
infrastructure = {
|
services.openssh.enable = true;
|
||||||
vault-server-approle.enable = lib.mkDefault true;
|
machine.type = "server";
|
||||||
vault-loki-sender = lib.mkDefault true;
|
os.auto-update.enable = true;
|
||||||
|
infrastructure = {
|
||||||
|
vault-server-approle.enable = lib.mkDefault true;
|
||||||
|
vault-loki-sender.enable = lib.mkDefault true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
stylix = {
|
||||||
|
enable = true;
|
||||||
|
autoEnable = false;
|
||||||
|
base16Scheme = lib.mkDefault "${pkgs.base16-schemes}/share/themes/solarized-dark.yaml";
|
||||||
|
targets.console.enable = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
# After creating the instance
|
||||||
|
|
||||||
|
Open https://vault.kaareskovgaard.net and initialize OpenBAO. Remember to get some sort of auto unsealing set up afterwards, currently this is implemented with a cronjob on TrueNAS. Doing it this way allows various certificates to continue getting issued, even as OpenBAO gets sealed (due to auto updates).
|
||||||
|
|
||||||
|
After this, run the post provisioning script to initialize the various OpenBAO parts needed. Then `nix run '.#bitwarden-to-vault` can transfer the needed Bitwarden secrets to vault.
|
||||||
|
|
@ -0,0 +1,61 @@
|
||||||
|
# { config, ... }:
|
||||||
|
# let
|
||||||
|
# secretsFile = "/var/lib/authentik/authentik-env";
|
||||||
|
# domain = "auth-test.kaareskovgaard.net";
|
||||||
|
# in
|
||||||
|
# {
|
||||||
|
# config = {
|
||||||
|
# khscodes.nix.nix-community.enable = true;
|
||||||
|
# services.authentik = {
|
||||||
|
# enable = true;
|
||||||
|
# environmentFile = secretsFile;
|
||||||
|
# settings = {
|
||||||
|
# email = {
|
||||||
|
# host = "smtp.soverin.net";
|
||||||
|
# port = 587;
|
||||||
|
# username = "kaare@kaareskovgaard.net";
|
||||||
|
# use_tls = true;
|
||||||
|
# use_ssl = false;
|
||||||
|
# from = "kaare@kaareskovgaard.net";
|
||||||
|
# };
|
||||||
|
# disable_startup_analytics = true;
|
||||||
|
# avatars = "initials";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# khscodes.services.nginx.virtualHosts.${domain} = {
|
||||||
|
# locations."/" = {
|
||||||
|
# proxyPass = "https://localhost:9443";
|
||||||
|
# recommendedProxySettings = true;
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# services.postgresqlBackup = {
|
||||||
|
# enable = true;
|
||||||
|
# databases = [ "authentik" ];
|
||||||
|
# };
|
||||||
|
|
||||||
|
# systemd.services = {
|
||||||
|
# authentik-migrate = {
|
||||||
|
# unitConfig = {
|
||||||
|
# ConditionPathExists = secretsFile;
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# authentik-worker = {
|
||||||
|
# unitConfig = {
|
||||||
|
# ConditionPathExists = secretsFile;
|
||||||
|
# };
|
||||||
|
# serviceConfig = {
|
||||||
|
# LoadCredential = [
|
||||||
|
# "${domain}.pem:${config.security.acme.certs.${domain}.directory}/fullchain.pem"
|
||||||
|
# "${domain}.key:${config.security.acme.certs.${domain}.directory}/key.pem"
|
||||||
|
# ];
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# authentik = {
|
||||||
|
# unitConfig = {
|
||||||
|
# ConditionPathExists = secretsFile;
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# }
|
||||||
|
{ }
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
{
|
||||||
|
inputs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
"${inputs.self}/nix/profiles/nixos/hetzner-server.nix"
|
||||||
|
./authentik.nix
|
||||||
|
./openbao.nix
|
||||||
|
./post/openbao
|
||||||
|
];
|
||||||
|
khscodes.services.nginx.enable = true;
|
||||||
|
khscodes.infrastructure.hetzner-instance = {
|
||||||
|
enable = true;
|
||||||
|
server_type = "cax11";
|
||||||
|
};
|
||||||
|
virtualisation.vmVariant.virtualisation.host.pkgs = import inputs.nixpkgs {
|
||||||
|
system = "aarch64-darwin";
|
||||||
|
};
|
||||||
|
# Cannot use vault for secrets source, as this is the server containing vault.
|
||||||
|
khscodes.infrastructure.provisioning.pre.secretsSource = "bitwarden";
|
||||||
|
khscodes.infrastructure.provisioning.post.secretsSource = "bitwarden";
|
||||||
|
khscodes.infrastructure.vault-server-approle.stage = "post";
|
||||||
|
khscodes.networking.fqdn = "security.kaareskovgaard.net";
|
||||||
|
users.users.khs = {
|
||||||
|
initialPassword = "changeme";
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqY0FHnWFKfLG2yfgr4qka5sR9CK+EMAhzlHUkaQyWHTKD+G0/vC/fNPyL1VV3Dxc/ajxGuPzVE+mBMoyxazL3EtuCDOVvHJ5CR+MUSEckg/DDwcGHqy6rC8BvVVpTAVL04ByQdwFnpE1qNSBaQLkxaFVdtriGKkgMkc7+UNeYX/bv7yn+APqfP1a3xr6wdkSSdO8x4N2jsSygOIMx10hLyCV4Ueu7Kp8Ww4rGY8j5o7lKJhbgfItBfSOuQHdppHVF/GKYRhdnK6Y2fZVYbhq4KipUtclbZ6O/VYd8/sOO98+LMm7cOX+K35PQjUpYgcoNy5+Sw3CNS/NHn4JvOtTaUEYP7fK6c9LhMULOO3T7Cm6TMdiFjUKHkyG+s2Mu/LXJJoilw571zwuh6chkeitW8+Ht7k0aPV96kNEvTdoXwLhBifVEaChlAsLAzSUjUq+YYCiXVk0VIXCZQWKj8LoVNTmaqDksWwbcT64fw/FpVC0N18WHbKcFUEIW/O4spJMa30CQwf9FeqpoWoaF1oRClCSDPvX0AauCu0JcmRinz1/JmlXljnXWbSfm20/V+WyvktlI0wTD0cdpNuSasT9vS77YfJ8nutcWWZKSkCj4R4uHeCNpDTX5YXzapy7FxpM9ANCXLIvoGX7Yafba2Po+er7SSsUIY1AsnBBr8ZoDVw=="
|
||||||
|
];
|
||||||
|
};
|
||||||
|
khscodes.infrastructure.openbao.domain = "vault-test.kaareskovgaard.net";
|
||||||
|
system.stateVersion = "25.05";
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,51 @@
|
||||||
|
{ pkgs, config, ... }:
|
||||||
|
let
|
||||||
|
domain = "vault-test.kaareskovgaard.net";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
config = {
|
||||||
|
services.openbao = {
|
||||||
|
enable = true;
|
||||||
|
package = pkgs.openbao;
|
||||||
|
settings = {
|
||||||
|
ui = true;
|
||||||
|
listener.tcp = {
|
||||||
|
type = "tcp";
|
||||||
|
tls_cert_file = "${config.security.acme.certs.${domain}.directory}/fullchain.pem";
|
||||||
|
tls_key_file = "${config.security.acme.certs.${domain}.directory}/key.pem";
|
||||||
|
};
|
||||||
|
api_addr = "https://${domain}";
|
||||||
|
storage.postgresql.connection_url = "postgres://openbao?host=/run/postgresql";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
security.acme.certs.${domain}.reloadServices = [ "openbao.service" ];
|
||||||
|
|
||||||
|
systemd.services.openbao.after = [ "postgresql.service" ];
|
||||||
|
|
||||||
|
# Allow openbao to read the certificate file
|
||||||
|
users.groups.nginx.members = [ "openbao" ];
|
||||||
|
|
||||||
|
services.postgresql = {
|
||||||
|
enable = true;
|
||||||
|
ensureDatabases = [ "openbao" ];
|
||||||
|
ensureUsers = [
|
||||||
|
{
|
||||||
|
name = "openbao";
|
||||||
|
ensureDBOwnership = true;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.postgresqlBackup = {
|
||||||
|
enable = true;
|
||||||
|
databases = [ "openbao" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
khscodes.services.nginx.virtualHosts.${domain} = {
|
||||||
|
locations."/" = {
|
||||||
|
proxyPass = "https://${config.services.openbao.settings.listener.tcp.address}/";
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
{
|
||||||
|
khscodes.infrastructure.vault-server-approle.path = "\${ vault_auth_backend.approle.path }";
|
||||||
|
khscodes.infrastructure.provisioning.post.modules = [
|
||||||
|
{
|
||||||
|
resource.vault_auth_backend.approle = {
|
||||||
|
type = "approle";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,29 @@
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./approle.nix
|
||||||
|
./ssh-host.nix
|
||||||
|
./loki-mtls.nix
|
||||||
|
./prometheus-mtls.nix
|
||||||
|
];
|
||||||
|
khscodes.infrastructure.vault-server-approle.path = "\${ vault_auth_backend.approle.path }";
|
||||||
|
khscodes.infrastructure.provisioning.post.modules = [
|
||||||
|
(
|
||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
khscodes.vault.mount.opentofu = {
|
||||||
|
path = "opentofu";
|
||||||
|
type = "kv";
|
||||||
|
options = {
|
||||||
|
version = "2";
|
||||||
|
};
|
||||||
|
description = "Secrets used during provisioning";
|
||||||
|
};
|
||||||
|
resource.vault_kv_secret_backend_v2.opentofu = {
|
||||||
|
mount = config.khscodes.vault.output.mount.opentofu.path;
|
||||||
|
max_versions = 5;
|
||||||
|
cas_required = false;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
)
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
# This should go into the setup of the vault server itself, as the vault server also needs stuff that depends on this.
|
||||||
|
{
|
||||||
|
khscodes.infrastructure.vault-loki-sender = {
|
||||||
|
terranixBackendName = "\${ vault_mount.loki-mtls.path }";
|
||||||
|
};
|
||||||
|
khscodes.infrastructure.provisioning.post.modules = [
|
||||||
|
(
|
||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
khscodes.vault.enable = true;
|
||||||
|
khscodes.vault.mount.loki-mtls = {
|
||||||
|
type = "pki";
|
||||||
|
path = "loki-mtls";
|
||||||
|
max_lease_ttl_seconds = 10 * 365 * 24 * 60 * 60;
|
||||||
|
default_lease_ttl_seconds = 60 * 60;
|
||||||
|
};
|
||||||
|
khscodes.vault.pki_secret_backend_root_cert.loki-mtls = {
|
||||||
|
backend = config.khscodes.vault.output.mount.loki-mtls.path;
|
||||||
|
type = "internal";
|
||||||
|
common_name = "loki.kaareskovgaard.net";
|
||||||
|
issuer_name = "loki-mtls-root-ca";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
)
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,27 @@
|
||||||
|
# This should go into the setup of the vault server itself, as the vault server also needs stuff that depends on this.
|
||||||
|
{
|
||||||
|
khscodes.infrastructure.vault-prometheus-sender = {
|
||||||
|
# This is quite ugly, but should get the job done. Sadly I cannot reference the output from here.
|
||||||
|
terranixBackendName = "\${ vault_mount.prometheus-mtls.path }";
|
||||||
|
};
|
||||||
|
khscodes.infrastructure.provisioning.post.modules = [
|
||||||
|
(
|
||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
khscodes.vault.enable = true;
|
||||||
|
khscodes.vault.mount.prometheus-mtls = {
|
||||||
|
type = "pki";
|
||||||
|
path = "prometheus-mtls";
|
||||||
|
max_lease_ttl_seconds = 10 * 365 * 24 * 60 * 60;
|
||||||
|
default_lease_ttl_seconds = 60 * 60;
|
||||||
|
};
|
||||||
|
khscodes.vault.pki_secret_backend_root_cert.prometheus-mtls = {
|
||||||
|
backend = config.khscodes.vault.output.mount.prometheus-mtls.path;
|
||||||
|
type = "internal";
|
||||||
|
common_name = "prometheus.kaareskovgaard.net";
|
||||||
|
issuer_name = "prometheus-mtls-root-ca";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
)
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
{
|
||||||
|
khscodes.services.openssh.hostCertificate.path = "\${ vault_mount.ssh-host.path }";
|
||||||
|
khscodes.infrastructure.provisioning.post.modules = [
|
||||||
|
(
|
||||||
|
{ config, ... }:
|
||||||
|
{
|
||||||
|
khscodes.vault.mount.ssh-host = {
|
||||||
|
type = "ssh";
|
||||||
|
path = "ssh-host";
|
||||||
|
default_lease_ttl_seconds = 24 * 60 * 60;
|
||||||
|
max_lease_ttl_seconds = 24 * 60 * 60;
|
||||||
|
};
|
||||||
|
|
||||||
|
resource.vault_ssh_secret_backend_ca.ssh-host = {
|
||||||
|
backend = config.khscodes.vault.output.mount.ssh-host.path;
|
||||||
|
generate_signing_key = true;
|
||||||
|
key_type = "ed25519";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
)
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
@ -10,5 +10,11 @@
|
||||||
device = "/dev/sda";
|
device = "/dev/sda";
|
||||||
diskName = "nixos";
|
diskName = "nixos";
|
||||||
};
|
};
|
||||||
|
users.users.khs = {
|
||||||
|
initialPassword = "changeme";
|
||||||
|
openssh.authorizedKeys.keys = [
|
||||||
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqY0FHnWFKfLG2yfgr4qka5sR9CK+EMAhzlHUkaQyWHTKD+G0/vC/fNPyL1VV3Dxc/ajxGuPzVE+mBMoyxazL3EtuCDOVvHJ5CR+MUSEckg/DDwcGHqy6rC8BvVVpTAVL04ByQdwFnpE1qNSBaQLkxaFVdtriGKkgMkc7+UNeYX/bv7yn+APqfP1a3xr6wdkSSdO8x4N2jsSygOIMx10hLyCV4Ueu7Kp8Ww4rGY8j5o7lKJhbgfItBfSOuQHdppHVF/GKYRhdnK6Y2fZVYbhq4KipUtclbZ6O/VYd8/sOO98+LMm7cOX+K35PQjUpYgcoNy5+Sw3CNS/NHn4JvOtTaUEYP7fK6c9LhMULOO3T7Cm6TMdiFjUKHkyG+s2Mu/LXJJoilw571zwuh6chkeitW8+Ht7k0aPV96kNEvTdoXwLhBifVEaChlAsLAzSUjUq+YYCiXVk0VIXCZQWKj8LoVNTmaqDksWwbcT64fw/FpVC0N18WHbKcFUEIW/O4spJMa30CQwf9FeqpoWoaF1oRClCSDPvX0AauCu0JcmRinz1/JmlXljnXWbSfm20/V+WyvktlI0wTD0cdpNuSasT9vS77YfJ8nutcWWZKSkCj4R4uHeCNpDTX5YXzapy7FxpM9ANCXLIvoGX7Yafba2Po+er7SSsUIY1AsnBBr8ZoDVw=="
|
||||||
|
];
|
||||||
|
};
|
||||||
system.stateVersion = "25.05";
|
system.stateVersion = "25.05";
|
||||||
}
|
}
|
||||||
|
|
|
||||||
1
result
Symbolic link
1
result
Symbolic link
|
|
@ -0,0 +1 @@
|
||||||
|
/nix/store/v800qb1c26k2hplgc35af8xnffkax9y5-env-20250714222538
|
||||||
Loading…
Add table
Add a link
Reference in a new issue