ildkule/grafana: add dashboard for php-fpm

base/default.nix

@@ -22,7 +22,6 @@
     ./vm.nix
 
     ./services/acme.nix
-    ./services/auditd.nix
     ./services/auto-upgrade.nix
     ./services/dbus.nix
     ./services/fluentbit.nix

base/services/auditd.nix

@@ -1,56 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  security.audit = {
-    enable = lib.mkDefault true;
-
-    # NOTE: see auditctl(8) for the meaning of the different rule flags.
-    rules = [
-      # Kernel module loading/unloading
-      "-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k kernel-modules"
-
-      # Mount/unmount by real (non-service) users
-      "-a always,exit -F arch=b64 -S mount,umount2 -F auid>=1000 -F auid!=-1 -k mounts"
-
-      # DAC permission/ownership changes by real users
-      "-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -k perm-mod"
-      "-a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=-1 -k perm-mod"
-      "-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -k perm-mod"
-
-      # Failed access attempts (permission denied) by real users
-      "-a always,exit -F arch=b64 -S open,openat,creat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k access"
-      "-a always,exit -F arch=b64 -S open,openat,creat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k access"
-
-      # File deletion/rename by real users
-      "-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=-1 -k delete"
-
-      # Execution of privileged commands
-      "-w ${config.security.wrapperDir}/sudo -p x -k privileged-sudo"
-      "-w ${config.security.wrapperDir}/su -p x -k privileged-su"
-
-      # Read of files containing secrets.
-      "-w /var/lib/sops-nix/key.txt -p r -k secrets"
-      "-w /run/secrets -p r -k secrets"
-      "-w /etc/ssh/ssh_host_ed25519_key -p r -k secrets"
-      "-w /etc/ssh/ssh_host_rsa_key -p r -k secrets"
-
-      # NixOS generation switching
-      "-w /nix/var/nix/profiles -p wa -k nixos-generation-switch"
-
-      # Switching bootloader content
-      "-w /boot -p wa -k boot-tampering"
-
-      # Login records
-      "-w /var/lib/lastlog2 -p wa -k logins"
-
-      # Write or append to the audit trail
-      "-w /var/log/audit -p wa -k audit-log-tampering"
-      "-w ${lib.getExe' pkgs.audit "auditctl"} -p x -k audit-tools"
-    ];
-  };
-
-  security.auditd = {
-    enable = lib.mkDefault true;
-    plugins.syslog.active = true;
-    plugins.af_unix.active = true;
-  };
-}

flake.lock

@@ -379,11 +379,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782759909,
-        "narHash": "sha256-gktjBeZyoRvVBkm2cO1tD99fdQ34iUDyB6iecRdorm4=",
+        "lastModified": 1784979981,
+        "narHash": "sha256-OnvjEXYU/InjJYH2+iIrvHWIjHnc5J9f84qWhrgAWlY=",
         "ref": "main",
-        "rev": "ad6c79fb713884a4a2df8aab30914cd0c1c2e6cb",
-        "revCount": 587,
+        "rev": "ffb8ed0c9df2444727e49f16f7e43ea70184dc4b",
+        "revCount": 590,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/nettsiden.git"
       },

hosts/bekkalokk/configuration.nix

@@ -13,6 +13,7 @@
     ./services/mediawiki
     ./services/nginx.nix
     ./services/phpfpm.nix
+    ./services/prometheus-phpfpm-exporter.nix
     ./services/vaultwarden.nix
     ./services/webmail
     ./services/website

hosts/bekkalokk/services/prometheus-phpfpm-exporter.nix

@@ -0,0 +1,49 @@
+{ config, lib, values, ... }:
+let
+  cfg = config.services.prometheus.exporters.php-fpm;
+  pools = [
+    "idp"
+    "mediawiki"
+    "pvv-nettsiden"
+    "roundcube"
+    "snappymail"
+  ];
+in
+{
+  services.phpfpm.pools = lib.genAttrs pools (_: {
+    settings."pm.status_path" = "/status";
+  });
+
+  services.prometheus.exporters.php-fpm = {
+    enable = true;
+    listenAddress = "127.0.0.1";
+    extraFlags = map
+      (name: "--phpfpm.scrape-uri=unix://${config.services.phpfpm.pools.${name}.socket};/status")
+      pools;
+  };
+
+  systemd.services.prometheus-php-fpm-exporter.serviceConfig = {
+    Slice = "system-monitoring.slice";
+    SupplementaryGroups = [ config.services.nginx.group ];
+  };
+
+  services.nginx = lib.mkIf cfg.enable {
+    virtualHosts."www.pvv.ntnu.no" = lib.mkIf config.services.nginx.enable {
+      forceSSL = true;
+      enableACME = true;
+      kTLS = true;
+
+      locations."/prometheus-php-fpm-exporter/metrics" = {
+        proxyPass = "http://localhost:${toString cfg.port}/metrics";
+
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.hosts.ildkule.ipv4};
+          allow ${values.hosts.ildkule.ipv6};
+          deny all;
+        '';
+      };
+    };
+  };
+}

hosts/bicep/services/postgresql/default.nix

@@ -150,7 +150,6 @@ in
   };
 
   networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ 5432 ];
-  networking.firewall.allowedUDPPorts = lib.mkIf cfg.enable [ 5432 ];
 
   environment.systemPackages = [
     (pkgs.writeShellApplication {

hosts/ildkule/services/monitoring/grafana.nix

@@ -68,6 +68,12 @@ in {
           url = "https://grafana.com/api/dashboards/9628/revisions/8/download";
           options.path = dashboards/postgres.json;
         }
+        {
+          name = "PHP-FPM";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/25149/revisions/1/download";
+          options.path = dashboards/php-fpm.json;
+        }
         {
           name = "Gitea Dashboard";
           type = "file";

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -7,6 +7,7 @@ in {
     ./machines.nix
     ./matrix-synapse.nix
     ./mysqld.nix
+    ./phpfpm.nix
     ./postgres.nix
   ];
 

hosts/ildkule/services/monitoring/prometheus/phpfpm.nix

@@ -0,0 +1,15 @@
+{ ... }:
+{
+  services.prometheus.scrapeConfigs = [{
+    job_name = "phpfpm";
+    scheme = "https";
+    metrics_path = "/prometheus-php-fpm-exporter/metrics";
+
+    static_configs = [
+      {
+        labels.hostname = "bekkalokk";
+        targets = [ "www.pvv.ntnu.no:443" ];
+      }
+    ];
+  }];
+}