prometheus for dibbler

base/default.nix

@@ -14,6 +14,7 @@
 
     ./mitigations.nix
 
+    ./flake-input-exporter.nix
     ./hardening.nix
     ./networking.nix
     ./nix.nix
@@ -33,11 +34,9 @@
     ./services/openssh.nix
     ./services/polkit.nix
     ./services/postfix.nix
-    ./services/prometheus-flake-input-exporter.nix
     ./services/prometheus-node-exporter.nix
     ./services/prometheus-systemd-exporter.nix
     ./services/roowho2.nix
-    ./services/rsyslogd.nix
     ./services/scrutiny-collector.nix
     ./services/smartd.nix
     ./services/thermald.nix

base/flake-input-exporter.nix

@@ -0,0 +1,55 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  values,
+  ...
+}:
+let
+  data = lib.flip lib.mapAttrs inputs (
+    name: input: {
+      inherit (input)
+        lastModified
+        ;
+    }
+  );
+  folder = pkgs.writeTextDir "share/flake-inputs" (
+    lib.concatMapStringsSep "\n" (
+      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
+    ) (lib.attrsToList data)
+  );
+  port = 9102;
+in
+{
+  services.nginx.virtualHosts."${config.networking.fqdn}-nixos-metrics" = {
+    serverName = config.networking.fqdn;
+    serverAliases = [
+      "${config.networking.hostName}.pvv.org"
+    ];
+    locations."/metrics" = {
+      root = "${folder}/share";
+      tryFiles = "/flake-inputs =404";
+      extraConfig = ''
+        default_type text/plain;
+      '';
+    };
+    listen = [
+      {
+        inherit port;
+        addr = "0.0.0.0";
+      }
+    ];
+    extraConfig = ''
+      allow ${values.hosts.ildkule.ipv4}/32;
+      allow ${values.hosts.ildkule.ipv6}/128;
+      allow 127.0.0.1/32;
+      allow ::1/128;
+      allow ${values.ipv4-space};
+      allow ${values.ipv6-space};
+      deny all;
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+}

base/services/nginx.nix

@@ -1,5 +1,18 @@
 { config, lib, ... }:
 {
+  # nginx return 444 for all nonexistent virtualhosts
+
+  systemd.services.nginx.after = [ "generate-snakeoil-certs.service" ];
+
+  environment.snakeoil-certs = lib.mkIf config.services.nginx.enable {
+    "/etc/certs/nginx" = {
+      owner = "nginx";
+      group = "nginx";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
+
   services.nginx = {
     recommendedTlsSettings = true;
     recommendedProxySettings = true;
@@ -47,8 +60,17 @@
           ];
         }
       ];
+      sslCertificate = "/etc/certs/nginx.crt";
+      sslCertificateKey = "/etc/certs/nginx.key";
+      addSSL = true;
+      extraConfig = "return 444;";
+    };
+
+    ${config.networking.fqdn} = {
+      sslCertificate = lib.mkDefault "/etc/certs/nginx.crt";
+      sslCertificateKey = lib.mkDefault "/etc/certs/nginx.key";
+      addSSL = lib.mkDefault true;
+      extraConfig = lib.mkDefault "return 444;";
     };
   };
-
-  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
 }

base/services/prometheus-flake-input-exporter.nix

@@ -1,47 +0,0 @@
-{
-  config,
-  inputs,
-  lib,
-  pkgs,
-  values,
-  ...
-}:
-let
-  data = lib.flip lib.mapAttrs inputs (
-    name: input: {
-      inherit (input)
-        lastModified
-        ;
-    }
-  );
-  folder = pkgs.writeTextDir "share/flake-inputs" (
-    lib.concatMapStringsSep "\n" (
-      { name, value }: ''nixos_last_modified_input{flake="${name}"} ${toString value.lastModified}''
-    ) (lib.attrsToList data)
-  );
-in
-{
-  services.nginx = {
-    enable = lib.mkDefault true;
-
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
-      forceSSL = true;
-      enableACME = true;
-      kTLS = true;
-
-      locations."/prometheus-nixos-flake-input-exporter/metrics" = {
-        root = "${folder}/share";
-        tryFiles = "/flake-inputs =404";
-        extraConfig = ''
-          default_type text/plain;
-
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
-  };
-}

base/services/prometheus-node-exporter.nix

@@ -5,30 +5,19 @@ in
 {
   services.prometheus.exporters.node = {
     enable = lib.mkDefault true;
-    listenAddress = "127.0.0.1";
     port = 9100;
     enabledCollectors = [ "systemd" ];
   };
 
-  services.nginx = {
+  systemd.services.prometheus-node-exporter.serviceConfig = lib.mkIf cfg.enable {
-    enable = lib.mkDefault true;
+    IPAddressDeny = "any";
-
+    IPAddressAllow = [
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      "127.0.0.1"
-      forceSSL = true;
+      "::1"
-      enableACME = true;
+      values.hosts.ildkule.ipv4
-      kTLS = true;
+      values.hosts.ildkule.ipv6
-
+    ];
-      locations."/prometheus-node-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
   };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
 }

base/services/prometheus-systemd-exporter.nix

@@ -5,7 +5,6 @@ in
 {
   services.prometheus.exporters.systemd = {
     enable = lib.mkDefault true;
-    listenAddress = "127.0.0.1";
     port = 9101;
     extraFlags = [
       "--systemd.collector.enable-restart-count"
@@ -13,25 +12,15 @@ in
     ];
   };
 
-  services.nginx = {
+  systemd.services.prometheus-systemd-exporter.serviceConfig = {
-    enable = lib.mkDefault true;
+    IPAddressDeny = "any";
-
+    IPAddressAllow = [
-    virtualHosts.${config.networking.fqdn} = lib.mkIf config.services.nginx.enable {
+      "127.0.0.1"
-      forceSSL = true;
+      "::1"
-      enableACME = true;
+      values.hosts.ildkule.ipv4
-      kTLS = true;
+      values.hosts.ildkule.ipv6
-
+    ];
-      locations."/prometheus-systemd-exporter/metrics" = {
-        proxyPass = "http://localhost:${toString cfg.port}/metrics";
-
-        extraConfig = ''
-          allow 127.0.0.1;
-          allow ::1;
-          allow ${values.hosts.ildkule.ipv4};
-          allow ${values.hosts.ildkule.ipv6};
-          deny all;
-        '';
-      };
-    };
   };
+
+  networking.firewall.allowedTCPPorts = lib.mkIf cfg.enable [ cfg.port ];
 }

base/services/rsyslogd.nix

@@ -1,13 +0,0 @@
-{ ... }:
-{
-  services.rsyslogd = {
-    enable = true;
-    defaultConfig = ''
-      *.* @loghost.pvv.ntnu.no
-    '';
-  };
-
-  services.journald.extraConfig = ''
-    ForwardToSyslog=yes
-  '';
-}

hosts/ildkule/services/monitoring/prometheus/default.nix

@@ -8,6 +8,7 @@ in {
     ./matrix-synapse.nix
     ./mysqld.nix
     ./postgres.nix
+    ./dibbler.nix
   ];
 
   services.prometheus = {

hosts/ildkule/services/monitoring/prometheus/dibbler.nix

@@ -0,0 +1,96 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.prometheus.exporters.sql;
+  configFile =
+    if cfg.configFile != null then
+      cfg.configFile
+    else
+      let
+        nameInline = lib.mapAttrsToList (k: v: v // { name = k; });
+        renameStartupSql = j: removeAttrs (j // { startup_sql = j.startupSql; }) [ "startupSql" ];
+        configuration = {
+          jobs = map renameStartupSql (
+            nameInline (lib.mapAttrs (k: v: (v // { queries = nameInline v.queries; })) cfg.configuration.jobs)
+          );
+        };
+      in
+      builtins.toFile "config.yaml" (builtins.toJSON configuration);
+in
+{
+  sops.secrets."config/postgresql_dibbler_password" = { };
+
+  services.prometheus.scrapeConfigs = [
+    {
+      job_name = "sql_exporter";
+      scrape_interval = "1m";
+      scheme = "http";
+
+      static_configs = [
+        {
+          targets = [ "localhost:9237" ];
+        }
+      ];
+    }
+  ];
+
+  services.prometheus.exporters.sql = {
+    enable = true;
+    configuration = {
+      jobs.dibbler = {
+        interval = "1m";
+
+        queries."daily_purchase_sum" = {
+          help = "Sum of purchases for the current day.";
+          labels = [ "thing" ];
+          values = [ "sum" ];
+          query = "SELECT SUM(price) FROM purchases GROUP BY DATE(time) ORDER BY DATE(time) DESC LIMIT 1";
+        };
+
+        queries."total_purchase_sum" = {
+          help = "Sum of all purchases.";
+          labels = [ "thing" ];
+          values = [ "sum" ];
+          query = "SELECT SUM(price) FROM purchases";
+        };
+
+        queries."total_stock_value" = {
+          help = "The value of all stock in dibbler.";
+          labels = [ "thing" ];
+          values = [ "sum" ];
+          query = "SELECT SUM(price * stock) FROM products";
+        };
+
+        queries."user_credit_sum" = {
+          help = "The sum of all user credit.";
+          labels = [ "thing" ];
+          values = [ "sum" ];
+          query = "SELECT SUM(credit) FROM users";
+        };
+      };
+    };
+  };
+
+  systemd.services."prometheus-sql-exporter".serviceConfig = {
+    RuntimeDirectory = "prometheus-sql-exporter";
+    LoadCredential = "postgresql_dibbler_password:${
+      config.sops.secrets."config/postgresql_dibbler_password".path
+    }";
+    ExecStartPre = ''
+      |${lib.getExe pkgs.jq} \
+      --null-input \
+      --compact-output \
+      --slurpfile config '${configFile}' \
+      --rawfile pw '%d/postgresql_dibbler_password' \
+      --from-file '${pkgs.writeText "prometheus-sql-exec-start-jq-filter" ''
+        ("postgres://pvv_vv:\($pw | gsub("\n"; ""))@postgres.pvv.ntnu.no") as $pg_uri
+        | $config[0]
+        | .jobs[0].connections[0] = $pg_uri
+      ''}' > /run/prometheus-sql-exporter/config.yaml
+    '';
+  };
+}

hosts/ildkule/services/monitoring/prometheus/machines.nix

@@ -6,63 +6,32 @@
     targets = map (port: "${name}.pvv.ntnu.no:${toString port}") ports;
   };
 
-  nixosMachines = [
-    "ildkule"
-    "bekkalokk"
-    "bicep"
-    "brzeczyszczykiewicz"
-    "georg"
-    "gluttony"
-    "kommode"
-    "lupine-1"
-    "lupine-2"
-    "lupine-3"
-    "lupine-4"
-    "lupine-5"
-    # TODO: export prometheus stats via apache on temmie
-    # "temmie"
-    "wenche"
-  ];
-
   defaultNodeExporterPort = 9100;
+  defaultSystemdExporterPort = 9101;
+  defaultNixosExporterPort = 9102;
 in {
-  services.prometheus.scrapeConfigs = [
+  services.prometheus.scrapeConfigs = [{
-    {
+    job_name = "base_info";
-      job_name = "nixos-node";
+    static_configs = [
-      scheme = "https";
+      (mkHostScrapeConfig "ildkule" [ cfg.exporters.node.port cfg.exporters.systemd.port defaultNixosExporterPort ])
-      metrics_path = "/prometheus-node-exporter/metrics";
+
-      static_configs = map (name: {
+      (mkHostScrapeConfig "bekkalokk" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        labels.hostname = name;
+      (mkHostScrapeConfig "bicep" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        targets = [ "${name}.pvv.ntnu.no:443" ];
+      (mkHostScrapeConfig "brzeczyszczykiewicz" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      }) nixosMachines;
+      (mkHostScrapeConfig "georg" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-    }
+      (mkHostScrapeConfig "gluttony" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-    {
+      (mkHostScrapeConfig "kommode" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      job_name = "nixos-systemd";
+      (mkHostScrapeConfig "lupine-1" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      scheme = "https";
+      (mkHostScrapeConfig "lupine-2" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      metrics_path = "/prometheus-systemd-exporter/metrics";
+      (mkHostScrapeConfig "lupine-3" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      static_configs = map (name: {
+      (mkHostScrapeConfig "lupine-4" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        labels.hostname = name;
+      (mkHostScrapeConfig "lupine-5" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-        targets = [ "${name}.pvv.ntnu.no:443" ];
+      (mkHostScrapeConfig "temmie" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-      }) nixosMachines;
+      (mkHostScrapeConfig "wenche" [ defaultNodeExporterPort defaultSystemdExporterPort defaultNixosExporterPort ])
-    }
+
-    {
+      (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
-      job_name = "nixos-flake-input";
+      (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
-      scheme = "https";
+      (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
-      metrics_path = "/prometheus-nixos-flake-input-exporter/metrics";
+    ];
-      static_configs = map (name: {
+  }];
-        labels.hostname = name;
-        targets = [ "${name}.pvv.ntnu.no:443" ];
-      }) nixosMachines;
-    }
-    {
-      job_name = "non-nixos-node";
-      scheme = "http";
-      metrics_path = "/metrics";
-      static_configs = [
-        (mkHostScrapeConfig "hildring" [ defaultNodeExporterPort ])
-        (mkHostScrapeConfig "isvegg" [ defaultNodeExporterPort ])
-        (mkHostScrapeConfig "microbel" [ defaultNodeExporterPort ])
-      ];
-    }
-  ];
 }

hosts/temmie/services/userweb/default.nix

@@ -212,19 +212,6 @@ in
     extraConfig = ''
       TraceEnable on
       LogLevel warn rewrite:trace3
-
-      <FilesMatch ".+\.ph(p[3457]?|t|tml)$">
-          SetHandler application/x-httpd-php
-      </FilesMatch>
-      <FilesMatch ".+\.phps$">
-          SetHandler application/x-httpd-php-source
-          Require all denied
-      </FilesMatch>
-      <FilesMatch "\.pl$">
-          SetHandler modperl
-          PerlResponseHandler ModPerl::Registry
-          Options +ExecCGI
-      </FilesMatch>
     '';
 
     virtualHosts."temmie.pvv.ntnu.no" = {
@@ -345,6 +332,7 @@ in
         ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:54:Apache httpd user:/var/empty:/run/current-system/sw/bin/bash' /run/httpd/pamunix-out/passwd"
         ":${lib.getExe pkgs.gnused} -i '$ a\\\\root:x:0:' /run/httpd/pamunix-out/group"
         ":${lib.getExe pkgs.gnused} -i '$ a\\\\wwwrun:x:54:' /run/httpd/pamunix-out/group"
+        "${lib.getExe' pkgs.coreutils "cat"} /run/httpd/pamunix-out/passwd"
         "+${lib.getExe' pkgs.coreutils "chown"} root:root /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
         "+${lib.getExe' pkgs.coreutils "chmod"} 0644 /run/httpd/pamunix-out/passwd /run/httpd/pamunix-out/group"
         "+${lib.getExe pkgs.mount} --bind /run/httpd/pamunix-out/passwd /etc/passwd"
@@ -459,13 +447,7 @@ in
           "/share"
         ];
       });
-      BindPaths = lib.mapCartesianProduct ({ directoryFn, letter }: "/run/pvv-home-mounts/${letter}:${directoryFn letter}${letter}") {
+      BindPaths = map (l: "/run/pvv-home-mounts/${l}:/home/pvv/${l}") homeLetters;
-        directoryFn = [
-          (_: "/home/pvv/")
-          (l: "/amd/homepvv${l}/")
-        ];
-        letter = homeLetters;
-      };
     };
   };
 

secrets/ildkule/ildkule.yaml

@@ -1,5 +1,6 @@
 config:
     mysqld_exporter_password: ENC[AES256_GCM,data:I9K+QMqaN3FOOVKzeOR9Q6UERStXX0P8WEHyN1jzzbM=,iv:UxvIdlfAyJvNuxPkU4+guKPa0fiD0vVLzHOTYktcmso=,tag:ltnIqEwESYx9HBu8UN0ZLw==,type:str]
+    postgresql_dibbler_password: ENC[AES256_GCM,data:wP4CVz9qRE3CJrblWWYqOIkcH3LM5H81,iv:j8zr1TRNlPPqIppYlWhDoKlL7m2Ph2wQlU6bvFj8R9A=,tag:Cfp8zbYkoLqI7DTDpOBlJw==,type:str]
 keys:
     grafana:
         secret_key: ENC[AES256_GCM,data:+WoAJbDBEgKs0RoHT+7oEELAVQ+/2Xt+5RTMSXg23moCqVRx+Gzll9P5Drw=,iv:AkRn/Y20iEe5i1T+84wAgLCTFtAox2G3giyawAkltAw=,tag:BZbt5Wb5lYLIJBm/pfP4GQ==,type:str]
@@ -72,8 +73,8 @@ sops:
             dC9meDZlc3d3aUJEVjc4REF0Y1BLcGcK79LbJzc5KVgEgyJR11crGuX8YcVoJBbT
             Fin7Zoon06L7qx0Zw5u27wV7RKMnYT7hOMiWs6660ZTLcYJ5M1aEZQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-16T20:08:18Z"
+    lastmodified: "2026-06-07T12:51:04Z"
-    mac: ENC[AES256_GCM,data:C2tpWppc13jKJq5d4nmAKQOaNWHm27TKwxAxm1fi2lejN1lqUaoz5bHfTBA7MfaWvuP5uZnfbtG32eeu48mnlWpo58XRUFFecAhb9JUpW9s5IR3/nbzLNkGU7H5C0oWPrxI4thd+bAVduIgBjjFyGj1pe6J9db3c0yUWRwNlwGU=,iv:YpoQ4psiFYOWLGipxv1QvRvr034XFsyn2Bhyy39HmOo=,tag:ByiCWygFC/VokVTbdLoLgg==,type:str]
+    mac: ENC[AES256_GCM,data:otGwzc3Bme1PGRU4zWRRf3kmAf5EDjT8sPkDK/zDrO0ve+d3x99Qls4DBZV8G6FsFtUXbeKVo70I5VpqUgaIef+nyMl6zzWkW1wpbKIBYjh5fkaP0xxhLnw+shrB088PAXT0wkP7hJBLO0ZJgTrpprJKhmeqVj2HEXBSJ1wSjk8=,iv:cjqtdbWBVLUfpQdykb3vKDKa/VC/kGBybwYtG/eStqc=,tag:remOj4bX/H/LlAPgcXHAdA==,type:str]
     pgp:
         - created_at: "2026-05-20T17:35:58Z"
           enc: |-
@@ -96,4 +97,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.12.2

users/vegardbm.nix

@@ -1,4 +1,4 @@
-{ pkgs, config, ... }:
+{ pkgs, ... }:
 {
   users.users.vegardbm = {
     isNormalUser = true;
@@ -8,14 +8,12 @@
       "drift"
       "nix-builder-users"
     ];
-    shell = if config.programs.zsh.enable then pkgs.zsh else pkgs.bash;
     packages = with pkgs; [
       btop
       eza
     ];
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDVA3HqEx3je6L1AC+bP8sTxu3ZTKvTCR0npCyOVAYK5 vbm@arch-xeon"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrYATHNvBNAHr9G+VwZIaAQPe02iRgAjqtZkW4x/dje vbm@talos"
     ];
   };
 }