Drift/pvv-nixos-config
17
6
Fork 1
Code Issues Pull Requests 10 Actions Wiki Activity

Set up prometheus-phpfpm-exporter for various pools on bekkalokk #159

Merged
oysteikt merged 2 commits from prometheus-phpfpm-exporter into main 2026-07-27 13:58:47 +02:00
Conversation 1 Commits 2 Files Changed 4
+71
4 changed files with 71 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/bekkalokk/configuration.nix
+1
View File
@@ -13,6 +13,7 @@
./services/mediawiki
./services/nginx.nix
./services/phpfpm.nix
./services/prometheus-phpfpm-exporter.nix
./services/vaultwarden.nix
./services/webmail
./services/website
hosts/bekkalokk/services/prometheus-phpfpm-exporter.nix
+54
View File
@@ -0,0 +1,54 @@
{ config, lib, values, ... }:
let
cfg = config.services.prometheus.exporters.php-fpm;
pools = [
"idp"
"mediawiki"
"pvv-nettsiden"
"roundcube"
"snappymail"
];
in
{
services.phpfpm.pools = lib.genAttrs pools (_: {
settings."pm.status_path" = "/status";
});
services.prometheus.exporters.php-fpm = {
enable = true;
listenAddress = "127.0.0.1";
extraFlags = [
"--phpfpm.scrape-uri=${lib.concatMapStringsSep "," (name: "unix://${config.services.phpfpm.pools.${name}.socket};/status") pools}"
];
};
systemd.services.prometheus-php-fpm-exporter.serviceConfig = {
Slice = "system-monitoring.slice";
SupplementaryGroups = [ config.services.nginx.group ];
RestrictAddressFamilies = lib.mkForce [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
};
services.nginx = lib.mkIf cfg.enable {
virtualHosts."www.pvv.ntnu.no" = lib.mkIf config.services.nginx.enable {
felixalb commented 2026-07-27 13:00:00 +02:00
Review
Copy Link
Copy Source

non-blocking nit: This mkif is erratic behavior that could potentially make troubleshooting more difficult. I don't see any benefit from conditionally changing the configuration, as if nginx is disabled, this is not used for anything anyways.

non-blocking nit: This mkif is erratic behavior that could potentially make troubleshooting more difficult. I don't see any benefit from conditionally changing the configuration, as if nginx is disabled, this is not used for anything anyways.
oysteikt commented 2026-07-27 13:58:26 +02:00
Review
Copy Link
Copy Source

I'll open a new issue on making a treewide decision about these

I'll open a new issue on making a treewide decision about these
forceSSL = true;
enableACME = true;
kTLS = true;
locations."/prometheus-php-fpm-exporter/metrics" = {
proxyPass = "http://localhost:${toString cfg.port}/metrics";
extraConfig = ''
allow 127.0.0.1;
felixalb commented 2026-07-27 13:01:25 +02:00
Review
Copy Link
Copy Source

non-blocking nit: we might want to go over the repo and replace most of these with 127.0.0.0/8, but this is probably absolutely fine

non-blocking nit: we might want to go over the repo and replace most of these with 127.0.0.0/8, but this is probably absolutely fine
oysteikt commented 2026-07-27 13:58:43 +02:00
Review
Copy Link
Copy Source

Let's solve these in anothet treewide

Let's solve these in anothet treewide
allow ::1;
allow ${values.hosts.ildkule.ipv4};
allow ${values.hosts.ildkule.ipv6};
deny all;
'';
};
};
};
}
hosts/ildkule/services/monitoring/prometheus/default.nix
+1
View File
@@ -7,6 +7,7 @@ in {
./machines.nix
./matrix-synapse.nix
./mysqld.nix
./phpfpm.nix
./postgres.nix
];
hosts/ildkule/services/monitoring/prometheus/phpfpm.nix
+15
View File
@@ -0,0 +1,15 @@
{ ... }:
{
services.prometheus.scrapeConfigs = [{
job_name = "phpfpm";
scheme = "https";
metrics_path = "/prometheus-php-fpm-exporter/metrics";
static_configs = [
{
labels.hostname = "bekkalokk";
targets = [ "www.pvv.ntnu.no:443" ];
}
];
}];
}