Move metrics,gitea,vaultwarden from voyager to defiant

common/metrics-exporters.nix

@@ -25,7 +25,7 @@
       };
       clients = [
         {
-          url = "http://voyager.home.feal.no:3100/loki/api/v1/push";
+          url = "http://grafana.home.feal.no:3100/loki/api/v1/push";
         }
       ];
       scrape_configs = [

hosts/defiant/configuration.nix

@@ -13,6 +13,9 @@
       ./services/flame.nix
       ./services/hedgedoc.nix
       ./services/pihole.nix
+      ./services/gitea.nix
+      ./services/vaultwarden.nix
+      ./services/metrics
   ];
 
   networking = {
@@ -33,6 +36,13 @@
     zfs
   ];
 
+  boot = {
+    zfs.extraPools = [ "tank" ];
+    supportedFilesystems = [ "zfs" ];
+    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+  };
+  services.prometheus.exporters.zfs.enable = true;
+
   virtualisation.docker.enable = true;
   virtualisation.oci-containers.backend = "docker";
 

hosts/defiant/services/gitea.nix

@@ -3,23 +3,26 @@ let
   cfg = config.services.gitea;
   domain = "git.feal.no";
   httpPort = 3004;
-  #sshPort = 2222;
+  sshPort = 2222;
 in {
     services.gitea = {
       enable = true;
       appName = "felixalbs Gitea";
-      database = {
-        type = "postgres";
-      };
+      database.type = "postgres";
+      stateDir = "/tank/services/gitea";
 
       settings = {
         server = {
-          LANDING_PAGE=''"/felixalb"'';
-          HTTP_PORT = httpPort;
-          /* SSH_PORT = sshPort; */
-          SSH_DOMAIN = "voyager.home.feal.no";
+          # Serve on local unix socket, exposed in hosts/defiant/services/nginx.nix
+          PROTOCOL = "http+unix";
           DOMAIN = domain;
           ROOT_URL = "https://${domain}";
+          LANDING_PAGE=''"/felixalb"'';
+
+          SSH_PORT = sshPort;
+          SSH_LISTEN_PORT = sshPort;
+          START_SSH_SERVER = true;
+          BUILTIN_SSH_SERVER_USER = "git";
         };
 
         service.DISABLE_REGISTRATION = true;
@@ -47,12 +50,13 @@ in {
       };
 
       # TODO:
-      # - dump (automatic backups)
+      # - Backup
+      #   - services.gitea.dump?
+      #   - ZFS snapshots?
       # - configure mailer
     };
 
-    systemd.services.gitea.serviceConfig.WorkingDirectory = lib.mkForce "/var/lib/gitea/work";
+    systemd.services.gitea.serviceConfig.WorkingDirectory = lib.mkForce "${cfg.stateDir}/work";
 
-    networking.firewall.allowedTCPPorts = [ httpPort ];
-    /* networking.firewall.allowedTCPPorts = [ httpPort sshPort ]; */
+    networking.firewall.allowedTCPPorts = [ sshPort ];
 }

hosts/defiant/services/metrics/grafana.nix

@@ -5,6 +5,10 @@ let
 in {
   services.grafana = {
     enable = true;
+    dataDir = "/tank/services/metrics/grafana";
+
+    # TODO: Migrate sqlite to postgres
+
     settings.server = {
       domain = "grafana.home.feal.no";
       http_port = 2342;

hosts/defiant/services/metrics/loki.nix

@@ -1,10 +1,11 @@
 { config, pkgs, ... }:
 let
   cfg = config.services.loki;
-  saveDirectory = "/tank/var/lib/loki";
+  saveDirectory = "/tank/services/metrics/loki";
 in {
   services.loki = {
     enable = true;
+    dataDir = saveDirectory;
     configuration = {
       auth_enabled = false;
       server = {
@@ -70,6 +71,4 @@ in {
       };
     };
   };
-
-  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
 }

hosts/defiant/services/metrics/prometheus.nix

@@ -8,18 +8,22 @@ in {
     listenAddress = "127.0.0.1";
     port = 9001;
 
+    # StateDirectory must be under /var/lib.
+    # TODO: Back up to /tank/services/metrics/prometheus
+
     scrapeConfigs = [
       {
         job_name = "node";
         static_configs = [
           {
             targets = [
-              "voyager.home.feal.no:${toString cfg.exporters.node.port}"
+              "voyager.home.feal.no:9100"
               "sulu.home.feal.no:9100"
               "mccoy.home.feal.no:9100"
-              "borg.home.feal.no:9100"
-              "troi.home.feal.no:9100"
               "dlink-feal.home.feal.no:9100"
+              "edison.home.feal.no:9100"
+              "defiant.home.feal.no:9100"
+              "scotty.home.feal.no:9100"
             ];
           }
         ];
@@ -58,7 +62,10 @@ in {
       {
         job_name = "zfs";
         static_configs = [
-          { targets = ["127.0.0.1:${toString config.services.prometheus.exporters.zfs.port}"]; }
+          { targets = [
+            "voyager.home.feal.no:9134"
+            "defiant.home.feal.no:9134"
+          ]; }
         ];
       }
     ];

hosts/defiant/services/nginx.nix

@@ -43,6 +43,7 @@
     };
   in {
     "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/";
+    "git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}";
     "wiki.wackattack.eu" = publicProxy "http://pascal.wackattack.home.feal.no/";
   };
 }

hosts/defiant/services/pihole.nix

@@ -24,7 +24,12 @@ in {
   };
 
   services.nginx.virtualHosts."${domain}" = {
-    locations."/".proxyPass = "http://${webuiListen}";
+    locations."/" = {
+      proxyPass = "http://${webuiListen}";
+      extraConfig = ''
+        rewrite /(.*) /admin/$1 break;
+      '';
+    };
   };
 }
 

hosts/defiant/services/vaultwarden.nix

@@ -3,7 +3,7 @@ let
   cfg = config.services.vaultwarden;
   domain = "pw.feal.no";
   address = "127.0.0.1";
-  port = 3011; # Note! The websocket port is left as default
+  port = 3011; # Note: The websocket port is left as default(3012)
 in {
   sops.secrets."vaultwarden/admintoken" = {
     owner = "vaultwarden";
@@ -20,27 +20,30 @@ in {
       rocketAddress = address;
       rocketPort = port;
       websocketEnabled = true;
-      databaseUrl = "postgresql://vaultwarden@localhost/vaultwarden?sslmode=disable";
+      # databaseUrl = "postgresql://vaultwarden:@localhost/vaultwarden?sslmode=disable";
+      databaseUrl = "postgresql://vaultwarden@/vaultwarden";
 
       signupsAllowed = false;
-      rocketLog = "critical";
-
-    # This example assumes a mailserver running on localhost,
-    # thus without transport encryption.
-    # If you use an external mail server, follow:
-    #   https://github.com/dani-garcia/vaultwarden/wiki/SMTP-configuration
-      /* SMTP_HOST = "127.0.0.1"; */
-      /* SMTP_PORT = 25; */
-      /* SMTP_SSL = false; */
-
-      /* SMTP_FROM = "admin@bitwarden.example.com"; */
-      /* SMTP_FROM_NAME = "example.com Bitwarden server"; */
-
     };
   };
 
+  services.postgresql = {
+    ensureDatabases = [ "vaultwarden" ];
+    ensureUsers = [{
+      name = "vaultwarden";
+      ensureDBOwnership = true;
+    }];
+  };
 
   services.nginx.virtualHosts."${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+
+    listen = [
+      { addr = "192.168.10.175"; port = 43443; ssl = true; }
+      { addr = "192.168.10.175"; port = 43080; ssl = false; }
+    ];
+
     extraConfig = ''
       client_max_body_size 128M;
     '';
@@ -57,11 +60,4 @@ in {
       proxyWebsockets = true;
     };
   };
-  services.postgresql = {
-    ensureDatabases = [ "vaultwarden" ];
-    ensureUsers = [{
-      name = "vaultwarden";
-      ensureDBOwnership = true;
-    }];
-  };
 }

hosts/voyager/configuration.nix

@@ -13,15 +13,12 @@
       ./services/snappymail.nix
       ./services/calibre.nix
       ./services/fancontrol.nix
-      ./services/gitea.nix
       ./services/jellyfin.nix
       ./services/kanidm.nix
-      ./services/metrics
       ./services/nginx
       ./services/postgres.nix
       ./services/timemachine.nix
       ./services/transmission.nix
-      ./services/vaultwarden.nix
   ];
 
   networking = {

hosts/voyager/filesystems.nix

@@ -11,7 +11,11 @@
     kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
   };
   services.zfs.autoScrub.enable = true;
-  services.prometheus.exporters.zfs.enable = true;
+  services.prometheus.exporters.zfs = {
+    enable = true;
+    openFirewall = true;
+    firewallFilter = "-p tcp -m tcp -s 192.168.10.175 --dport 9134"; # Only allow defiant
+  };
 
   # Network mounts (import)
   fileSystems = {

secrets/defiant/defiant.yaml

@@ -3,6 +3,8 @@ matrix:
         registrationsecret: ENC[AES256_GCM,data:6gRW6t080VSyNRAmIrMqXL/oj7dj0JbcQekG3lac7zcdvJbgkUaqEGoWdrym2XiEOSLBOVMthnpLdalC2wcyJdmxB7xMNsYS4RfjR3PMKIo1Ap7JSmuKBl3eeaOalHk=,iv:dZl4/qFMoqEbSwL4JF/sjG21e6DuKVxbXwrGHkxfW4U=,tag:LWdCcmUUeTO4YAHkHOSJuw==,type:str]
 hedgedoc:
     env: ENC[AES256_GCM,data:7UU8MNo3AEpG1L0lpbfow4mGsIj7qMgtldCxv2T8rimintl1PN+avb2yxXz2P+1MqxNhacYYfBn5AkVqUJvAvo/HaQmsu+M1iFuMG6vEQuMGZZ1bjcslKxjVFWe9Rxzb9O33jqielsBiUmkP7f0MoGzfdyncpRuGjge+ADL7YXdRdH2zyDLW0txM3P593MQYiGo9wzwb7ZpycX4NsuE=,iv:4QE4RwD6c7KQS/w15YP/P2u7iOTWd36/YhpA2Jtdu0U=,tag:QBvO3q5C9TK0oSeso367/Q==,type:str]
+vaultwarden:
+    admintoken: ENC[AES256_GCM,data:sUPOe3goxpJFpe5fBdwcM5Z6+DXNdZr5Xd6HzRUb7LtDk9IUtwL4wtlckwnMRoLF628XvCV3ObrX2UmTqUX/6pWqLkWL/vWb3C8ogq4=,iv:vvO9nEkCjcKvl+ILEMlMorMmvyNM1juRYRnEolwg9sQ=,tag:wFnz9oOA+ZGrb4UqKrtUcA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -27,8 +29,8 @@ sops:
             RXcvQU1JYnl0bUtocTZuNkRxcGQwR2MKnyAYtF2y7XBmNuIYi6RzqEJEPPg7B22A
             fQVeDfIhiNSVva784KTU+y4TU1UPxumriRrLRFPF3h42ZEq2zQAgrQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-24T23:15:29Z"
-    mac: ENC[AES256_GCM,data:h+omoqeN7ssm7lfF/kdUCX7umQwWtTeph2C9tJQEAP7naL+Sm5WgXl/6PYHjjDSJ8X56tQgNdA2F5P5xIwTEfi6ip0Xbqy9vL+TfqjRhaT897O9W3Gka0zKTIkLFH2klgv3FXRd1CybxfyZpuz8Gpyy/tHZMcdIbEt+snlAII/A=,iv:+MgU7SfErnTMc63liEr8SmJLAthlbG8kU/xY6fUC7jU=,tag:I56xwXpVOF38QelGqW0XPg==,type:str]
+    lastmodified: "2023-12-25T23:07:08Z"
+    mac: ENC[AES256_GCM,data:q+e4CbkTrpAl2gsiYi/cJ7v5cv6IoT/o4eBF+3IbkO36c9CWTlV0ntfTYJInhMvjWfiKaTpx0s3CzSB+WmI541zGudSraxibL7ZPdpaTO9YeODRPg5mkUe5lfEqhy1kdXeqeen+3kSUalJOzbefkZOmITBMLtYUzTOs8HW7NQqE=,iv:zbZdSXoPnJAYk8oozTsxNCZlImu+aAJlVrqzBWAKieQ=,tag:UYhIu5YN2OBYgvCEXUy5kA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1