commit 8ee102baf885aaa3ae2cb6ba7ecea378be3fcbe8 · ptr.pet/ark

+22 -27

dns/dnsconfig.js

···

       3
       3
        
       

     

       4
       4
        
       var WOLUMONDE_IP = "23.88.101.188";

     

       5
       5
        
       var DZWONEK_IP = "94.237.26.47";

     

       6
       6
       +
       var TRIMOUNTS_IP = "159.195.58.28";

     

       6
       7
        
       

     

       7
       8
        
       D(

     

       8
       9
        
           "gaze.systems",

     

       9
       10
        
           REG_NONE,

     

       10
       11
        
           DnsProvider(DSP_CLOUDFLARE),

     

       11
       12
        
           DefaultTTL(1),

     

       12
       12
       -
           A("@", WOLUMONDE_IP, CF_PROXY_OFF),

     

       13
       13
       -
           A("doc", WOLUMONDE_IP, CF_PROXY_OFF),

     

       14
       14
       -
           A("git", WOLUMONDE_IP, CF_PROXY_OFF),

     

       15
       15
       -
           A("limbus", WOLUMONDE_IP, CF_PROXY_OFF),

     

       16
       16
       -
           A("pmart", WOLUMONDE_IP, CF_PROXY_OFF),

     

       13
       13
       +
           A("@", TRIMOUNTS_IP, CF_PROXY_OFF, TTL(60)),

     

       14
       14
       +
           A("doc", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       15
       15
       +
           A("pmart", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       17
       16
        
           // A("webhook", WOLUMONDE_IP, CF_PROXY_OFF),

     

       18
       18
       -
           A("dash", WOLUMONDE_IP, CF_PROXY_OFF), // perses

     

       19
       19
       -
           A("knot", WOLUMONDE_IP, CF_PROXY_OFF),

     

       20
       20
       -
           A("spindle", WOLUMONDE_IP, CF_PROXY_OFF),

     

       21
       21
       -
           A("skeetdeck", WOLUMONDE_IP, CF_PROXY_OFF),

     

       22
       22
       -
           A("likes", WOLUMONDE_IP, CF_PROXY_OFF),

     

       23
       23
       -
           A("id", WOLUMONDE_IP, CF_PROXY_OFF),

     

       24
       24
       -
           A("test", WOLUMONDE_IP, CF_PROXY_OFF),

     

       25
       25
       -
           // atp handles

     

       26
       26
       -
           A("dawn", WOLUMONDE_IP, CF_PROXY_OFF),

     

       27
       27
       -
           A("guestbook", WOLUMONDE_IP, CF_PROXY_OFF),

     

       28
       28
       -
           A("drew", WOLUMONDE_IP, CF_PROXY_OFF),

     

       29
       29
       -
           A("eris", WOLUMONDE_IP, CF_PROXY_OFF),

     

       17
       17
       +
           A("dash", TRIMOUNTS_IP, CF_PROXY_OFF), // perses

     

       18
       18
       +
           A("knot", TRIMOUNTS_IP, CF_PROXY_OFF, TTL(60)),

     

       19
       19
       +
           A("spindle", TRIMOUNTS_IP, CF_PROXY_OFF, TTL(60)),

     

       20
       20
       +
           A("id", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       21
       21
       +
           // atp

     

       22
       22
       +
           A("guestbook", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       30
       23
        
           // dzwonek

     

       31
       24
        
           A("vpn", DZWONEK_IP, CF_PROXY_OFF),

     

       32
       25
        
           // A("meow", WOLUMONDE_IP, CF_PROXY_OFF),

     
···

       54
       47
        
           TXT("send.poke", "v=spf1 include:amazonses.com ~all"),

     

       55
       48
        
           // atproto

     

       56
       49
        
           TXT("_atproto.eris", "did=did:plc:bxjnsrfzozl365rsdo5yvuz5", TTL(60)),

     

       57
       57
       -
           // TXT("_atproto", "did=did:plc:dfl62fgb7wtjj3fcbb72naae", TTL(60)),

     

       58
       58
       -
           // TXT("_atproto.dusk", "did=did:plc:dfl62fgb7wtjj3fcbb72naae", TTL(60)),

     

       50
       50
       +
           TXT("_atproto.drew", "did=did:plc:vo6ie3kd6xvpjlof4pnb2zzp", TTL(60)),

     

       59
       51
        
       );

     

       60
       52
        
       

     

       61
       53
        
       D(

     
···

       63
       55
        
           REG_NONE,

     

       64
       56
        
           DnsProvider(DSP_CLOUDFLARE),

     

       65
       57
        
           DefaultTTL(1),

     

       66
       66
       -
           A("@", WOLUMONDE_IP, CF_PROXY_ON),

     

       58
       58
       +
           A("@", TRIMOUNTS_IP, CF_PROXY_ON),

     

       67
       59
        
           TXT("@", "a data endpoint for entity with serial id /90008/."),

     

       68
       60
        
           TXT(

     

       69
       61
        
               "@",

     
···

       79
       71
        
           ),

     

       80
       72
        
           // atproto

     

       81
       73
        
           // TXT("_atproto", "did=did:plc:dfl62fgb7wtjj3fcbb72naae"),

     

       74
       74
       +
           IGNORE_NAME("_acme-challenge"),

     

       82
       75
        
       );

     

       83
       76
        
       

     

       84
       77
        
       D(

     
···

       86
       79
        
           REG_NONE,

     

       87
       80
        
           DnsProvider(DSP_CLOUDFLARE),

     

       88
       81
        
           DefaultTTL(1),

     

       89
       89
       -
           A("@", WOLUMONDE_IP, CF_PROXY_OFF),

     

       82
       82
       +
           A("@", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       90
       83
        
           TXT("@", "v=spf1 -all"),

     

       91
       84
        
           TXT("_dmarc", "v=DMARC1; p=reject;"),

     

       85
       85
       +
           TXT("_atproto", "did=did:plc:dfl62fgb7wtjj3fcbb72naae", TTL(60)),

     

       86
       86
       +
           IGNORE_NAME("_acme-challenge"),

     

       92
       87
        
       );

     

       93
       88
        
       

     

       94
       89
        
       var EMAIL_TTL = 86400;

     
···

       98
       93
        
           REG_NONE,

     

       99
       94
        
           DnsProvider(DSP_CLOUDFLARE),

     

       100
       95
        
           DefaultTTL(1),

     

       101
       101
       -
           A("@", WOLUMONDE_IP, CF_PROXY_OFF),

     

       102
       102
       -
           A("test", WOLUMONDE_IP, CF_PROXY_OFF),

     

       96
       96
       +
           A("@", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       103
       97
        
           A("nucleus", DZWONEK_IP, CF_PROXY_OFF),

     

       104
       98
        
           A("trill", DZWONEK_IP, CF_PROXY_OFF),

     

       105
       99
        
           // atproto

     

       106
       100
        
           TXT("_atproto", "did=did:plc:dfl62fgb7wtjj3fcbb72naae"),

     

       107
       107
       -
           A("nil", WOLUMONDE_IP, CF_PROXY_OFF),

     

       108
       101
        
           TXT("_atproto.nil", "did=did:plc:dumbmutt4po52ept2tczimje"),

     

       109
       102
        
           TXT("_atproto.june", "did=did:plc:y3z2rr7q5rywu4fjn3fmfyop"),

     

       110
       103
        
           // june

     
···

       159
       152
        
           ),

     

       160
       153
        
       

     

       161
       154
        
           // mta-sts

     

       162
       162
       -
           A("mta-sts", WOLUMONDE_IP, CF_PROXY_OFF),

     

       155
       155
       +
           A("mta-sts", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       163
       156
        
           TXT("_mta-sts", "v=STSv1; id=20250930T1945", TTL(EMAIL_TTL)),

     

       164
       157
        
       

     

       165
       158
        
           // autoconfig

     

       166
       166
       -
           A("autoconfig", WOLUMONDE_IP, CF_PROXY_OFF),

     

       167
       167
       -
           A("autodiscover", WOLUMONDE_IP, CF_PROXY_OFF),

     

       159
       159
       +
           A("autoconfig", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       160
       160
       +
           A("autodiscover", TRIMOUNTS_IP, CF_PROXY_OFF),

     

       168
       161
        
       

     

       169
       162
        
           // autodiscovery

     

       170
       163
        
           SRV(

     
···

       178
       171
        
           SRV("_submissions._tcp", 0, 1, 465, "smtp.migadu.com.", TTL(EMAIL_TTL)),

     

       179
       172
        
           SRV("_imaps._tcp", 0, 1, 993, "imap.migadu.com.", TTL(EMAIL_TTL)),

     

       180
       173
        
           SRV("_pop3s._tcp", 0, 1, 995, "pop.migadu.com.", TTL(EMAIL_TTL)),

     

       174
       174
       +
       

     

       175
       175
       +
           IGNORE_NAME("_acme-challenge"),

     

       181
       176
        
       );

+18 -18

flake.lock

···

       9
       9
        
               "rust-overlay": "rust-overlay"

     

       10
       10
        
             },

     

       11
       11
        
             "locked": {

     

       12
       12
       -
               "lastModified": 1764153295,

     

       13
       13
       -
               "narHash": "sha256-Y+Cp19zLo5JZVLSbzpyCTSK1bVYfE3Leuut6nQVkdR4=",

     

       12
       12
       +
               "lastModified": 1764351487,

     

       13
       13
       +
               "narHash": "sha256-7XJcTfz0dPhBd7nfyjcFxT1LIIctJZ2LthiI2Ltd7zY=",

     

       14
       14
        
               "owner": "chaotic-cx",

     

       15
       15
        
               "repo": "nyx",

     

       16
       16
       -
               "rev": "29c49282c9b2e8216004a87086494defe401fee8",

     

       16
       16
       +
               "rev": "2031f4a0507d0f7ab3e1aaff4c027a010feee447",

     

       17
       17
        
               "type": "github"

     

       18
       18
        
             },

     

       19
       19
        
             "original": {

     
···

       45
       45
        
               ]

     

       46
       46
        
             },

     

       47
       47
        
             "locked": {

     

       48
       48
       -
               "lastModified": 1764075860,

     

       49
       49
       -
               "narHash": "sha256-KYEIHCBBw+/lwKsJNRNoUxBB4ZY2LK0G0T8f+0i65q0=",

     

       48
       48
       +
               "lastModified": 1764194569,

     

       49
       49
       +
               "narHash": "sha256-iUM9ktarEzThkayyZrzQ7oycPshAY2XRQqVKz0xX/L0=",

     

       50
       50
        
               "owner": "nix-community",

     

       51
       51
        
               "repo": "home-manager",

     

       52
       52
       -
               "rev": "295d90e22d557ccc3049dc92460b82f372cd3892",

     

       52
       52
       +
               "rev": "9651819d75f6c7ffaf8a9227490ac704f29659f0",

     

       53
       53
        
               "type": "github"

     

       54
       54
        
             },

     

       55
       55
        
             "original": {

     
···

       67
       67
        
               ]

     

       68
       68
        
             },

     

       69
       69
        
             "locked": {

     

       70
       70
       -
               "lastModified": 1763714684,

     

       71
       71
       -
               "narHash": "sha256-ZNJPAaeSYQTDgvwwE8XHhCz4HiHqYoUyoXdoBE2nxug=",

     

       70
       70
       +
               "lastModified": 1764275117,

     

       71
       71
       +
               "narHash": "sha256-DRcv8Y0BnWm4ZhUQnaYk1dNzC6ZhA2W9Vv5Jl4n0RbE=",

     

       72
       72
        
               "owner": "Jovian-Experiments",

     

       73
       73
        
               "repo": "Jovian-NixOS",

     

       74
       74
       -
               "rev": "6178d787ee61b8586fdb0ccb8644fbfd5317d0f3",

     

       74
       74
       +
               "rev": "96023dcc9a0febaaa3b91f447b9ae2fbe86f2923",

     

       75
       75
        
               "type": "github"

     

       76
       76
        
             },

     

       77
       77
        
             "original": {

     
···

       105
       105
        
           },

     

       106
       106
        
           "nixpkgs": {

     

       107
       107
        
             "locked": {

     

       108
       108
       -
               "lastModified": 1763966396,

     

       109
       109
       -
               "narHash": "sha256-6eeL1YPcY1MV3DDStIDIdy/zZCDKgHdkCmsrLJFiZf0=",

     

       108
       108
       +
               "lastModified": 1764242076,

     

       109
       109
       +
               "narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",

     

       110
       110
        
               "owner": "NixOS",

     

       111
       111
        
               "repo": "nixpkgs",

     

       112
       112
       -
               "rev": "5ae3b07d8d6527c42f17c876e404993199144b6a",

     

       112
       112
       +
               "rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",

     

       113
       113
        
               "type": "github"

     

       114
       114
        
             },

     

       115
       115
        
             "original": {

     
···

       121
       121
        
           },

     

       122
       122
        
           "nixpkgs_2": {

     

       123
       123
        
             "locked": {

     

       124
       124
       -
               "lastModified": 1763966396,

     

       125
       125
       -
               "narHash": "sha256-6eeL1YPcY1MV3DDStIDIdy/zZCDKgHdkCmsrLJFiZf0=",

     

       124
       124
       +
               "lastModified": 1764242076,

     

       125
       125
       +
               "narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",

     

       126
       126
        
               "owner": "NixOS",

     

       127
       127
        
               "repo": "nixpkgs",

     

       128
       128
       -
               "rev": "5ae3b07d8d6527c42f17c876e404993199144b6a",

     

       128
       128
       +
               "rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",

     

       129
       129
        
               "type": "github"

     

       130
       130
        
             },

     

       131
       131
        
             "original": {

     
···

       149
       149
        
               ]

     

       150
       150
        
             },

     

       151
       151
        
             "locked": {

     

       152
       152
       -
               "lastModified": 1764038373,

     

       153
       153
       -
               "narHash": "sha256-M6w2wNBRelcavoDAyFL2iO4NeWknD40ASkH1S3C0YGM=",

     

       152
       152
       +
               "lastModified": 1764211126,

     

       153
       153
       +
               "narHash": "sha256-p5y13PnMZYd5WdHk+XCzyUaLGBUCwnz2n4KYKEZM0Pw=",

     

       154
       154
        
               "owner": "oxalica",

     

       155
       155
        
               "repo": "rust-overlay",

     

       156
       156
       -
               "rev": "ab3536fe850211a96673c6ffb2cb88aab8071cc9",

     

       156
       156
       +
               "rev": "895935bff08cfcfb663fb9c8263c43596e7cd1ed",

     

       157
       157
        
               "type": "github"

     

       158
       158
        
             },

     

       159
       159
        
             "original": {

+1 -3

hosts/chernobog/default.nix

···

       49
       49
        
             noto-fonts

     

       50
       50
        
             noto-fonts-cjk-serif

     

       51
       51
        
             noto-fonts-cjk-sans

     

       52
       52
       -
             noto-fonts-emoji

     

       52
       52
       +
             noto-fonts-color-emoji

     

       53
       53
        
             font-awesome

     

       54
       54
        
             source-han-serif

     

       55
       55
        
             source-han-sans

     

       56
       56
       -
             source-han-sans-japanese

     

       57
       57
       -
             source-han-serif-japanese

     

       58
       56
        
             comic-mono

     

       59
       57
        
             comic-relief

     

       60
       58
        
           ];

+22 -2

hosts/chernobog/modules/vr.nix

···

       25
       25
        
           };

     

       26
       26
        
         };

     

       27
       27
        
       

     

       28
       28
       -
         # programs.envision.enable = true;

     

       28
       28
       +
         environment.systemPackages = with pkgs; [ wlx-overlay-s eepyxr wayvr-dashboard xrizer ];

     

       29
       29
        
       

     

       30
       30
       -
         environment.systemPackages = with pkgs; [ wlx-overlay-s eepyxr wayvr-dashboard ];

     

       30
       30
       +
         home-manager.sharedModules = [{

     

       31
       31
       +
           xdg.configFile."openvr/openvrpaths.vrpath".text = ''

     

       32
       32
       +
             {

     

       33
       33
       +
               "config" :

     

       34
       34
       +
               [

     

       35
       35
       +
                 "/home/mayer/.local/share/Steam/config"

     

       36
       36
       +
               ],

     

       37
       37
       +
               "external_drivers" : null,

     

       38
       38
       +
               "jsonid" : "vrpathreg",

     

       39
       39
       +
               "log" :

     

       40
       40
       +
               [

     

       41
       41
       +
                 "/home/mayer/.local/share/Steam/logs"

     

       42
       42
       +
               ],

     

       43
       43
       +
               "runtime" :

     

       44
       44
       +
               [

     

       45
       45
       +
                 ${pkgs.xrizer}/lib/xrizer"

     

       46
       46
       +
               ],

     

       47
       47
       +
               "version" : 1

     

       48
       48
       +
             }

     

       49
       49
       +
           '';

     

       50
       50
       +
         }];

     

       31
       51
        
       }

+1 -1

hosts/default.nix

···

       29
       29
        
         systems = {

     

       30
       30
        
           # lungmen = "x86_64-linux";

     

       31
       31
        
           # tkaronto = "x86_64-linux";

     

       32
       32
       -
           wolumonde = allPkgsSets.x86_64-linux;

     

       32
       32
       +
           # wolumonde = allPkgsSets.x86_64-linux;

     

       33
       33
        
           # wsl = allPkgsSets.x86_64-linux;

     

       34
       34
        
           dzwonek = allPkgsSets.x86_64-linux;

     

       35
       35
        
           volsinii = allPkgsSets.x86_64-linux;

-3

hosts/dzwonek/modules/nginx.nix

···

       1
       1
        
       {

     

       2
       2
       -
         lib,

     

       3
       2
        
         inputs,

     

       4
       4
       -
         pkgs,

     

       5
       3
        
         ...

     

       6
       4
        
       }:

     

       7
       5
        
       {

     

       8
       6
        
         services.nginx = {

     

       9
       7
        
           enable = true;

     

       10
       10
       -
           package = pkgs.nginxQuic;

     

       11
       8
        
           recommendedTlsSettings = true;

     

       12
       9
        
           recommendedOptimisation = true;

     

       13
       10
        
           recommendedGzipSettings = true;

+38

hosts/trimounts/modules/atproto.nix

···

       1
       1
       +
       { pkgs, lib, ... }:

     

       2
       2
       +
       let

     

       3
       3
       +
         getFileType = name: if lib.hasSuffix ".json" name then "application/json" else "text/plain";

     

       4
       4
       +
         mkWellKnownCfg = files: {

     

       5
       5
       +
           quic = true;

     

       6
       6
       +
           kTLS = true;

     

       7
       7
       +
           locations = (

     

       8
       8
       +
             lib.mapAttrs' (name: file: {

     

       9
       9
       +
               name = "=/.well-known/${name}";

     

       10
       10
       +
               value = {

     

       11
       11
       +
                 extraConfig = ''

     

       12
       12
       +
                   alias ${file};

     

       13
       13
       +
                   add_header access-control-allow-origin *;

     

       14
       14
       +
                   default_type ${getFileType name};

     

       15
       15
       +
                 '';

     

       16
       16
       +
               };

     

       17
       17
       +
             }) files

     

       18
       18
       +
           );

     

       19
       19
       +
         };

     

       20
       20
       +
         mkDidWebCfg = domain: {

     

       21
       21
       +
           "${domain}" =

     

       22
       22
       +
             (mkWellKnownCfg {

     

       23
       23
       +
               "did.json" = ../../../secrets/${domain}.did;

     

       24
       24
       +
               "atproto-did" = pkgs.writeText "server" "did:web:${domain}";

     

       25
       25
       +
             })

     

       26
       26
       +
             // (lib.optionalAttrs (lib.hasSuffix "gaze.systems" domain) {

     

       27
       27
       +
               useACMEHost = "gaze.systems";

     

       28
       28
       +
               forceSSL = true;

     

       29
       29
       +
               quic = true;

     

       30
       30
       +
               kTLS = true;

     

       31
       31
       +
             });

     

       32
       32
       +
         };

     

       33
       33
       +
         guestbookDid = "guestbook.gaze.systems";

     

       34
       34
       +
       in

     

       35
       35
       +
       {

     

       36
       36
       +
         security.acme.certs."gaze.systems".extraDomainNames = [guestbookDid];

     

       37
       37
       +
         services.nginx.virtualHosts = mkDidWebCfg guestbookDid;

     

       38
       38
       +
       }

+58

hosts/trimounts/modules/email.nix

···

       1
       1
       +
       { pkgs, ... }:

     

       2
       2
       +
       {

     

       3
       3
       +
         security.acme.certs."ptr.pet".extraDomainNames = [

     

       4
       4
       +
           "mta-sts.ptr.pet"

     

       5
       5
       +
           "autoconfig.ptr.pet"

     

       6
       6
       +
           "autodiscover.ptr.pet"

     

       7
       7
       +
         ];

     

       8
       8
       +
         services.nginx.virtualHosts."ptr.pet" = {

     

       9
       9
       +
           useACMEHost = "ptr.pet";

     

       10
       10
       +
           quic = true;

     

       11
       11
       +
           kTLS = true;

     

       12
       12
       +
           forceSSL = true;

     

       13
       13
       +
           locations."/mail/config-v1.1.xml" = {

     

       14
       14
       +
             return = "301 https://autoconfig.migadu.com/mail/config-v1.1.xml";

     

       15
       15
       +
           };

     

       16
       16
       +
           locations."/Autodiscover/Autodiscover.xml" = {

     

       17
       17
       +
             return = "301 https://autodiscover.migadu.com/Autodiscover/Autodiscover.xml";

     

       18
       18
       +
           };

     

       19
       19
       +
         };

     

       20
       20
       +
         services.nginx.virtualHosts."mta-sts.ptr.pet" =

     

       21
       21
       +
           let

     

       22
       22
       +
             file = pkgs.writeText "mta-sts.txt" ''

     

       23
       23
       +
               version: STSv1

     

       24
       24
       +
               mode: enforce

     

       25
       25
       +
               mx: aspmx1.migadu.com

     

       26
       26
       +
               mx: aspmx2.migadu.com

     

       27
       27
       +
               max_age: 31557600

     

       28
       28
       +
             '';

     

       29
       29
       +
           in

     

       30
       30
       +
           {

     

       31
       31
       +
             useACMEHost = "ptr.pet";

     

       32
       32
       +
             quic = true;

     

       33
       33
       +
             kTLS = true;

     

       34
       34
       +
             forceSSL = true;

     

       35
       35
       +
             locations."=/.well-known/mta-sts.txt".extraConfig = ''

     

       36
       36
       +
               alias ${file};

     

       37
       37
       +
               default_type text/plain;

     

       38
       38
       +
             '';

     

       39
       39
       +
           };

     

       40
       40
       +
         services.nginx.virtualHosts."autoconfig.ptr.pet" = {

     

       41
       41
       +
           useACMEHost = "ptr.pet";

     

       42
       42
       +
           quic = true;

     

       43
       43
       +
           kTLS = true;

     

       44
       44
       +
           forceSSL = true;

     

       45
       45
       +
           locations."/" = {

     

       46
       46
       +
             return = "301 https://autoconfig.migadu.com$request_uri";

     

       47
       47
       +
           };

     

       48
       48
       +
         };

     

       49
       49
       +
         services.nginx.virtualHosts."autodiscover.ptr.pet" = {

     

       50
       50
       +
           useACMEHost = "ptr.pet";

     

       51
       51
       +
           quic = true;

     

       52
       52
       +
           kTLS = true;

     

       53
       53
       +
           forceSSL = true;

     

       54
       54
       +
           locations."/" = {

     

       55
       55
       +
             return = "301 https://autodiscover.migadu.com$request_uri";

     

       56
       56
       +
           };

     

       57
       57
       +
         };

     

       58
       58
       +
       }

+47

hosts/trimounts/modules/limbusart.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         inputs,

     

       3
       3
       +
         pkgs,

     

       4
       4
       +
         lib,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       let

     

       8
       8
       +
         pkg = pkgs.callPackage "${inputs.limbusart}/package.nix" { };

     

       9
       9
       +
         domain = "pmart.gaze.systems";

     

       10
       10
       +
       in

     

       11
       11
       +
       {

     

       12
       12
       +
         systemd.services.limbusart = {

     

       13
       13
       +
           description = "limbusart";

     

       14
       14
       +
           wantedBy = [ "multi-user.target" ];

     

       15
       15
       +
           after = [ "network.target" ];

     

       16
       16
       +
           serviceConfig = lib.mkMerge [

     

       17
       17
       +
             {

     

       18
       18
       +
               User = "limbusart";

     

       19
       19
       +
               ExecStart = "${pkg}/bin/limbusart";

     

       20
       20
       +
               Restart = "on-failure";

     

       21
       21
       +
               RestartSec = 5;

     

       22
       22
       +
               WorkingDirectory = "/var/lib/limbusart";

     

       23
       23
       +
               EnvironmentFile = pkgs.writeText "limbusart.conf" ''

     

       24
       24
       +
                 ARTS_PATH="arts.txt"

     

       25
       25
       +
                 SITE_TITLE="random pm art"

     

       26
       26
       +
                 EMBED_TITLE="random pm art here!!"

     

       27
       27
       +
                 EMBED_DESC="click NOW to see random pm art"

     

       28
       28
       +
                 EMBED_COLOR="#bd0000"

     

       29
       29
       +
               '';

     

       30
       30
       +
             }

     

       31
       31
       +
           ];

     

       32
       32
       +
         };

     

       33
       33
       +
         users.users.limbusart = {

     

       34
       34
       +
           isSystemUser = true;

     

       35
       35
       +
           group = "limbusart";

     

       36
       36
       +
         };

     

       37
       37
       +
         users.groups.limbusart = { };

     

       38
       38
       +
       

     

       39
       39
       +
         security.acme.certs."gaze.systems".extraDomainNames = [domain];

     

       40
       40
       +
         services.nginx.virtualHosts.${domain} = {

     

       41
       41
       +
           useACMEHost = "gaze.systems";

     

       42
       42
       +
           forceSSL = true;

     

       43
       43
       +
           quic = true;

     

       44
       44
       +
           kTLS = true;

     

       45
       45
       +
           locations."/".proxyPass = "http://localhost:3000";

     

       46
       46
       +
         };

     

       47
       47
       +
       }

+3

hosts/trimounts/modules/mosh.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         programs.mosh.enable = true;

     

       3
       3
       +
       }

+134

hosts/trimounts/modules/nginx.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         config,

     

       3
       3
       +
         lib,

     

       4
       4
       +
         inputs,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       {

     

       8
       8
       +
         services.nginx = {

     

       9
       9
       +
           enable = true;

     

       10
       10
       +
           recommendedTlsSettings = true;

     

       11
       11
       +
           recommendedOptimisation = true;

     

       12
       12
       +
           recommendedGzipSettings = true;

     

       13
       13
       +
           recommendedProxySettings = true;

     

       14
       14
       +
           # /nginx_status

     

       15
       15
       +
           statusPage = true;

     

       16
       16
       +
         };

     

       17
       17
       +
       

     

       18
       18
       +
         networking.firewall.allowedTCPPorts = [ 80 443 ];

     

       19
       19
       +
       

     

       20
       20
       +
         # output json logs so we can consume them more easily

     

       21
       21
       +
         services.nginx.appendHttpConfig = ''

     

       22
       22
       +
           log_format json_logs escape=json '{'

     

       23
       23
       +
             '"_msg":"request completed",'

     

       24
       24
       +
             '"time":"$time_local",'

     

       25
       25
       +
             '"req.remoteAddr":"$remote_addr",'

     

       26
       26
       +
             '"req.method":"$request_method",'

     

       27
       27
       +
             '"req.url":"$uri",'

     

       28
       28
       +
             '"req.httpVersion":"$server_protocol",'

     

       29
       29
       +
             '"res.statusCode":$status,'

     

       30
       30
       +
             '"res.bodySize":$body_bytes_sent,'

     

       31
       31
       +
             '"req.headers.id":"$request_id",'

     

       32
       32
       +
             '"req.headers.referer":"$http_referer",'

     

       33
       33
       +
             '"req.headers.user-agent":"$http_user_agent",'

     

       34
       34
       +
             '"requestTime":$request_time'

     

       35
       35
       +
           '}';

     

       36
       36
       +
           access_log /var/log/nginx/access.log json_logs;

     

       37
       37
       +
         '';

     

       38
       38
       +
       

     

       39
       39
       +
         users.users.nginx.extraGroups = [ "acme" ];

     

       40
       40
       +
       

     

       41
       41
       +
         age.secrets.cfDnsEditToken.file = ../../../secrets/cloudflareDnsEdit.age;

     

       42
       42
       +
         security.acme = {

     

       43
       43
       +
           acceptTerms = true;

     

       44
       44
       +
           defaults = {

     

       45
       45
       +
             group = "nginx";

     

       46
       46
       +
             email = (import "${inputs.self}/personal.nix").emails.primary;

     

       47
       47
       +
             dnsProvider = "cloudflare";

     

       48
       48
       +
             credentialFiles = {

     

       49
       49
       +
               CF_DNS_API_TOKEN_FILE = config.age.secrets.cfDnsEditToken.path;

     

       50
       50
       +
             };

     

       51
       51
       +
           };

     

       52
       52
       +
           certs."poor.dog" = { };

     

       53
       53
       +
           certs."ptr.pet" = { };

     

       54
       54
       +
           certs."gaze.systems" = { };

     

       55
       55
       +
         };

     

       56
       56
       +
         services.nginx.virtualHosts."gaze.systems" = {

     

       57
       57
       +
           quic = true;

     

       58
       58
       +
           kTLS = true;

     

       59
       59
       +
           useACMEHost = "gaze.systems";

     

       60
       60
       +
           forceSSL = true;

     

       61
       61
       +
         };

     

       62
       62
       +
         services.nginx.virtualHosts."poor.dog" = {

     

       63
       63
       +
           quic = true;

     

       64
       64
       +
           kTLS = true;

     

       65
       65
       +
           useACMEHost = "poor.dog";

     

       66
       66
       +
           forceSSL = true;

     

       67
       67
       +
         };

     

       68
       68
       +
         services.nginx.virtualHosts."ptr.pet" = {

     

       69
       69
       +
           quic = true;

     

       70
       70
       +
           kTLS = true;

     

       71
       71
       +
           useACMEHost = "ptr.pet";

     

       72
       72
       +
           forceSSL = true;

     

       73
       73
       +
         };

     

       74
       74
       +
       

     

       75
       75
       +
         services.fluent-bit.settings = {

     

       76
       76
       +
           parsers = [

     

       77
       77
       +
             {

     

       78
       78
       +
               name = "nginx_json";

     

       79
       79
       +
               format = "json";

     

       80
       80
       +
               time_key = "time";

     

       81
       81
       +
               time_format = "%d/%b/%Y:%H:%M:%S %z";

     

       82
       82
       +
             }

     

       83
       83
       +
           ];

     

       84
       84
       +
           pipeline = {

     

       85
       85
       +
             inputs = [

     

       86
       86
       +
               {

     

       87
       87
       +
                 name = "nginx_metrics";

     

       88
       88
       +
                 tag = "metrics.nginx";

     

       89
       89
       +
                 status_url = "/nginx_status";

     

       90
       90
       +
                 nginx_plus = false;

     

       91
       91
       +
               }

     

       92
       92
       +
               {

     

       93
       93
       +
                 name = "tail";

     

       94
       94
       +
                 tag = "logs.nginx";

     

       95
       95
       +
                 path = "/var/log/nginx/*.log";

     

       96
       96
       +
                 db = "/var/lib/fluent-bit/nginx-access.db";

     

       97
       97
       +
                 "db.locking" = true;

     

       98
       98
       +
                 buffer_chunk_size = "4m";

     

       99
       99
       +
                 buffer_max_size = "32m";

     

       100
       100
       +
                 parser = "nginx_json";

     

       101
       101
       +
               }

     

       102
       102
       +
             ];

     

       103
       103
       +
             filters = [

     

       104
       104
       +
               {

     

       105
       105
       +
                 name = "modify";

     

       106
       106
       +
                 match = "logs.nginx";

     

       107
       107
       +
                 Add = [ "name nginx" ];

     

       108
       108
       +
               }

     

       109
       109
       +
             ];

     

       110
       110
       +
           };

     

       111
       111
       +
         };

     

       112
       112
       +
       

     

       113
       113
       +
         # need so fluent-bit can access nginx

     

       114
       114
       +
         systemd.services.fluent-bit.serviceConfig.SupplementaryGroups = lib.mkForce "systemd-journal nginx";

     

       115
       115
       +
       

     

       116
       116
       +
         services.vmalert.instances."".rules.groups = [

     

       117
       117
       +
           {

     

       118
       118
       +
             name = "nginx-logs";

     

       119
       119
       +
             type = "vlogs";

     

       120
       120
       +
             interval = "1m";

     

       121
       121
       +
             rules = [

     

       122
       122
       +
               {

     

       123
       123
       +
                 record = "nginx_request_count";

     

       124
       124
       +
                 expr = "name:nginx | stats (res.statusCode) count() as total_requests";

     

       125
       125
       +
               }

     

       126
       126
       +
               {

     

       127
       127
       +
                 record = "nginx_request_latency";

     

       128
       128
       +
                 # filter out subscribeRepos requests because they are long polling http L

     

       129
       129
       +
                 expr = "name:nginx | filter req.url:!/xrpc/com.atproto.sync.subscribeRepos | stats avg(requestTime) avg, quantile(0.5, requestTime) p50, quantile(0.9, requestTime) p90, quantile(0.99, requestTime) p99";

     

       130
       130
       +
               }

     

       131
       131
       +
             ];

     

       132
       132
       +
           }

     

       133
       133
       +
         ];

     

       134
       134
       +
       }

+65

hosts/trimounts/modules/nsid-tracker.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         pkgs,

     

       3
       3
       +
         terra,

     

       4
       4
       +
         inputs,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       let

     

       8
       8
       +
         client-modules = pkgs.callPackage "${inputs.nsid-tracker}/nix/client-modules.nix" { };

     

       9
       9
       +
         client = pkgs.callPackage "${inputs.nsid-tracker}/nix/client.nix" {

     

       10
       10
       +
           PUBLIC_API_URL = "gaze.systems/nsid-tracker/api";

     

       11
       11
       +
           inherit client-modules;

     

       12
       12
       +
         };

     

       13
       13
       +
         # server = terra.nsid-tracker-server;

     

       14
       14
       +
         port = 3713;

     

       15
       15
       +
       in

     

       16
       16
       +
       {

     

       17
       17
       +
         systemd.services.nsid-tracker-client = {

     

       18
       18
       +
           description = "nsid-tracker-client";

     

       19
       19
       +
           wantedBy = [ "multi-user.target" ];

     

       20
       20
       +
           after = [ "network.target" ];

     

       21
       21
       +
           environment = {

     

       22
       22
       +
             # ORIGIN = "https://gaze.systems";

     

       23
       23
       +
             PORT = toString port;

     

       24
       24
       +
           };

     

       25
       25
       +
           serviceConfig = {

     

       26
       26
       +
             DynamicUser = true;

     

       27
       27
       +
             ExecStart = "${client}/bin/website";

     

       28
       28
       +
             Restart = "on-failure";

     

       29
       29
       +
             RestartSec = 5;

     

       30
       30
       +
             WorkingDirectory = "/var/lib/nsid-tracker";

     

       31
       31
       +
           };

     

       32
       32
       +
         };

     

       33
       33
       +
       

     

       34
       34
       +
         systemd.services.nsid-tracker-keep-alive = {

     

       35
       35
       +
           description = "keeps nsid-tracker peer connection alive";

     

       36
       36
       +
           wantedBy = [ "multi-user.target" ];

     

       37
       37
       +
           after = [ "network.target" ];

     

       38
       38
       +
           serviceConfig = {

     

       39
       39
       +
             Type = "oneshot";

     

       40
       40
       +
             ExecStart = "${pkgs.curl}/bin/curl http://dusk-devel-mobi:${toString port}/events";

     

       41
       41
       +
           };

     

       42
       42
       +
         };

     

       43
       43
       +
         systemd.timers.nsid-tracker-keep-alive.timerConfig = {

     

       44
       44
       +
           OnBootSec = "5 min";

     

       45
       45
       +
           OnUnitActiveSec = "5 min";

     

       46
       46
       +
           Unit = "nsid-tracker-keep-alive.service";

     

       47
       47
       +
         };

     

       48
       48
       +
       

     

       49
       49
       +
         services.nginx.virtualHosts."gaze.systems" = {

     

       50
       50
       +
           locations."/nsid-tracker/api" = {

     

       51
       51
       +
             proxyPass = "http://100.64.0.6:${toString port}/";

     

       52
       52
       +
             proxyWebsockets = true;

     

       53
       53
       +
             extraConfig = ''

     

       54
       54
       +
               rewrite ^/nsid-tracker/api/(.*) /$1 break;

     

       55
       55
       +
             '';

     

       56
       56
       +
           };

     

       57
       57
       +
           locations."/nsid-tracker".return = "301 /nsid-tracker/";

     

       58
       58
       +
           locations."/nsid-tracker/" = {

     

       59
       59
       +
             proxyPass = "http://localhost:${toString port}/";

     

       60
       60
       +
             extraConfig = ''

     

       61
       61
       +
               rewrite ^/nsid-tracker/(.*)$ /$1 break;

     

       62
       62
       +
             '';

     

       63
       63
       +
           };

     

       64
       64
       +
         };

     

       65
       65
       +
       }

+104

hosts/trimounts/modules/perses.nix/default.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         pkgs,

     

       3
       3
       +
         config,

     

       4
       4
       +
         ...

     

       5
       5
       +
       }:

     

       6
       6
       +
       let

     

       7
       7
       +
         domain = "dash.gaze.systems";

     

       8
       8
       +
         port = 7412;

     

       9
       9
       +
         user = "perses";

     

       10
       10
       +
       

     

       11
       11
       +
         provisionFolder = "provisioning";

     

       12
       12
       +
         provisioningFolder = "${config.users.users.${user}.home}/${provisionFolder}";

     

       13
       13
       +
       

     

       14
       14
       +
         persesConfig = {

     

       15
       15
       +
           database.file = {

     

       16
       16
       +
             folder = config.users.users.${user}.home;

     

       17
       17
       +
             extension = "json";

     

       18
       18
       +
           };

     

       19
       19
       +
           provisioning.folders = [ provisioningFolder ];

     

       20
       20
       +
           security = {

     

       21
       21
       +
             enable_auth = true;

     

       22
       22
       +
             authentication = {

     

       23
       23
       +
               providers = {

     

       24
       24
       +
                 enable_native = false;

     

       25
       25
       +
                 oidc = [

     

       26
       26
       +
                   {

     

       27
       27
       +
                     slug_id = "pocketid";

     

       28
       28
       +
                     name = "Pocket ID";

     

       29
       29
       +
                     client_id = "aa583db6-e03c-4490-853a-7f2b3e089fbe";

     

       30
       30
       +
                     issuer = config.services.pocket-id.settings.APP_URL;

     

       31
       31
       +
                     scopes = [ "openid profile email" ];

     

       32
       32
       +
                   }

     

       33
       33
       +
                 ];

     

       34
       34
       +
               };

     

       35
       35
       +
               disable_sign_up = false;

     

       36
       36
       +
             };

     

       37
       37
       +
             cookie = {

     

       38
       38
       +
               same_site = "strict";

     

       39
       39
       +
               secure = true;

     

       40
       40
       +
             };

     

       41
       41
       +
           };

     

       42
       42
       +
         };

     

       43
       43
       +
         persesConfigYaml = pkgs.writers.writeYAML "config.yaml" persesConfig;

     

       44
       44
       +
       

     

       45
       45
       +
         secrets = config.age.secrets;

     

       46
       46
       +
       in

     

       47
       47
       +
       {

     

       48
       48
       +
         environment.systemPackages = [ pkgs.perses ];

     

       49
       49
       +
       

     

       50
       50
       +
         users.users.${user} = {

     

       51
       51
       +
           isNormalUser = true;

     

       52
       52
       +
           group = user;

     

       53
       53
       +
           home = "/var/lib/${user}";

     

       54
       54
       +
           createHome = true;

     

       55
       55
       +
           uid = 1001;

     

       56
       56
       +
         };

     

       57
       57
       +
         users.groups.${user} = {

     

       58
       58
       +
           gid = 976;

     

       59
       59
       +
         };

     

       60
       60
       +
       

     

       61
       61
       +
         age.secrets.persesSecret = {

     

       62
       62
       +
           file = ../../../../secrets/persesSecret.age;

     

       63
       63
       +
           owner = user;

     

       64
       64
       +
           group = user;

     

       65
       65
       +
         };

     

       66
       66
       +
       

     

       67
       67
       +
         systemd.services.perses = {

     

       68
       68
       +
           description = "perses";

     

       69
       69
       +
           after = [

     

       70
       70
       +
             "network.target"

     

       71
       71
       +
             "pocket-id.service"

     

       72
       72
       +
           ];

     

       73
       73
       +
           requires = [ "pocket-id.service" ];

     

       74
       74
       +
           serviceConfig = {

     

       75
       75
       +
             ExecStart = "${pkgs.perses}/bin/perses --config=${persesConfigYaml} --web.listen-address=:${toString port} --log.level=info";

     

       76
       76
       +
             EnvironmentFile = secrets.persesSecret.path;

     

       77
       77
       +
             WorkingDirectory = config.users.users.${user}.home;

     

       78
       78
       +
           };

     

       79
       79
       +
         };

     

       80
       80
       +
         systemd.services.perses.preStart = ''

     

       81
       81
       +
           rm -rf ${provisioningFolder} && mkdir -p ${provisioningFolder}

     

       82
       82
       +
           cp -f ${./provision}/* ${provisioningFolder}

     

       83
       83
       +
         '';

     

       84
       84
       +
       

     

       85
       85
       +
         security.acme.certs."gaze.systems".extraDomainNames = [ domain ];

     

       86
       86
       +
         services.nginx.virtualHosts.${domain} = {

     

       87
       87
       +
           useACMEHost = "gaze.systems"; # TODO: write a module to define vhosts for subdomains

     

       88
       88
       +
           quic = true;

     

       89
       89
       +
           kTLS = true;

     

       90
       90
       +
           forceSSL = true;

     

       91
       91
       +
           locations."/" = {

     

       92
       92
       +
             proxyPass = "http://localhost:${toString port}";

     

       93
       93
       +
           };

     

       94
       94
       +
         };

     

       95
       95
       +
       

     

       96
       96
       +
         # scrape perses metrics

     

       97
       97
       +
         services.victoriametrics.prometheusConfig.scrape_configs = [

     

       98
       98
       +
           {

     

       99
       99
       +
             job_name = "perses";

     

       100
       100
       +
             metrics_path = "/metrics";

     

       101
       101
       +
             static_configs = [ { targets = [ "localhost:${toString port}" ]; } ];

     

       102
       102
       +
           }

     

       103
       103
       +
         ];

     

       104
       104
       +
       }

+3

hosts/trimounts/modules/perses.nix/provision/1-private-infra.yaml

···

       1
       1
       +
       kind: Project

     

       2
       2
       +
       metadata:

     

       3
       3
       +
         name: private-infra

+9

hosts/trimounts/modules/perses.nix/provision/2-admin-role.yaml

···

       1
       1
       +
       - kind: GlobalRole

     

       2
       2
       +
         metadata:

     

       3
       3
       +
           name: admin

     

       4
       4
       +
         spec:

     

       5
       5
       +
           permissions:

     

       6
       6
       +
           - actions:

     

       7
       7
       +
             - '*'

     

       8
       8
       +
             scopes:

     

       9
       9
       +
             - '*'

+8

hosts/trimounts/modules/perses.nix/provision/3-admin-bind-role.yaml

···

       1
       1
       +
       - kind: GlobalRoleBinding

     

       2
       2
       +
         metadata:

     

       3
       3
       +
           name: admin

     

       4
       4
       +
         spec:

     

       5
       5
       +
           role: admin

     

       6
       6
       +
           subjects:

     

       7
       7
       +
           - kind: User

     

       8
       8
       +
             name: 90008

+12

hosts/trimounts/modules/perses.nix/provision/4-victoria.yaml

···

       1
       1
       +
       - kind: GlobalDatasource

     

       2
       2
       +
         metadata:

     

       3
       3
       +
           name: victoria

     

       4
       4
       +
         spec:

     

       5
       5
       +
           default: true

     

       6
       6
       +
           plugin:

     

       7
       7
       +
             kind: PrometheusDatasource

     

       8
       8
       +
             spec:

     

       9
       9
       +
               proxy:

     

       10
       10
       +
                 kind: HTTPProxy

     

       11
       11
       +
                 spec:

     

       12
       12
       +
                   url: http://localhost:8428

+12

hosts/trimounts/modules/perses.nix/provision/6-guest-role.yaml

···

       1
       1
       +
       - kind: GlobalRole

     

       2
       2
       +
         metadata:

     

       3
       3
       +
           name: guest

     

       4
       4
       +
         spec:

     

       5
       5
       +
           permissions:

     

       6
       6
       +
           - actions:

     

       7
       7
       +
             - 'read'

     

       8
       8
       +
             scopes:

     

       9
       9
       +
             - 'Dashboard'

     

       10
       10
       +
             - 'Project'

     

       11
       11
       +
             - 'Datasource'

     

       12
       12
       +
             - 'GlobalDatasource'

+8

hosts/trimounts/modules/perses.nix/provision/7-guest-role-bind.yaml

···

       1
       1
       +
       - kind: GlobalRoleBinding

     

       2
       2
       +
         metadata:

     

       3
       3
       +
           name: guest

     

       4
       4
       +
         spec:

     

       5
       5
       +
           role: guest

     

       6
       6
       +
           subjects:

     

       7
       7
       +
           - kind: User

     

       8
       8
       +
             name: sorryu02

+454

hosts/trimounts/modules/perses.nix/provision/90-wolumonde.yaml

···

       1
       1
       +
       kind: Dashboard

     

       2
       2
       +
       metadata:

     

       3
       3
       +
           name: wolumonde

     

       4
       4
       +
           createdAt: 0001-01-01T00:00:00Z

     

       5
       5
       +
           updatedAt: 0001-01-01T00:00:00Z

     

       6
       6
       +
           version: 0

     

       7
       7
       +
           project: private-infra

     

       8
       8
       +
       spec:

     

       9
       9
       +
           panels:

     

       10
       10
       +
               "0_0":

     

       11
       11
       +
                   kind: Panel

     

       12
       12
       +
                   spec:

     

       13
       13
       +
                       display:

     

       14
       14
       +
                           name: load over 5 min

     

       15
       15
       +
                       plugin:

     

       16
       16
       +
                           kind: GaugeChart

     

       17
       17
       +
                           spec:

     

       18
       18
       +
                               calculation: mean

     

       19
       19
       +
                               format:

     

       20
       20
       +
                                   unit: percent

     

       21
       21
       +
                               max: 100

     

       22
       22
       +
                       queries:

     

       23
       23
       +
                           - kind: TimeSeriesQuery

     

       24
       24
       +
                             spec:

     

       25
       25
       +
                               plugin:

     

       26
       26
       +
                                   kind: PrometheusTimeSeriesQuery

     

       27
       27
       +
                                   spec:

     

       28
       28
       +
                                       query: node_load5 * 100 / count(count(node_cpu_seconds_total) by (cpu))

     

       29
       29
       +
                                       seriesNameFormat: load %

     

       30
       30
       +
               "0_1":

     

       31
       31
       +
                   kind: Panel

     

       32
       32
       +
                   spec:

     

       33
       33
       +
                       display:

     

       34
       34
       +
                           name: cpu usage

     

       35
       35
       +
                       plugin:

     

       36
       36
       +
                           kind: GaugeChart

     

       37
       37
       +
                           spec:

     

       38
       38
       +
                               calculation: mean

     

       39
       39
       +
                               format:

     

       40
       40
       +
                                   unit: percent

     

       41
       41
       +
                               max: 100

     

       42
       42
       +
                       queries:

     

       43
       43
       +
                           - kind: TimeSeriesQuery

     

       44
       44
       +
                             spec:

     

       45
       45
       +
                               plugin:

     

       46
       46
       +
                                   kind: PrometheusTimeSeriesQuery

     

       47
       47
       +
                                   spec:

     

       48
       48
       +
                                       query: sum by (cpu) (rate(node_cpu_seconds_total{mode=~"user|system"}[1m])) * 100

     

       49
       49
       +
                                       seriesNameFormat: cpu {{cpu}}

     

       50
       50
       +
               "0_2":

     

       51
       51
       +
                   kind: Panel

     

       52
       52
       +
                   spec:

     

       53
       53
       +
                       display:

     

       54
       54
       +
                           name: memory usage

     

       55
       55
       +
                       plugin:

     

       56
       56
       +
                           kind: GaugeChart

     

       57
       57
       +
                           spec:

     

       58
       58
       +
                               calculation: mean

     

       59
       59
       +
                               format:

     

       60
       60
       +
                                   unit: percent

     

       61
       61
       +
                               max: 100

     

       62
       62
       +
                       queries:

     

       63
       63
       +
                           - kind: TimeSeriesQuery

     

       64
       64
       +
                             spec:

     

       65
       65
       +
                               plugin:

     

       66
       66
       +
                                   kind: PrometheusTimeSeriesQuery

     

       67
       67
       +
                                   spec:

     

       68
       68
       +
                                       query: (node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes) * 100 / node_memory_MemTotal_bytes

     

       69
       69
       +
                                       seriesNameFormat: memory usage %

     

       70
       70
       +
               "0_3":

     

       71
       71
       +
                   kind: Panel

     

       72
       72
       +
                   spec:

     

       73
       73
       +
                       display:

     

       74
       74
       +
                           name: disk usage /

     

       75
       75
       +
                       plugin:

     

       76
       76
       +
                           kind: GaugeChart

     

       77
       77
       +
                           spec:

     

       78
       78
       +
                               calculation: last

     

       79
       79
       +
                               format:

     

       80
       80
       +
                                   unit: percent

     

       81
       81
       +
                               max: 100

     

       82
       82
       +
                       queries:

     

       83
       83
       +
                           - kind: TimeSeriesQuery

     

       84
       84
       +
                             spec:

     

       85
       85
       +
                               plugin:

     

       86
       86
       +
                                   kind: PrometheusTimeSeriesQuery

     

       87
       87
       +
                                   spec:

     

       88
       88
       +
                                       query: (node_filesystem_size_bytes{mountpoint="/"} - node_filesystem_free_bytes{mountpoint="/"}) * 100 / node_filesystem_size_bytes{mountpoint="/"}

     

       89
       89
       +
                                       seriesNameFormat: disk usage %

     

       90
       90
       +
               "0_4":

     

       91
       91
       +
                   kind: Panel

     

       92
       92
       +
                   spec:

     

       93
       93
       +
                       display:

     

       94
       94
       +
                           name: load over 5 min

     

       95
       95
       +
                       plugin:

     

       96
       96
       +
                           kind: TimeSeriesChart

     

       97
       97
       +
                           spec:

     

       98
       98
       +
                               yAxis:

     

       99
       99
       +
                                   max: 2

     

       100
       100
       +
                       queries:

     

       101
       101
       +
                           - kind: TimeSeriesQuery

     

       102
       102
       +
                             spec:

     

       103
       103
       +
                               plugin:

     

       104
       104
       +
                                   kind: PrometheusTimeSeriesQuery

     

       105
       105
       +
                                   spec:

     

       106
       106
       +
                                       query: node_load5

     

       107
       107
       +
                                       seriesNameFormat: load

     

       108
       108
       +
               "0_5":

     

       109
       109
       +
                   kind: Panel

     

       110
       110
       +
                   spec:

     

       111
       111
       +
                       display:

     

       112
       112
       +
                           name: cpu usage

     

       113
       113
       +
                       plugin:

     

       114
       114
       +
                           kind: TimeSeriesChart

     

       115
       115
       +
                           spec:

     

       116
       116
       +
                               yAxis:

     

       117
       117
       +
                                   format:

     

       118
       118
       +
                                       unit: percent

     

       119
       119
       +
                                   max: 100

     

       120
       120
       +
                       queries:

     

       121
       121
       +
                           - kind: TimeSeriesQuery

     

       122
       122
       +
                             spec:

     

       123
       123
       +
                               plugin:

     

       124
       124
       +
                                   kind: PrometheusTimeSeriesQuery

     

       125
       125
       +
                                   spec:

     

       126
       126
       +
                                       query: sum by (cpu) (rate(node_cpu_seconds_total{mode=~"user|system"}[1m])) * 100

     

       127
       127
       +
                                       seriesNameFormat: cpu {{cpu}}

     

       128
       128
       +
               "0_6":

     

       129
       129
       +
                   kind: Panel

     

       130
       130
       +
                   spec:

     

       131
       131
       +
                       display:

     

       132
       132
       +
                           name: memory usage

     

       133
       133
       +
                       plugin:

     

       134
       134
       +
                           kind: TimeSeriesChart

     

       135
       135
       +
                           spec:

     

       136
       136
       +
                               yAxis:

     

       137
       137
       +
                                   format:

     

       138
       138
       +
                                       unit: bytes

     

       139
       139
       +
                                   max: 4e+09

     

       140
       140
       +
                       queries:

     

       141
       141
       +
                           - kind: TimeSeriesQuery

     

       142
       142
       +
                             spec:

     

       143
       143
       +
                               plugin:

     

       144
       144
       +
                                   kind: PrometheusTimeSeriesQuery

     

       145
       145
       +
                                   spec:

     

       146
       146
       +
                                       query: node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes

     

       147
       147
       +
                                       seriesNameFormat: current memory usage

     

       148
       148
       +
               "0_7":

     

       149
       149
       +
                   kind: Panel

     

       150
       150
       +
                   spec:

     

       151
       151
       +
                       display:

     

       152
       152
       +
                           name: disk usage /

     

       153
       153
       +
                       plugin:

     

       154
       154
       +
                           kind: TimeSeriesChart

     

       155
       155
       +
                           spec:

     

       156
       156
       +
                               yAxis:

     

       157
       157
       +
                                   format:

     

       158
       158
       +
                                       unit: bytes

     

       159
       159
       +
                                   max: 3.8e+10

     

       160
       160
       +
                       queries:

     

       161
       161
       +
                           - kind: TimeSeriesQuery

     

       162
       162
       +
                             spec:

     

       163
       163
       +
                               plugin:

     

       164
       164
       +
                                   kind: PrometheusTimeSeriesQuery

     

       165
       165
       +
                                   spec:

     

       166
       166
       +
                                       query: node_filesystem_size_bytes{mountpoint="/"} - node_filesystem_free_bytes{mountpoint="/"}

     

       167
       167
       +
                                       seriesNameFormat: disk usage

     

       168
       168
       +
               "1_0":

     

       169
       169
       +
                   kind: Panel

     

       170
       170
       +
                   spec:

     

       171
       171
       +
                       display:

     

       172
       172
       +
                           name: nginx requests / min

     

       173
       173
       +
                       plugin:

     

       174
       174
       +
                           kind: TimeSeriesChart

     

       175
       175
       +
                           spec:

     

       176
       176
       +
                               legend:

     

       177
       177
       +
                                   position: bottom

     

       178
       178
       +
                                   size: small

     

       179
       179
       +
                               yAxis:

     

       180
       180
       +
                                   format:

     

       181
       181
       +
                                       unit: decimal

     

       182
       182
       +
                               visual:

     

       183
       183
       +
                                   display: bar

     

       184
       184
       +
                                   palette:

     

       185
       185
       +
                                       mode: categorical

     

       186
       186
       +
                                   stack: all

     

       187
       187
       +
                       queries:

     

       188
       188
       +
                           - kind: TimeSeriesQuery

     

       189
       189
       +
                             spec:

     

       190
       190
       +
                               plugin:

     

       191
       191
       +
                                   kind: PrometheusTimeSeriesQuery

     

       192
       192
       +
                                   spec:

     

       193
       193
       +
                                       query: nginx_request_count

     

       194
       194
       +
                                       seriesNameFormat: '{{res.statusCode}}'

     

       195
       195
       +
               "1_1":

     

       196
       196
       +
                   kind: Panel

     

       197
       197
       +
                   spec:

     

       198
       198
       +
                       display:

     

       199
       199
       +
                           name: nginx latency / min

     

       200
       200
       +
                       plugin:

     

       201
       201
       +
                           kind: TimeSeriesChart

     

       202
       202
       +
                           spec:

     

       203
       203
       +
                               yAxis:

     

       204
       204
       +
                                   format:

     

       205
       205
       +
                                       unit: seconds

     

       206
       206
       +
                                   max: 0.5

     

       207
       207
       +
                       queries:

     

       208
       208
       +
                           - kind: TimeSeriesQuery

     

       209
       209
       +
                             spec:

     

       210
       210
       +
                               plugin:

     

       211
       211
       +
                                   kind: PrometheusTimeSeriesQuery

     

       212
       212
       +
                                   spec:

     

       213
       213
       +
                                       query: nginx_request_latency

     

       214
       214
       +
                                       seriesNameFormat: '{{stats_result}}'

     

       215
       215
       +
               "2_0":

     

       216
       216
       +
                   kind: Panel

     

       217
       217
       +
                   spec:

     

       218
       218
       +
                       display:

     

       219
       219
       +
                           name: pds requests / min

     

       220
       220
       +
                       plugin:

     

       221
       221
       +
                           kind: TimeSeriesChart

     

       222
       222
       +
                           spec:

     

       223
       223
       +
                               legend:

     

       224
       224
       +
                                   position: bottom

     

       225
       225
       +
                                   size: small

     

       226
       226
       +
                               yAxis:

     

       227
       227
       +
                                   format:

     

       228
       228
       +
                                       unit: decimal

     

       229
       229
       +
                               visual:

     

       230
       230
       +
                                   display: bar

     

       231
       231
       +
                                   palette:

     

       232
       232
       +
                                       mode: categorical

     

       233
       233
       +
                                   stack: all

     

       234
       234
       +
                       queries:

     

       235
       235
       +
                           - kind: TimeSeriesQuery

     

       236
       236
       +
                             spec:

     

       237
       237
       +
                               plugin:

     

       238
       238
       +
                                   kind: PrometheusTimeSeriesQuery

     

       239
       239
       +
                                   spec:

     

       240
       240
       +
                                       query: pds_request_count

     

       241
       241
       +
                                       seriesNameFormat: '{{res.statusCode}}'

     

       242
       242
       +
               "2_1":

     

       243
       243
       +
                   kind: Panel

     

       244
       244
       +
                   spec:

     

       245
       245
       +
                       display:

     

       246
       246
       +
                           name: pds latency / min

     

       247
       247
       +
                       plugin:

     

       248
       248
       +
                           kind: TimeSeriesChart

     

       249
       249
       +
                           spec:

     

       250
       250
       +
                               yAxis:

     

       251
       251
       +
                                   format:

     

       252
       252
       +
                                       unit: milliseconds

     

       253
       253
       +
                                   max: 500

     

       254
       254
       +
                       queries:

     

       255
       255
       +
                           - kind: TimeSeriesQuery

     

       256
       256
       +
                             spec:

     

       257
       257
       +
                               plugin:

     

       258
       258
       +
                                   kind: PrometheusTimeSeriesQuery

     

       259
       259
       +
                                   spec:

     

       260
       260
       +
                                       query: pds_response_latency

     

       261
       261
       +
                                       seriesNameFormat: '{{stats_result}}'

     

       262
       262
       +
               "3_0":

     

       263
       263
       +
                   kind: Panel

     

       264
       264
       +
                   spec:

     

       265
       265
       +
                       display:

     

       266
       266
       +
                           name: gazesys visits

     

       267
       267
       +
                       plugin:

     

       268
       268
       +
                           kind: BarChart

     

       269
       269
       +
                           spec:

     

       270
       270
       +
                               calculation: last

     

       271
       271
       +
                       queries:

     

       272
       272
       +
                           - kind: TimeSeriesQuery

     

       273
       273
       +
                             spec:

     

       274
       274
       +
                               plugin:

     

       275
       275
       +
                                   kind: PrometheusTimeSeriesQuery

     

       276
       276
       +
                                   spec:

     

       277
       277
       +
                                       query: gazesys_visit_real_total + gazesys_visit_fake_total

     

       278
       278
       +
                                       seriesNameFormat: total visits

     

       279
       279
       +
                           - kind: TimeSeriesQuery

     

       280
       280
       +
                             spec:

     

       281
       281
       +
                               plugin:

     

       282
       282
       +
                                   kind: PrometheusTimeSeriesQuery

     

       283
       283
       +
                                   spec:

     

       284
       284
       +
                                       query: gazesys_visit_fake_total

     

       285
       285
       +
                                       seriesNameFormat: (ai) bot visits

     

       286
       286
       +
                           - kind: TimeSeriesQuery

     

       287
       287
       +
                             spec:

     

       288
       288
       +
                               plugin:

     

       289
       289
       +
                                   kind: PrometheusTimeSeriesQuery

     

       290
       290
       +
                                   spec:

     

       291
       291
       +
                                       query: gazesys_visit_real_total

     

       292
       292
       +
                                       seriesNameFormat: real visits

     

       293
       293
       +
               "3_1":

     

       294
       294
       +
                   kind: Panel

     

       295
       295
       +
                   spec:

     

       296
       296
       +
                       display:

     

       297
       297
       +
                           name: gazesys pet

     

       298
       298
       +
                       plugin:

     

       299
       299
       +
                           kind: StatChart

     

       300
       300
       +
                           spec:

     

       301
       301
       +
                               calculation: last

     

       302
       302
       +
                               format:

     

       303
       303
       +
                                   unit: decimal

     

       304
       304
       +
                                   shortValues: true

     

       305
       305
       +
                       queries:

     

       306
       306
       +
                           - kind: TimeSeriesQuery

     

       307
       307
       +
                             spec:

     

       308
       308
       +
                               plugin:

     

       309
       309
       +
                                   kind: PrometheusTimeSeriesQuery

     

       310
       310
       +
                                   spec:

     

       311
       311
       +
                                       query: gazesys_pet_bounce_total

     

       312
       312
       +
                                       seriesNameFormat: bounce count

     

       313
       313
       +
                           - kind: TimeSeriesQuery

     

       314
       314
       +
                             spec:

     

       315
       315
       +
                               plugin:

     

       316
       316
       +
                                   kind: PrometheusTimeSeriesQuery

     

       317
       317
       +
                                   spec:

     

       318
       318
       +
                                       query: gazesys_pet_distance_total

     

       319
       319
       +
                                       seriesNameFormat: distance travelled

     

       320
       320
       +
               "4_0":

     

       321
       321
       +
                   kind: Panel

     

       322
       322
       +
                   spec:

     

       323
       323
       +
                       display:

     

       324
       324
       +
                           name: anubis policy actions

     

       325
       325
       +
                       plugin:

     

       326
       326
       +
                           kind: BarChart

     

       327
       327
       +
                           spec:

     

       328
       328
       +
                               calculation: last

     

       329
       329
       +
                       queries:

     

       330
       330
       +
                           - kind: TimeSeriesQuery

     

       331
       331
       +
                             spec:

     

       332
       332
       +
                               plugin:

     

       333
       333
       +
                                   kind: PrometheusTimeSeriesQuery

     

       334
       334
       +
                                   spec:

     

       335
       335
       +
                                       query: anubis_policy_results

     

       336
       336
       +
                                       seriesNameFormat: '{{action}}: {{rule}}'

     

       337
       337
       +
           layouts:

     

       338
       338
       +
               - kind: Grid

     

       339
       339
       +
                 spec:

     

       340
       340
       +
                   display:

     

       341
       341
       +
                       title: resource usage

     

       342
       342
       +
                   items:

     

       343
       343
       +
                       - x: 0

     

       344
       344
       +
                         "y": 0

     

       345
       345
       +
                         width: 6

     

       346
       346
       +
                         height: 6

     

       347
       347
       +
                         content:

     

       348
       348
       +
                           $ref: '#/spec/panels/0_0'

     

       349
       349
       +
                       - x: 6

     

       350
       350
       +
                         "y": 0

     

       351
       351
       +
                         width: 6

     

       352
       352
       +
                         height: 6

     

       353
       353
       +
                         content:

     

       354
       354
       +
                           $ref: '#/spec/panels/0_1'

     

       355
       355
       +
                       - x: 12

     

       356
       356
       +
                         "y": 0

     

       357
       357
       +
                         width: 6

     

       358
       358
       +
                         height: 6

     

       359
       359
       +
                         content:

     

       360
       360
       +
                           $ref: '#/spec/panels/0_2'

     

       361
       361
       +
                       - x: 18

     

       362
       362
       +
                         "y": 0

     

       363
       363
       +
                         width: 6

     

       364
       364
       +
                         height: 6

     

       365
       365
       +
                         content:

     

       366
       366
       +
                           $ref: '#/spec/panels/0_3'

     

       367
       367
       +
                       - x: 0

     

       368
       368
       +
                         "y": 6

     

       369
       369
       +
                         width: 6

     

       370
       370
       +
                         height: 6

     

       371
       371
       +
                         content:

     

       372
       372
       +
                           $ref: '#/spec/panels/0_4'

     

       373
       373
       +
                       - x: 6

     

       374
       374
       +
                         "y": 6

     

       375
       375
       +
                         width: 6

     

       376
       376
       +
                         height: 6

     

       377
       377
       +
                         content:

     

       378
       378
       +
                           $ref: '#/spec/panels/0_5'

     

       379
       379
       +
                       - x: 12

     

       380
       380
       +
                         "y": 6

     

       381
       381
       +
                         width: 6

     

       382
       382
       +
                         height: 6

     

       383
       383
       +
                         content:

     

       384
       384
       +
                           $ref: '#/spec/panels/0_6'

     

       385
       385
       +
                       - x: 18

     

       386
       386
       +
                         "y": 6

     

       387
       387
       +
                         width: 6

     

       388
       388
       +
                         height: 6

     

       389
       389
       +
                         content:

     

       390
       390
       +
                           $ref: '#/spec/panels/0_7'

     

       391
       391
       +
               - kind: Grid

     

       392
       392
       +
                 spec:

     

       393
       393
       +
                   display:

     

       394
       394
       +
                       title: nginx metrics

     

       395
       395
       +
                   items:

     

       396
       396
       +
                       - x: 0

     

       397
       397
       +
                         "y": 0

     

       398
       398
       +
                         width: 8

     

       399
       399
       +
                         height: 6

     

       400
       400
       +
                         content:

     

       401
       401
       +
                           $ref: '#/spec/panels/1_0'

     

       402
       402
       +
                       - x: 8

     

       403
       403
       +
                         "y": 0

     

       404
       404
       +
                         width: 8

     

       405
       405
       +
                         height: 6

     

       406
       406
       +
                         content:

     

       407
       407
       +
                           $ref: '#/spec/panels/1_1'

     

       408
       408
       +
               - kind: Grid

     

       409
       409
       +
                 spec:

     

       410
       410
       +
                   display:

     

       411
       411
       +
                       title: pds metrics

     

       412
       412
       +
                   items:

     

       413
       413
       +
                       - x: 0

     

       414
       414
       +
                         "y": 0

     

       415
       415
       +
                         width: 8

     

       416
       416
       +
                         height: 6

     

       417
       417
       +
                         content:

     

       418
       418
       +
                           $ref: '#/spec/panels/2_0'

     

       419
       419
       +
                       - x: 8

     

       420
       420
       +
                         "y": 0

     

       421
       421
       +
                         width: 8

     

       422
       422
       +
                         height: 6

     

       423
       423
       +
                         content:

     

       424
       424
       +
                           $ref: '#/spec/panels/2_1'

     

       425
       425
       +
               - kind: Grid

     

       426
       426
       +
                 spec:

     

       427
       427
       +
                   display:

     

       428
       428
       +
                       title: gazesys

     

       429
       429
       +
                   items:

     

       430
       430
       +
                       - x: 0

     

       431
       431
       +
                         "y": 0

     

       432
       432
       +
                         width: 8

     

       433
       433
       +
                         height: 6

     

       434
       434
       +
                         content:

     

       435
       435
       +
                           $ref: '#/spec/panels/3_0'

     

       436
       436
       +
                       - x: 8

     

       437
       437
       +
                         "y": 0

     

       438
       438
       +
                         width: 8

     

       439
       439
       +
                         height: 6

     

       440
       440
       +
                         content:

     

       441
       441
       +
                           $ref: '#/spec/panels/3_1'

     

       442
       442
       +
               - kind: Grid

     

       443
       443
       +
                 spec:

     

       444
       444
       +
                   display:

     

       445
       445
       +
                       title: forgejo

     

       446
       446
       +
                   items:

     

       447
       447
       +
                       - x: 0

     

       448
       448
       +
                         "y": 0

     

       449
       449
       +
                         width: 8

     

       450
       450
       +
                         height: 6

     

       451
       451
       +
                         content:

     

       452
       452
       +
                           $ref: '#/spec/panels/4_0'

     

       453
       453
       +
           duration: 30m

     

       454
       454
       +
           refreshInterval: 1m

+6

hosts/trimounts/modules/tangled.nix/default.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         imports = [

     

       3
       3
       +
           ./knot.nix

     

       4
       4
       +
           ./spindle.nix

     

       5
       5
       +
         ];

     

       6
       6
       +
       }

+39

hosts/trimounts/modules/tangled.nix/knot.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         config,

     

       3
       3
       +
         inputs,

     

       4
       4
       +
         terra,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       let

     

       8
       8
       +
         knotCfg = config.services.tangled.knot;

     

       9
       9
       +
       in

     

       10
       10
       +
       {

     

       11
       11
       +
         imports = [

     

       12
       12
       +
           "${inputs.tangled}/nix/modules/knot.nix"

     

       13
       13
       +
         ];

     

       14
       14
       +
       

     

       15
       15
       +
         services.tangled.knot = {

     

       16
       16
       +
           enable = true;

     

       17
       17
       +
           package = terra.tangled-knot;

     

       18
       18
       +
           gitUser = "git";

     

       19
       19
       +
           motdFile = ./motd;

     

       20
       20
       +
           server = {

     

       21
       21
       +
             listenAddr = "0.0.0.0:7777";

     

       22
       22
       +
             hostname = "knot.gaze.systems";

     

       23
       23
       +
             owner = "did:plc:dfl62fgb7wtjj3fcbb72naae";

     

       24
       24
       +
           };

     

       25
       25
       +
         };

     

       26
       26
       +
       

     

       27
       27
       +
         security.acme.certs."gaze.systems".extraDomainNames = [ knotCfg.server.hostname ];

     

       28
       28
       +
       

     

       29
       29
       +
         services.nginx.virtualHosts.${knotCfg.server.hostname} = {

     

       30
       30
       +
           useACMEHost = "gaze.systems";

     

       31
       31
       +
           forceSSL = true;

     

       32
       32
       +
           quic = true;

     

       33
       33
       +
           kTLS = true;

     

       34
       34
       +
           locations."/" = {

     

       35
       35
       +
             proxyPass = "http://${knotCfg.server.listenAddr}";

     

       36
       36
       +
             proxyWebsockets = true;

     

       37
       37
       +
           };

     

       38
       38
       +
         };

     

       39
       39
       +
       }

+5

hosts/trimounts/modules/tangled.nix/motd

···

       1
       1
       +
       

     

       2
       2
       +
       ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓

     

       3
       3
       +
       ┃ *paws at your commits* arf :3c ┃

     

       4
       4
       +
       ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

     

       5
       5
       +

+64

hosts/trimounts/modules/tangled.nix/spindle.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         lib,

     

       3
       3
       +
         config,

     

       4
       4
       +
         inputs,

     

       5
       5
       +
         terra,

     

       6
       6
       +
         ...

     

       7
       7
       +
       }:

     

       8
       8
       +
       let

     

       9
       9
       +
         spindleCfg = config.services.tangled.spindle;

     

       10
       10
       +
       in

     

       11
       11
       +
       {

     

       12
       12
       +
         imports = [

     

       13
       13
       +
           "${inputs.tangled}/nix/modules/spindle.nix"

     

       14
       14
       +
         ];

     

       15
       15
       +
       

     

       16
       16
       +
         services.tangled.spindle = {

     

       17
       17
       +
           enable = true;

     

       18
       18
       +
           package = terra.tangled-spindle;

     

       19
       19
       +
           server = {

     

       20
       20
       +
             listenAddr = "0.0.0.0:7391";

     

       21
       21
       +
             hostname = "spindle.gaze.systems";

     

       22
       22
       +
             owner = "did:plc:dfl62fgb7wtjj3fcbb72naae";

     

       23
       23
       +
             # secrets = {

     

       24
       24
       +
             #   provider = "openbao";

     

       25
       25
       +
             #   openbao.proxyAddr = "http://spindle.bao.lan.gaze.systems";

     

       26
       26
       +
             # };

     

       27
       27
       +
             secrets.provider = "sqlite";

     

       28
       28
       +
           };

     

       29
       29
       +
         };

     

       30
       30
       +
         users.users.spindle = {

     

       31
       31
       +
           group = "spindle";

     

       32
       32
       +
           isSystemUser = true;

     

       33
       33
       +
         };

     

       34
       34
       +
         users.groups.spindle = { };

     

       35
       35
       +
         users.groups.podman.members = [ "spindle" ];

     

       36
       36
       +
         systemd.services.spindle = {

     

       37
       37
       +
           # after = lib.mkForce [ "network.target" "openbao-proxy-spindle.service" ];

     

       38
       38
       +
           serviceConfig = {

     

       39
       39
       +
             User = "spindle";

     

       40
       40
       +
             Group = "spindle";

     

       41
       41
       +
           };

     

       42
       42
       +
         };

     

       43
       43
       +
       

     

       44
       44
       +
         security.acme.certs."gaze.systems".extraDomainNames = [ spindleCfg.server.hostname ];

     

       45
       45
       +
       

     

       46
       46
       +
         services.nginx.virtualHosts.${spindleCfg.server.hostname} = {

     

       47
       47
       +
           useACMEHost = "gaze.systems";

     

       48
       48
       +
           forceSSL = true;

     

       49
       49
       +
           quic = true;

     

       50
       50
       +
           kTLS = true;

     

       51
       51
       +
           locations."/" = {

     

       52
       52
       +
             proxyPass = "http://${spindleCfg.server.listenAddr}";

     

       53
       53
       +
             proxyWebsockets = true;

     

       54
       54
       +
           };

     

       55
       55
       +
         };

     

       56
       56
       +
       

     

       57
       57
       +
         virtualisation.docker.enable = lib.mkForce false;

     

       58
       58
       +
         virtualisation.podman = {

     

       59
       59
       +
           enable = true;

     

       60
       60
       +
           autoPrune.enable = true;

     

       61
       61
       +
           dockerCompat = true;

     

       62
       62
       +
           dockerSocket.enable = true;

     

       63
       63
       +
         };

     

       64
       64
       +
       }

+85

hosts/trimounts/modules/website.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         config,

     

       3
       3
       +
         pkgs,

     

       4
       4
       +
         inputs,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       let

     

       8
       8
       +
         PUBLIC_BASE_URL = "https://gaze.systems";

     

       9
       9
       +
         modules = (pkgs.callPackage "${inputs.blog}/nix/modules.nix" { }).overrideAttrs (_: {

     

       10
       10
       +
           outputHash = "sha256-rzfSfiK8FSNFR+1QTwM/ltLZBprG9BoQsPmOt6IdXFc=";

     

       11
       11
       +
         });

     

       12
       12
       +
         pkg = pkgs.callPackage "${inputs.blog}/nix" {

     

       13
       13
       +
           inherit PUBLIC_BASE_URL;

     

       14
       14
       +
           gazesys-modules = modules;

     

       15
       15
       +
         };

     

       16
       16
       +
         port = 3003;

     

       17
       17
       +
       in

     

       18
       18
       +
       {

     

       19
       19
       +
         users.users.website = {

     

       20
       20
       +
           isSystemUser = true;

     

       21
       21
       +
           group = "website";

     

       22
       22
       +
         };

     

       23
       23
       +
         users.groups.website = { };

     

       24
       24
       +
       

     

       25
       25
       +
         age.secrets.websiteConfig.file = ../../../secrets/websiteConfig.age;

     

       26
       26
       +
       

     

       27
       27
       +
         systemd.services.website = {

     

       28
       28
       +
           description = "website";

     

       29
       29
       +
           wantedBy = [ "multi-user.target" ];

     

       30
       30
       +
           after = [ "network.target" ];

     

       31
       31
       +
           environment = {

     

       32
       32
       +
             HOME = "/var/lib/website";

     

       33
       33
       +
             ORIGIN = PUBLIC_BASE_URL;

     

       34
       34
       +
             PORT = toString port;

     

       35
       35
       +
             WEBSITE_DATA_DIR = "/var/lib/website";

     

       36
       36
       +
             VITE_CLOUDINARY_CLOUD_NAME = "dgtwf7mar";

     

       37
       37
       +
           };

     

       38
       38
       +
           serviceConfig = {

     

       39
       39
       +
             User = "website";

     

       40
       40
       +
             ExecStart = "${pkg}/bin/website";

     

       41
       41
       +
             Restart = "on-failure";

     

       42
       42
       +
             RestartSec = 5;

     

       43
       43
       +
             WorkingDirectory = "/var/lib/website";

     

       44
       44
       +
             EnvironmentFile = config.age.secrets.websiteConfig.path;

     

       45
       45
       +
             KillSignal = "SIGKILL";

     

       46
       46
       +
           };

     

       47
       47
       +
         };

     

       48
       48
       +
       

     

       49
       49
       +
         # systemd.services.annoy-keep-alive = {

     

       50
       50
       +
         #   description = "keeps annoy peer connection alive";

     

       51
       51
       +
         #   wantedBy = [ "multi-user.target" ];

     

       52
       52
       +
         #   after = [ "network.target" ];

     

       53
       53
       +
         #   serviceConfig = {

     

       54
       54
       +
         #     Type = "oneshot";

     

       55
       55
       +
         #     ExecStart = "${pkgs.curl}/bin/curl http://100.64.0.1:3111/";

     

       56
       56
       +
         #   };

     

       57
       57
       +
         # };

     

       58
       58
       +
         # systemd.timers.annoy-keep-alive.timerConfig = {

     

       59
       59
       +
         #   OnBootSec = "5 min";

     

       60
       60
       +
         #   OnUnitActiveSec = "5 min";

     

       61
       61
       +
         #   Unit = "annoy-keep-alive.service";

     

       62
       62
       +
         # };

     

       63
       63
       +
       

     

       64
       64
       +
         services.nginx.virtualHosts."gaze.systems" = {

     

       65
       65
       +
           locations."/".proxyPass = "http://localhost:${toString port}";

     

       66
       66
       +
           locations."/annoy/ws/" = {

     

       67
       67
       +
             proxyWebsockets = true;

     

       68
       68
       +
             proxyPass = "http://100.64.0.9:3111/";

     

       69
       69
       +
             extraConfig = ''

     

       70
       70
       +
               rewrite ^/annoy/ws/(.*) /$1 break;

     

       71
       71
       +
             '';

     

       72
       72
       +
           };

     

       73
       73
       +
           locations."/annoy/ws" = {

     

       74
       74
       +
             proxyWebsockets = true;

     

       75
       75
       +
             proxyPass = "http://100.64.0.9:3111/";

     

       76
       76
       +
             extraConfig = ''

     

       77
       77
       +
               rewrite ^/annoy/ws(.*) /$1 break;

     

       78
       78
       +
             '';

     

       79
       79
       +
           };

     

       80
       80
       +
         };

     

       81
       81
       +
       

     

       82
       82
       +
         services.nginx.virtualHosts."poor.dog" = {

     

       83
       83
       +
           locations."/".return = "301 https://gaze.systems$request_uri";

     

       84
       84
       +
         };

     

       85
       85
       +
       }

+28

hosts/wolumonde/modules/arpa.disabled

···

       1
       1
       +
       { pkgs, ... }:

     

       2
       2
       +
       let

     

       3
       3
       +
         index = pkgs.writeText "index.txt" ''

     

       4
       4
       +
           hi there~

     

       5
       5
       +
       

     

       6
       6
       +
           you are currently interfacing with one of the data endpoints

     

       7
       7
       +
           of entity with serial id /90008/. you may want to open a

     

       8
       8
       +
           connection to https://gaze.systems/about for more data.

     

       9
       9
       +
       

     

       10
       10
       +
           /discord           90.008/

     

       11
       11
       +
           /bsky           @poor.dog/

     

       12
       12
       +
           /email 90008@gaze.systems/

     

       13
       13
       +
       

     

       14
       14
       +
           /dig +short TXT 9.0.0.0.8.e.f.1.5.0.7.4.0.1.0.0.2.ip6.arpa/

     

       15
       15
       +
         '';

     

       16
       16
       +
         root = pkgs.runCommand "root" { } ''

     

       17
       17
       +
           mkdir -p $out

     

       18
       18
       +
           ln -s ${index} $out/index.txt

     

       19
       19
       +
         '';

     

       20
       20
       +
       in

     

       21
       21
       +
       {

     

       22
       22
       +
         services.nginx.virtualHosts."9.0.0.0.8.e.f.1.5.0.7.4.0.1.0.0.2.ip6.arpa" = {

     

       23
       23
       +
           inherit root;

     

       24
       24
       +
           locations."/".index = "index.txt";

     

       25
       25
       +
           quic = true;

     

       26
       26
       +
           kTLS = true;

     

       27
       27
       +
         };

     

       28
       28
       +
       }

hosts/wolumonde/modules/arpa.nix hosts/trimounts/modules/arpa.nix

hosts/wolumonde/modules/atproto.nix hosts/wolumonde/modules/atproto.disabled

+2

hosts/wolumonde/modules/blog.nix hosts/wolumonde/modules/website.nix

···

       22
       22
        
         };

     

       23
       23
        
         users.groups.website = { };

     

       24
       24
        
       

     

       25
       25
       +
         age.secrets.websiteConfig.file = ../../../secrets/websiteConfig.age;

     

       26
       26
       +
       

     

       25
       27
        
         systemd.services.website = {

     

       26
       28
        
           description = "website";

     

       27
       29
        
           wantedBy = [ "multi-user.target" ];

+29

hosts/wolumonde/modules/clickee-proxy.disabled

···

       1
       1
       +
       { config, terra, ... }:

     

       2
       2
       +
       let

     

       3
       3
       +
         port = 7145;

     

       4
       4
       +
       in

     

       5
       5
       +
       {

     

       6
       6
       +
         age.secrets.clickeeProxyConfig = {

     

       7
       7
       +
           file = ../../../secrets/clickeeProxyConfig.age;

     

       8
       8
       +
         };

     

       9
       9
       +
       

     

       10
       10
       +
         systemd.services.clickee-proxy = {

     

       11
       11
       +
           description = "clickee-proxy";

     

       12
       12
       +
           wantedBy = [ "multi-user.target" ];

     

       13
       13
       +
           after = [ "network.target" ];

     

       14
       14
       +
           environment = {

     

       15
       15
       +
             PORT = toString port;

     

       16
       16
       +
           };

     

       17
       17
       +
           serviceConfig = {

     

       18
       18
       +
             DynamicUser = true;

     

       19
       19
       +
             ExecStart = "${terra.clickee-proxy}/bin/clickee-proxy";

     

       20
       20
       +
             Restart = "on-failure";

     

       21
       21
       +
             RestartSec = 5;

     

       22
       22
       +
             EnvironmentFile = config.age.secrets.clickeeProxyConfig.path;

     

       23
       23
       +
           };

     

       24
       24
       +
         };

     

       25
       25
       +
       

     

       26
       26
       +
         services.nginx.virtualHosts."poor.dog" = {

     

       27
       27
       +
           locations."/click".proxyPass = "http://localhost:${toString port}";

     

       28
       28
       +
         };

     

       29
       29
       +
       }

hosts/wolumonde/modules/clickee-proxy.nix hosts/trimounts/modules/clickee-proxy.nix

hosts/wolumonde/modules/email.nix hosts/wolumonde/modules/email.disabled

+33

hosts/wolumonde/modules/fluentbit.disabled

···

       1
       1
       +
       {

     

       2
       2
       +
         pkgs,

     

       3
       3
       +
         config,

     

       4
       4
       +
         lib,

     

       5
       5
       +
         ...

     

       6
       6
       +
       }:

     

       7
       7
       +
       {

     

       8
       8
       +
         services.fluent-bit = {

     

       9
       9
       +
           enable = true;

     

       10
       10
       +
           settings = {

     

       11
       11
       +
             service.flush = 1;

     

       12
       12
       +
             pipeline.inputs = [

     

       13
       13
       +
               {

     

       14
       14
       +
                 name = "node_exporter_metrics";

     

       15
       15
       +
                 tag = "metrics.node";

     

       16
       16
       +
                 scrape_interval = 5;

     

       17
       17
       +
               }

     

       18
       18
       +
               # {

     

       19
       19
       +
               #   name = "dummy";

     

       20
       20
       +
               #   tag = "logs.dummy";

     

       21
       21
       +
               #   dummy = ''{"_msg": "dummy"}'';

     

       22
       22
       +
               # }

     

       23
       23
       +
               {

     

       24
       24
       +
                 name = "fluentbit_metrics";

     

       25
       25
       +
                 tag = "metrics.fluentbit";

     

       26
       26
       +
                 scrape_interval = 5;

     

       27
       27
       +
               }

     

       28
       28
       +
             ];

     

       29
       29
       +
           };

     

       30
       30
       +
         };

     

       31
       31
       +
       

     

       32
       32
       +
         systemd.services.fluent-bit.serviceConfig.StateDirectory = "fluent-bit";

     

       33
       33
       +
       }

hosts/wolumonde/modules/fluentbit.nix hosts/trimounts/modules/fluentbit.nix

hosts/wolumonde/modules/forgejo.nix/default.nix hosts/wolumonde/modules/forgejo.disabled/default.nix

hosts/wolumonde/modules/forgejo.nix/public/assets/css/theme-edge-dark.css hosts/wolumonde/modules/forgejo.disabled/public/assets/css/theme-edge-dark.css

hosts/wolumonde/modules/forgejo.nix/public/assets/fonts/comic.woff2 hosts/wolumonde/modules/forgejo.disabled/public/assets/fonts/comic.woff2

hosts/wolumonde/modules/forgejo.nix/public/assets/fonts/comicbd.woff2 hosts/wolumonde/modules/forgejo.disabled/public/assets/fonts/comicbd.woff2

hosts/wolumonde/modules/forgejo.nix/public/assets/fonts/comici.woff2 hosts/wolumonde/modules/forgejo.disabled/public/assets/fonts/comici.woff2

hosts/wolumonde/modules/forgejo.nix/public/assets/img/favicon.png hosts/wolumonde/modules/forgejo.disabled/public/assets/img/favicon.png

hosts/wolumonde/modules/forgejo.nix/public/assets/img/grrr.webp hosts/wolumonde/modules/forgejo.disabled/public/assets/img/grrr.webp

hosts/wolumonde/modules/forgejo.nix/public/assets/img/logo.png hosts/wolumonde/modules/forgejo.disabled/public/assets/img/logo.png

hosts/wolumonde/modules/forgejo.nix/public/assets/img/wecode.gif hosts/wolumonde/modules/forgejo.disabled/public/assets/img/wecode.gif

hosts/wolumonde/modules/forgejo.nix/templates/base/head.tmpl hosts/wolumonde/modules/forgejo.disabled/templates/base/head.tmpl

hosts/wolumonde/modules/forgejo.nix/templates/base/head_navbar.tmpl hosts/wolumonde/modules/forgejo.disabled/templates/base/head_navbar.tmpl

hosts/wolumonde/modules/forgejo.nix/templates/home.tmpl hosts/wolumonde/modules/forgejo.disabled/templates/home.tmpl

+28

hosts/wolumonde/modules/hedgedoc.disabled

···

       1
       1
       +
       { config, ... }:

     

       2
       2
       +
       let

     

       3
       3
       +
         cfg = config.services.hedgedoc.settings;

     

       4
       4
       +
       in

     

       5
       5
       +
       {

     

       6
       6
       +
         services.hedgedoc = {

     

       7
       7
       +
           enable = true;

     

       8
       8
       +
           settings = {

     

       9
       9
       +
             port = 3333;

     

       10
       10
       +
             domain = "doc.gaze.systems";

     

       11
       11
       +
             protocolUseSSL = true;

     

       12
       12
       +
             allowEmailRegister = false;

     

       13
       13
       +
             allowAnonymous = false;

     

       14
       14
       +
             allowAnonymousEdits = true;

     

       15
       15
       +
             allowFreeURL = true;

     

       16
       16
       +
             requireFreeURLAuthentication = true;

     

       17
       17
       +
           };

     

       18
       18
       +
         };

     

       19
       19
       +
       

     

       20
       20
       +
         security.acme.certs."gaze.systems".extraDomainNames = [ cfg.domain ];

     

       21
       21
       +
         services.nginx.virtualHosts.${cfg.domain} = {

     

       22
       22
       +
           useACMEHost = "gaze.systems";

     

       23
       23
       +
           forceSSL = true;

     

       24
       24
       +
           quic = true;

     

       25
       25
       +
           kTLS = true;

     

       26
       26
       +
           locations."/".proxyPass = "http://${cfg.host}:${toString cfg.port}";

     

       27
       27
       +
         };

     

       28
       28
       +
       }

hosts/wolumonde/modules/hedgedoc.nix hosts/trimounts/modules/hedgedoc.nix

hosts/wolumonde/modules/limbusart.nix hosts/wolumonde/modules/limbusart.disabled

+67 -61

hosts/wolumonde/modules/nginx.nix

···

       1
       1
        
       {

     

       2
       2
       +
         config,

     

       2
       3
        
         lib,

     

       3
       4
        
         inputs,

     

       4
       4
       -
         pkgs,

     

       5
       5
        
         ...

     

       6
       6
        
       }:

     

       7
       7
        
       {

     

       8
       8
        
         services.nginx = {

     

       9
       9
        
           enable = true;

     

       10
       10
       -
           package = pkgs.nginxQuic;

     

       11
       10
        
           recommendedTlsSettings = true;

     

       12
       11
        
           recommendedOptimisation = true;

     

       13
       12
        
           recommendedGzipSettings = true;

     
···

       40
       39
        
       

     

       41
       40
        
         users.users.nginx.extraGroups = [ "acme" ];

     

       42
       41
        
       

     

       42
       42
       +
         age.secrets.cfDnsEditToken.file = ../../../secrets/cloudflareDnsEdit.age;

     

       43
       43
        
         security.acme = {

     

       44
       44
        
           acceptTerms = true;

     

       45
       45
       -
           defaults.email = (import "${inputs.self}/personal.nix").emails.primary;

     

       46
       46
       -
           defaults.webroot = "/var/lib/acme/acme-challenge";

     

       45
       45
       +
           defaults = {

     

       46
       46
       +
             group = "nginx";

     

       47
       47
       +
             email = (import "${inputs.self}/personal.nix").emails.primary;

     

       48
       48
       +
             dnsProvider = "cloudflare";

     

       49
       49
       +
             credentialFiles = {

     

       50
       50
       +
               CF_DNS_API_TOKEN_FILE = config.age.secrets.cfDnsEditToken.path;

     

       51
       51
       +
             };

     

       52
       52
       +
           };

     

       47
       53
        
           certs."poor.dog" = { };

     

       48
       54
        
           certs."ptr.pet" = { };

     

       49
       55
        
           certs."gaze.systems" = { };

     
···

       67
       73
        
           forceSSL = true;

     

       68
       74
        
         };

     

       69
       75
        
       

     

       70
       70
       -
         services.fluent-bit.settings = {

     

       71
       71
       -
           parsers = [

     

       72
       72
       -
             {

     

       73
       73
       -
               name = "nginx_json";

     

       74
       74
       -
               format = "json";

     

       75
       75
       -
               time_key = "time";

     

       76
       76
       -
               time_format = "%d/%b/%Y:%H:%M:%S %z";

     

       77
       77
       -
             }

     

       78
       78
       -
           ];

     

       79
       79
       -
           pipeline = {

     

       80
       80
       -
             inputs = [

     

       81
       81
       -
               {

     

       82
       82
       -
                 name = "nginx_metrics";

     

       83
       83
       -
                 tag = "metrics.nginx";

     

       84
       84
       -
                 status_url = "/nginx_status";

     

       85
       85
       -
                 nginx_plus = false;

     

       86
       86
       -
               }

     

       87
       87
       -
               {

     

       88
       88
       -
                 name = "tail";

     

       89
       89
       -
                 tag = "logs.nginx";

     

       90
       90
       -
                 path = "/var/log/nginx/*.log";

     

       91
       91
       -
                 db = "/var/lib/fluent-bit/nginx-access.db";

     

       92
       92
       -
                 "db.locking" = true;

     

       93
       93
       -
                 buffer_chunk_size = "4m";

     

       94
       94
       -
                 buffer_max_size = "32m";

     

       95
       95
       -
                 parser = "nginx_json";

     

       96
       96
       -
               }

     

       97
       97
       -
             ];

     

       98
       98
       -
             filters = [

     

       99
       99
       -
               {

     

       100
       100
       -
                 name = "modify";

     

       101
       101
       -
                 match = "logs.nginx";

     

       102
       102
       -
                 Add = [ "name nginx" ];

     

       103
       103
       -
               }

     

       104
       104
       -
             ];

     

       105
       105
       -
           };

     

       106
       106
       -
         };

     

       76
       76
       +
         # services.fluent-bit.settings = {

     

       77
       77
       +
         #   parsers = [

     

       78
       78
       +
         #     {

     

       79
       79
       +
         #       name = "nginx_json";

     

       80
       80
       +
         #       format = "json";

     

       81
       81
       +
         #       time_key = "time";

     

       82
       82
       +
         #       time_format = "%d/%b/%Y:%H:%M:%S %z";

     

       83
       83
       +
         #     }

     

       84
       84
       +
         #   ];

     

       85
       85
       +
         #   pipeline = {

     

       86
       86
       +
         #     inputs = [

     

       87
       87
       +
         #       {

     

       88
       88
       +
         #         name = "nginx_metrics";

     

       89
       89
       +
         #         tag = "metrics.nginx";

     

       90
       90
       +
         #         status_url = "/nginx_status";

     

       91
       91
       +
         #         nginx_plus = false;

     

       92
       92
       +
         #       }

     

       93
       93
       +
         #       {

     

       94
       94
       +
         #         name = "tail";

     

       95
       95
       +
         #         tag = "logs.nginx";

     

       96
       96
       +
         #         path = "/var/log/nginx/*.log";

     

       97
       97
       +
         #         db = "/var/lib/fluent-bit/nginx-access.db";

     

       98
       98
       +
         #         "db.locking" = true;

     

       99
       99
       +
         #         buffer_chunk_size = "4m";

     

       100
       100
       +
         #         buffer_max_size = "32m";

     

       101
       101
       +
         #         parser = "nginx_json";

     

       102
       102
       +
         #       }

     

       103
       103
       +
         #     ];

     

       104
       104
       +
         #     filters = [

     

       105
       105
       +
         #       {

     

       106
       106
       +
         #         name = "modify";

     

       107
       107
       +
         #         match = "logs.nginx";

     

       108
       108
       +
         #         Add = [ "name nginx" ];

     

       109
       109
       +
         #       }

     

       110
       110
       +
         #     ];

     

       111
       111
       +
         #   };

     

       112
       112
       +
         # };

     

       107
       113
        
       

     

       108
       108
       -
         # need so fluent-bit can access nginx

     

       109
       109
       -
         systemd.services.fluent-bit.serviceConfig.SupplementaryGroups = lib.mkForce "systemd-journal nginx";

     

       114
       114
       +
         # # need so fluent-bit can access nginx

     

       115
       115
       +
         # systemd.services.fluent-bit.serviceConfig.SupplementaryGroups = lib.mkForce "systemd-journal nginx";

     

       110
       116
        
       

     

       111
       111
       -
         services.vmalert.instances."".rules.groups = [

     

       112
       112
       -
           {

     

       113
       113
       -
             name = "nginx-logs";

     

       114
       114
       -
             type = "vlogs";

     

       115
       115
       -
             interval = "1m";

     

       116
       116
       -
             rules = [

     

       117
       117
       -
               {

     

       118
       118
       -
                 record = "nginx_request_count";

     

       119
       119
       -
                 expr = "name:nginx | stats (res.statusCode) count() as total_requests";

     

       120
       120
       -
               }

     

       121
       121
       -
               {

     

       122
       122
       -
                 record = "nginx_request_latency";

     

       123
       123
       -
                 # filter out subscribeRepos requests because they are long polling http L

     

       124
       124
       -
                 expr = "name:nginx | filter req.url:!/xrpc/com.atproto.sync.subscribeRepos | stats avg(requestTime) avg, quantile(0.5, requestTime) p50, quantile(0.9, requestTime) p90, quantile(0.99, requestTime) p99";

     

       125
       125
       -
               }

     

       126
       126
       -
             ];

     

       127
       127
       -
           }

     

       128
       128
       -
         ];

     

       117
       117
       +
         # services.vmalert.instances."".rules.groups = [

     

       118
       118
       +
         #   {

     

       119
       119
       +
         #     name = "nginx-logs";

     

       120
       120
       +
         #     type = "vlogs";

     

       121
       121
       +
         #     interval = "1m";

     

       122
       122
       +
         #     rules = [

     

       123
       123
       +
         #       {

     

       124
       124
       +
         #         record = "nginx_request_count";

     

       125
       125
       +
         #         expr = "name:nginx | stats (res.statusCode) count() as total_requests";

     

       126
       126
       +
         #       }

     

       127
       127
       +
         #       {

     

       128
       128
       +
         #         record = "nginx_request_latency";

     

       129
       129
       +
         #         # filter out subscribeRepos requests because they are long polling http L

     

       130
       130
       +
         #         expr = "name:nginx | filter req.url:!/xrpc/com.atproto.sync.subscribeRepos | stats avg(requestTime) avg, quantile(0.5, requestTime) p50, quantile(0.9, requestTime) p90, quantile(0.99, requestTime) p99";

     

       131
       131
       +
         #       }

     

       132
       132
       +
         #     ];

     

       133
       133
       +
         #   }

     

       134
       134
       +
         # ];

     

       129
       135
        
       }

hosts/wolumonde/modules/nsid-tracker.nix hosts/wolumonde/modules/nsid-tracker.disabled

+152

hosts/wolumonde/modules/pds.disabled

···

       1
       1
       +
       { lib, config, ... }:

     

       2
       2
       +
       let

     

       3
       3
       +
         pdsLocalhost = "http://localhost:${toString config.services.bluesky-pds.settings.PDS_PORT}";

     

       4
       4
       +
       in

     

       5
       5
       +
       {

     

       6
       6
       +
         services.nginx.virtualHosts.${config.services.bluesky-pds.settings.PDS_HOSTNAME} = {

     

       7
       7
       +
           useACMEHost = "gaze.systems";

     

       8
       8
       +
           forceSSL = true;

     

       9
       9
       +
           locations = {

     

       10
       10
       +
             # we need to proxy /xrpc for pds to work

     

       11
       11
       +
             # silly but i want root domain >:3

     

       12
       12
       +
             "/xrpc" = {

     

       13
       13
       +
               proxyPass = pdsLocalhost;

     

       14
       14
       +
               proxyWebsockets = true;

     

       15
       15
       +
               # pass ws headers so we can actually proxy the ws

     

       16
       16
       +
               extraConfig = ''

     

       17
       17
       +
                 proxy_set_header id $request_id;

     

       18
       18
       +
                 client_max_body_size 100M;

     

       19
       19
       +
               '';

     

       20
       20
       +
               # higher prio just to make sure

     

       21
       21
       +
               priority = 100;

     

       22
       22
       +
             };

     

       23
       23
       +
             "/xrpc/app.bsky.unspecced.getAgeAssuranceState".extraConfig = ''

     

       24
       24
       +
           		default_type application/json;

     

       25
       25
       +
           		add_header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy" always;

     

       26
       26
       +
           		add_header access-control-allow-origin "*" always;

     

       27
       27
       +
           		return 200 '{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured"}';

     

       28
       28
       +
             '';

     

       29
       29
       +
           }

     

       30
       30
       +
           # others

     

       31
       31
       +
           // (lib.genAttrs

     

       32
       32
       +
             [

     

       33
       33
       +
               "/account"

     

       34
       34
       +
               "/@atproto"

     

       35
       35
       +
               "/oauth"

     

       36
       36
       +
               "=/.well-known/oauth-protected-resource"

     

       37
       37
       +
               "=/.well-known/oauth-authorization-server"

     

       38
       38
       +
             ]

     

       39
       39
       +
             (_: {

     

       40
       40
       +
               proxyPass = pdsLocalhost;

     

       41
       41
       +
               # higher prio just to make sure

     

       42
       42
       +
               priority = 100;

     

       43
       43
       +
             })

     

       44
       44
       +
           );

     

       45
       45
       +
         };

     

       46
       46
       +
         # setup pds stuff

     

       47
       47
       +
         services.bluesky-pds = {

     

       48
       48
       +
           enable = true;

     

       49
       49
       +
           settings = {

     

       50
       50
       +
             PDS_HOSTNAME = "gaze.systems";

     

       51
       51
       +
             PDS_PORT = 1334;

     

       52
       52
       +
       

     

       53
       53
       +
             PDS_SERVICE_NAME = ''"gazing at the sky"'';

     

       54
       54
       +
             PDS_LOGO_URL = "https://gaze.systems/icons/gaze_site.webp";

     

       55
       55
       +
       

     

       56
       56
       +
             PDS_RATE_LIMITS_ENABLED = "true";

     

       57
       57
       +
             PDS_INVITE_REQUIRED = "true";

     

       58
       58
       +
       

     

       59
       59
       +
             PDS_DID_PLC_URL = "https://plc.directory";

     

       60
       60
       +
             PDS_BSKY_APP_VIEW_URL = "https://api.bsky.app";

     

       61
       61
       +
             PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";

     

       62
       62
       +
             PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";

     

       63
       63
       +
             PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";

     

       64
       64
       +
             PDS_CRAWLERS = "https://bsky.network";

     

       65
       65
       +
           };

     

       66
       66
       +
           environmentFiles = [ config.age.secrets.pdsConfig.path ];

     

       67
       67
       +
         };

     

       68
       68
       +
       

     

       69
       69
       +
         # services.fluent-bit.settings = {

     

       70
       70
       +
         #   parsers = [

     

       71
       71
       +
         #     {

     

       72
       72
       +
         #       name = "pds_json";

     

       73
       73
       +
         #       format = "json";

     

       74
       74
       +
         #       time_key = "time";

     

       75
       75
       +
         #       time_strict = false;

     

       76
       76
       +
         #     }

     

       77
       77
       +
         #   ];

     

       78
       78
       +
         #   pipeline = {

     

       79
       79
       +
         #     inputs = [

     

       80
       80
       +
         #       {

     

       81
       81
       +
         #         name = "systemd";

     

       82
       82
       +
         #         tag = "logs.pds";

     

       83
       83
       +
         #         systemd_filter = "_SYSTEMD_UNIT=bluesky-pds.service";

     

       84
       84
       +
         #       }

     

       85
       85
       +
         #     ];

     

       86
       86
       +
         #     filters = [

     

       87
       87
       +
         #       {

     

       88
       88
       +
         #         name = "parser";

     

       89
       89
       +
         #         match = "logs.pds";

     

       90
       90
       +
         #         key_name = "MESSAGE";

     

       91
       91
       +
         #         parser = "pds_json";

     

       92
       92
       +
         #       }

     

       93
       93
       +
         #       {

     

       94
       94
       +
         #         name = "modify";

     

       95
       95
       +
         #         match = "logs.pds";

     

       96
       96
       +
         #         Rename = [ "msg _msg" ];

     

       97
       97
       +
         #       }

     

       98
       98
       +
         #     ];

     

       99
       99
       +
         #   };

     

       100
       100
       +
         # };

     

       101
       101
       +
       

     

       102
       102
       +
         # services.vmalert.instances."".rules.groups = [

     

       103
       103
       +
         #   {

     

       104
       104
       +
         #     name = "pds-logs";

     

       105
       105
       +
         #     type = "vlogs";

     

       106
       106
       +
         #     interval = "1m";

     

       107
       107
       +
         #     rules = [

     

       108
       108
       +
         #       {

     

       109
       109
       +
         #         record = "pds_request_count";

     

       110
       110
       +
         #         expr = "name:pds | stats (res.statusCode) count() as total_requests";

     

       111
       111
       +
         #       }

     

       112
       112
       +
         #       {

     

       113
       113
       +
         #         record = "pds_response_latency";

     

       114
       114
       +
         #         expr = "name:pds | stats avg(responseTime) avg, quantile(0.5, responseTime) p50, quantile(0.9, responseTime) p90, quantile(0.99, responseTime) p99";

     

       115
       115
       +
         #       }

     

       116
       116
       +
         #     ];

     

       117
       117
       +
         #   }

     

       118
       118
       +
         # ];

     

       119
       119
       +
       

     

       120
       120
       +
         # virtualisation = {

     

       121
       121
       +
         #   podman = {

     

       122
       122
       +
         #     enable = true;

     

       123
       123
       +
         #     dockerCompat = true;

     

       124
       124
       +
         #     defaultNetwork.settings.dns_enabled = true;

     

       125
       125
       +
         #   };

     

       126
       126
       +
         #   oci-containers.containers = {

     

       127
       127
       +
         #     pds = {

     

       128
       128
       +
         #       image = "ghcr.io/bluesky-social/pds:0.4";

     

       129
       129
       +
         #       autoStart = true;

     

       130
       130
       +
         #       environmentFiles = [ ./pds.env config.age.secrets.pdsConfig.path ];

     

       131
       131
       +
         #       ports = [ "1334:1334" ];

     

       132
       132
       +
         #       volumes = [

     

       133
       133
       +
         #         "/var/lib/pds:/pds"

     

       134
       134
       +
         #       ];

     

       135
       135
       +
         #       extraOptions = [

     

       136
       136
       +
         #         #"--network=host"

     

       137
       137
       +
         #         "--label=io.containers.autoupdate=registry"

     

       138
       138
       +
         #       ];

     

       139
       139
       +
         #     };

     

       140
       140
       +
         #   };

     

       141
       141
       +
         # };

     

       142
       142
       +
         # # This is the podman auto-update systemd timer.

     

       143
       143
       +
         # # If I start to rely on podman auto-update more, I should move this out of the PDS definition.

     

       144
       144
       +
         # systemd.timers."podman-auto-update" = {

     

       145
       145
       +
         #   enable = true;

     

       146
       146
       +
         #   timerConfig = {

     

       147
       147
       +
         #     OnCalendar = "*-*-* 4:00:00";

     

       148
       148
       +
         #     Persistent = true;

     

       149
       149
       +
         #   };

     

       150
       150
       +
         #   wantedBy = [ "timers.target" ];

     

       151
       151
       +
         # };

     

       152
       152
       +
       }

+2 -33

hosts/wolumonde/modules/pds.nix hosts/trimounts/modules/pds.nix

···

       3
       3
        
         pdsLocalhost = "http://localhost:${toString config.services.bluesky-pds.settings.PDS_PORT}";

     

       4
       4
        
       in

     

       5
       5
        
       {

     

       6
       6
       +
         age.secrets.pdsConfig.file = ../../../secrets/pdsConfig.age;

     

       7
       7
       +
         

     

       6
       8
        
         services.nginx.virtualHosts.${config.services.bluesky-pds.settings.PDS_HOSTNAME} = {

     

       7
       9
        
           useACMEHost = "gaze.systems";

     

       8
       10
        
           forceSSL = true;

     
···

       116
       118
        
             ];

     

       117
       119
        
           }

     

       118
       120
        
         ];

     

       119
       119
       -
       

     

       120
       120
       -
         # virtualisation = {

     

       121
       121
       -
         #   podman = {

     

       122
       122
       -
         #     enable = true;

     

       123
       123
       -
         #     dockerCompat = true;

     

       124
       124
       -
         #     defaultNetwork.settings.dns_enabled = true;

     

       125
       125
       -
         #   };

     

       126
       126
       -
         #   oci-containers.containers = {

     

       127
       127
       -
         #     pds = {

     

       128
       128
       -
         #       image = "ghcr.io/bluesky-social/pds:0.4";

     

       129
       129
       -
         #       autoStart = true;

     

       130
       130
       -
         #       environmentFiles = [ ./pds.env config.age.secrets.pdsConfig.path ];

     

       131
       131
       -
         #       ports = [ "1334:1334" ];

     

       132
       132
       -
         #       volumes = [

     

       133
       133
       -
         #         "/var/lib/pds:/pds"

     

       134
       134
       -
         #       ];

     

       135
       135
       -
         #       extraOptions = [

     

       136
       136
       -
         #         #"--network=host"

     

       137
       137
       -
         #         "--label=io.containers.autoupdate=registry"

     

       138
       138
       -
         #       ];

     

       139
       139
       -
         #     };

     

       140
       140
       -
         #   };

     

       141
       141
       -
         # };

     

       142
       142
       -
         # # This is the podman auto-update systemd timer.

     

       143
       143
       -
         # # If I start to rely on podman auto-update more, I should move this out of the PDS definition.

     

       144
       144
       -
         # systemd.timers."podman-auto-update" = {

     

       145
       145
       -
         #   enable = true;

     

       146
       146
       -
         #   timerConfig = {

     

       147
       147
       -
         #     OnCalendar = "*-*-* 4:00:00";

     

       148
       148
       -
         #     Persistent = true;

     

       149
       149
       -
         #   };

     

       150
       150
       -
         #   wantedBy = [ "timers.target" ];

     

       151
       151
       -
         # };

     

       152
       121
        
       }

+2

hosts/wolumonde/modules/perses.disabled/dashboards/.gitignore

···

       1
       1
       +
       # folder used to store the results of the `percli dac build` command

     

       2
       2
       +
       built

+28

hosts/wolumonde/modules/perses.disabled/dashboards/go.mod

···

       1
       1
       +
       module dash

     

       2
       2
       +
       

     

       3
       3
       +
       go 1.24.2

     

       4
       4
       +
       

     

       5
       5
       +
       require (

     

       6
       6
       +
       	github.com/beorn7/perks v1.0.1 // indirect

     

       7
       7
       +
       	github.com/cespare/xxhash/v2 v2.3.0 // indirect

     

       8
       8
       +
       	github.com/go-jose/go-jose/v4 v4.0.5 // indirect

     

       9
       9
       +
       	github.com/jpillora/backoff v1.0.0 // indirect

     

       10
       10
       +
       	github.com/muhlemmer/gu v0.3.1 // indirect

     

       11
       11
       +
       	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

     

       12
       12
       +
       	github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f // indirect

     

       13
       13
       +
       	github.com/perses/perses v0.50.3 // indirect

     

       14
       14
       +
       	github.com/prometheus/client_golang v1.20.5 // indirect

     

       15
       15
       +
       	github.com/prometheus/client_model v0.6.1 // indirect

     

       16
       16
       +
       	github.com/prometheus/common v0.63.0 // indirect

     

       17
       17
       +
       	github.com/prometheus/procfs v0.15.1 // indirect

     

       18
       18
       +
       	github.com/zitadel/oidc/v3 v3.36.1 // indirect

     

       19
       19
       +
       	github.com/zitadel/schema v1.3.0 // indirect

     

       20
       20
       +
       	golang.org/x/crypto v0.36.0 // indirect

     

       21
       21
       +
       	golang.org/x/net v0.35.0 // indirect

     

       22
       22
       +
       	golang.org/x/oauth2 v0.28.0 // indirect

     

       23
       23
       +
       	golang.org/x/sys v0.31.0 // indirect

     

       24
       24
       +
       	golang.org/x/text v0.23.0 // indirect

     

       25
       25
       +
       	google.golang.org/protobuf v1.36.5 // indirect

     

       26
       26
       +
       	gopkg.in/yaml.v2 v2.4.0 // indirect

     

       27
       27
       +
       	gopkg.in/yaml.v3 v3.0.1 // indirect

     

       28
       28
       +
       )

+45

hosts/wolumonde/modules/perses.disabled/dashboards/go.sum

···

       1
       1
       +
       github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

     

       2
       2
       +
       github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=

     

       3
       3
       +
       github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

     

       4
       4
       +
       github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=

     

       5
       5
       +
       github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=

     

       6
       6
       +
       github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=

     

       7
       7
       +
       github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=

     

       8
       8
       +
       github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=

     

       9
       9
       +
       github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM=

     

       10
       10
       +
       github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM=

     

       11
       11
       +
       github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=

     

       12
       12
       +
       github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

     

       13
       13
       +
       github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=

     

       14
       14
       +
       github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=

     

       15
       15
       +
       github.com/perses/perses v0.50.3 h1:BHlU9qkCFCUSP4HP5p9GwophWcxm5Vnu6Fsrx8Fb/+w=

     

       16
       16
       +
       github.com/perses/perses v0.50.3/go.mod h1:oqfHLOrXERvEqECShqXPjHXqVukQxcoaaTM6ySRF7hU=

     

       17
       17
       +
       github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=

     

       18
       18
       +
       github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=

     

       19
       19
       +
       github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=

     

       20
       20
       +
       github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=

     

       21
       21
       +
       github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=

     

       22
       22
       +
       github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=

     

       23
       23
       +
       github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=

     

       24
       24
       +
       github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=

     

       25
       25
       +
       github.com/zitadel/oidc/v3 v3.36.1 h1:1AT1NqKKEqAwx4GmKJZ9fYkWH2WIn/VKMfQ46nBtRf0=

     

       26
       26
       +
       github.com/zitadel/oidc/v3 v3.36.1/go.mod h1:dApGZLvWZTHRuxmcbQlW5d2XVjVYR3vGOdq536igmTs=

     

       27
       27
       +
       github.com/zitadel/schema v1.3.0 h1:kQ9W9tvIwZICCKWcMvCEweXET1OcOyGEuFbHs4o5kg0=

     

       28
       28
       +
       github.com/zitadel/schema v1.3.0/go.mod h1:NptN6mkBDFvERUCvZHlvWmmME+gmZ44xzwRXwhzsbtc=

     

       29
       29
       +
       golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=

     

       30
       30
       +
       golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=

     

       31
       31
       +
       golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=

     

       32
       32
       +
       golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=

     

       33
       33
       +
       golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=

     

       34
       34
       +
       golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=

     

       35
       35
       +
       golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=

     

       36
       36
       +
       golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=

     

       37
       37
       +
       golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=

     

       38
       38
       +
       golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=

     

       39
       39
       +
       google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=

     

       40
       40
       +
       google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=

     

       41
       41
       +
       gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

     

       42
       42
       +
       gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=

     

       43
       43
       +
       gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

     

       44
       44
       +
       gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

     

       45
       45
       +
       gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

+334

hosts/wolumonde/modules/perses.disabled/dashboards/wolumonde.go

···

       1
       1
       +
       package main

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"flag"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/perses/perses/go-sdk"

     

       8
       8
       +
       	"github.com/perses/perses/go-sdk/common"

     

       9
       9
       +
       	dash "github.com/perses/perses/go-sdk/dashboard"

     

       10
       10
       +
       	"github.com/perses/perses/go-sdk/panel"

     

       11
       11
       +
       	panels "github.com/perses/perses/go-sdk/panel-group"

     

       12
       12
       +
       	"github.com/perses/perses/go-sdk/panel/bar"

     

       13
       13
       +
       	"github.com/perses/perses/go-sdk/panel/gauge"

     

       14
       14
       +
       	"github.com/perses/perses/go-sdk/panel/stat"

     

       15
       15
       +
       	"github.com/perses/perses/go-sdk/prometheus/query"

     

       16
       16
       +
       

     

       17
       17
       +
       	timeSeries "github.com/perses/perses/go-sdk/panel/time-series"

     

       18
       18
       +
       	// promDs "github.com/perses/perses/go-sdk/prometheus/datasource"

     

       19
       19
       +
       )

     

       20
       20
       +
       

     

       21
       21
       +
       func main() {

     

       22
       22
       +
       	flag.Parse()

     

       23
       23
       +
       	exec := sdk.NewExec()

     

       24
       24
       +
       

     

       25
       25
       +
       	var loadPanel = panels.AddPanel("load over 5 min",

     

       26
       26
       +
       		timeSeries.Chart(

     

       27
       27
       +
       			timeSeries.WithYAxis(

     

       28
       28
       +
       				timeSeries.YAxis{

     

       29
       29
       +
       					Max: 2.0,

     

       30
       30
       +
       				},

     

       31
       31
       +
       			),

     

       32
       32
       +
       		),

     

       33
       33
       +
       		panel.AddQuery(

     

       34
       34
       +
       			query.PromQL(

     

       35
       35
       +
       				"node_load5",

     

       36
       36
       +
       				query.SeriesNameFormat("load"),

     

       37
       37
       +
       			),

     

       38
       38
       +
       		),

     

       39
       39
       +
       	)

     

       40
       40
       +
       	var cpuPanel = panels.AddPanel("cpu usage",

     

       41
       41
       +
       		timeSeries.Chart(

     

       42
       42
       +
       			timeSeries.WithYAxis(

     

       43
       43
       +
       				timeSeries.YAxis{

     

       44
       44
       +
       					Format: &common.Format{

     

       45
       45
       +
       						Unit: "percent",

     

       46
       46
       +
       					},

     

       47
       47
       +
       					Max: 100.0,

     

       48
       48
       +
       				},

     

       49
       49
       +
       			),

     

       50
       50
       +
       		),

     

       51
       51
       +
       		panel.AddQuery(

     

       52
       52
       +
       			query.PromQL(

     

       53
       53
       +
       				`sum by (cpu) (rate(node_cpu_seconds_total{mode=~"user|system"}[1m])) * 100`,

     

       54
       54
       +
       				query.SeriesNameFormat("cpu {{cpu}}"),

     

       55
       55
       +
       			),

     

       56
       56
       +
       		),

     

       57
       57
       +
       	)

     

       58
       58
       +
       	var memoryPanel = panels.AddPanel("memory usage",

     

       59
       59
       +
       		timeSeries.Chart(

     

       60
       60
       +
       			timeSeries.WithYAxis(

     

       61
       61
       +
       				timeSeries.YAxis{

     

       62
       62
       +
       					Format: &common.Format{

     

       63
       63
       +
       						Unit: "bytes",

     

       64
       64
       +
       					},

     

       65
       65
       +
       					Max: 4000000000,

     

       66
       66
       +
       				},

     

       67
       67
       +
       			),

     

       68
       68
       +
       		),

     

       69
       69
       +
       		panel.AddQuery(

     

       70
       70
       +
       			query.PromQL(

     

       71
       71
       +
       				"node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes",

     

       72
       72
       +
       				query.SeriesNameFormat("current memory usage"),

     

       73
       73
       +
       			),

     

       74
       74
       +
       		),

     

       75
       75
       +
       	)

     

       76
       76
       +
       

     

       77
       77
       +
       	var diskPanel = panels.AddPanel("disk usage /",

     

       78
       78
       +
       		timeSeries.Chart(

     

       79
       79
       +
       			timeSeries.WithYAxis(

     

       80
       80
       +
       				timeSeries.YAxis{

     

       81
       81
       +
       					Format: &common.Format{

     

       82
       82
       +
       						Unit: "bytes",

     

       83
       83
       +
       					},

     

       84
       84
       +
       					Max: 38000000000,

     

       85
       85
       +
       				},

     

       86
       86
       +
       			),

     

       87
       87
       +
       		),

     

       88
       88
       +
       		panel.AddQuery(

     

       89
       89
       +
       			query.PromQL(

     

       90
       90
       +
       				`node_filesystem_size_bytes{mountpoint="/"} - node_filesystem_free_bytes{mountpoint="/"}`,

     

       91
       91
       +
       				query.SeriesNameFormat("disk usage"),

     

       92
       92
       +
       			),

     

       93
       93
       +
       		),

     

       94
       94
       +
       	)

     

       95
       95
       +
       

     

       96
       96
       +
       	// Gauge versions (percent unit)

     

       97
       97
       +
       	var loadGaugePanel = panels.AddPanel("load over 5 min",

     

       98
       98
       +
       		gauge.Chart(

     

       99
       99
       +
       			gauge.Format(common.Format{Unit: "percent"}),

     

       100
       100
       +
       			gauge.Max(100),

     

       101
       101
       +
       			gauge.Calculation(common.MeanCalculation),

     

       102
       102
       +
       		),

     

       103
       103
       +
       		panel.AddQuery(

     

       104
       104
       +
       			query.PromQL(

     

       105
       105
       +
       				"node_load5 * 100 / count(count(node_cpu_seconds_total) by (cpu))",

     

       106
       106
       +
       				query.SeriesNameFormat("load %"),

     

       107
       107
       +
       			),

     

       108
       108
       +
       		),

     

       109
       109
       +
       	)

     

       110
       110
       +
       	var cpuGaugePanel = panels.AddPanel("cpu usage",

     

       111
       111
       +
       		gauge.Chart(

     

       112
       112
       +
       			gauge.Format(common.Format{Unit: "percent"}),

     

       113
       113
       +
       			gauge.Max(100),

     

       114
       114
       +
       			gauge.Calculation(common.MeanCalculation),

     

       115
       115
       +
       		),

     

       116
       116
       +
       		panel.AddQuery(

     

       117
       117
       +
       			query.PromQL(

     

       118
       118
       +
       				`sum by (cpu) (rate(node_cpu_seconds_total{mode=~"user|system"}[1m])) * 100`,

     

       119
       119
       +
       				query.SeriesNameFormat("cpu {{cpu}}"),

     

       120
       120
       +
       			),

     

       121
       121
       +
       		),

     

       122
       122
       +
       	)

     

       123
       123
       +
       	var memoryGaugePanel = panels.AddPanel("memory usage",

     

       124
       124
       +
       		gauge.Chart(

     

       125
       125
       +
       			gauge.Format(common.Format{Unit: "percent"}),

     

       126
       126
       +
       			gauge.Max(100),

     

       127
       127
       +
       			gauge.Calculation(common.MeanCalculation),

     

       128
       128
       +
       		),

     

       129
       129
       +
       		panel.AddQuery(

     

       130
       130
       +
       			query.PromQL(

     

       131
       131
       +
       				"(node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes) * 100 / node_memory_MemTotal_bytes",

     

       132
       132
       +
       				query.SeriesNameFormat("memory usage %"),

     

       133
       133
       +
       			),

     

       134
       134
       +
       		),

     

       135
       135
       +
       	)

     

       136
       136
       +
       	var diskGaugePanel = panels.AddPanel("disk usage /",

     

       137
       137
       +
       		gauge.Chart(

     

       138
       138
       +
       			gauge.Format(common.Format{Unit: "percent"}),

     

       139
       139
       +
       			gauge.Max(100),

     

       140
       140
       +
       		),

     

       141
       141
       +
       		panel.AddQuery(

     

       142
       142
       +
       			query.PromQL(

     

       143
       143
       +
       				`(node_filesystem_size_bytes{mountpoint="/"} - node_filesystem_free_bytes{mountpoint="/"}) * 100 / node_filesystem_size_bytes{mountpoint="/"}`,

     

       144
       144
       +
       				query.SeriesNameFormat("disk usage %"),

     

       145
       145
       +
       			),

     

       146
       146
       +
       		),

     

       147
       147
       +
       	)

     

       148
       148
       +
       

     

       149
       149
       +
       	var resPanels = dash.AddPanelGroup("resource usage",

     

       150
       150
       +
       		panels.PanelsPerLine(4),

     

       151
       151
       +
       		loadGaugePanel, cpuGaugePanel, memoryGaugePanel, diskGaugePanel,

     

       152
       152
       +
       		loadPanel, cpuPanel, memoryPanel, diskPanel,

     

       153
       153
       +
       	)

     

       154
       154
       +
       

     

       155
       155
       +
       	var nginxPanel = panels.AddPanel("nginx requests / min",

     

       156
       156
       +
       		timeSeries.Chart(

     

       157
       157
       +
       			timeSeries.WithYAxis(

     

       158
       158
       +
       				timeSeries.YAxis{

     

       159
       159
       +
       					Format: &common.Format{

     

       160
       160
       +
       						Unit: "decimal",

     

       161
       161
       +
       					},

     

       162
       162
       +
       				},

     

       163
       163
       +
       			),

     

       164
       164
       +
       			timeSeries.WithVisual(timeSeries.Visual{

     

       165
       165
       +
       				Display: timeSeries.BarDisplay,

     

       166
       166
       +
       				Palette: timeSeries.Palette{

     

       167
       167
       +
       					Mode: timeSeries.CategoricalMode,

     

       168
       168
       +
       				},

     

       169
       169
       +
       				Stack: timeSeries.AllStack,

     

       170
       170
       +
       			}),

     

       171
       171
       +
       			timeSeries.WithLegend(timeSeries.Legend{

     

       172
       172
       +
       				Position: timeSeries.BottomPosition,

     

       173
       173
       +
       				Size:     timeSeries.SmallSize,

     

       174
       174
       +
       			}),

     

       175
       175
       +
       		),

     

       176
       176
       +
       		panel.AddQuery(

     

       177
       177
       +
       			query.PromQL(

     

       178
       178
       +
       				"nginx_request_count",

     

       179
       179
       +
       				query.SeriesNameFormat("{{res.statusCode}}"),

     

       180
       180
       +
       			),

     

       181
       181
       +
       		),

     

       182
       182
       +
       	)

     

       183
       183
       +
       

     

       184
       184
       +
       	var nginxLatencyPanel = panels.AddPanel("nginx latency / min",

     

       185
       185
       +
       		timeSeries.Chart(

     

       186
       186
       +
       			timeSeries.WithYAxis(

     

       187
       187
       +
       				timeSeries.YAxis{

     

       188
       188
       +
       					Format: &common.Format{

     

       189
       189
       +
       						Unit: "seconds",

     

       190
       190
       +
       					},

     

       191
       191
       +
       					Max: 0.5,

     

       192
       192
       +
       				},

     

       193
       193
       +
       			),

     

       194
       194
       +
       		),

     

       195
       195
       +
       		panel.AddQuery(

     

       196
       196
       +
       			query.PromQL(

     

       197
       197
       +
       				"nginx_request_latency",

     

       198
       198
       +
       				query.SeriesNameFormat("{{stats_result}}"),

     

       199
       199
       +
       			),

     

       200
       200
       +
       		),

     

       201
       201
       +
       	)

     

       202
       202
       +
       

     

       203
       203
       +
       	var nginxPanels = dash.AddPanelGroup("nginx metrics",

     

       204
       204
       +
       		panels.PanelsPerLine(3),

     

       205
       205
       +
       		nginxPanel,

     

       206
       206
       +
       		nginxLatencyPanel,

     

       207
       207
       +
       	)

     

       208
       208
       +
       

     

       209
       209
       +
       	var pdsPanel = panels.AddPanel("pds requests / min",

     

       210
       210
       +
       		timeSeries.Chart(

     

       211
       211
       +
       			timeSeries.WithYAxis(

     

       212
       212
       +
       				timeSeries.YAxis{

     

       213
       213
       +
       					Format: &common.Format{

     

       214
       214
       +
       						Unit: "decimal",

     

       215
       215
       +
       					},

     

       216
       216
       +
       				},

     

       217
       217
       +
       			),

     

       218
       218
       +
       			timeSeries.WithVisual(timeSeries.Visual{

     

       219
       219
       +
       				Display: timeSeries.BarDisplay,

     

       220
       220
       +
       				Palette: timeSeries.Palette{

     

       221
       221
       +
       					Mode: timeSeries.CategoricalMode,

     

       222
       222
       +
       				},

     

       223
       223
       +
       				Stack: timeSeries.AllStack,

     

       224
       224
       +
       			}),

     

       225
       225
       +
       			timeSeries.WithLegend(timeSeries.Legend{

     

       226
       226
       +
       				Position: timeSeries.BottomPosition,

     

       227
       227
       +
       				Size:     timeSeries.SmallSize,

     

       228
       228
       +
       			}),

     

       229
       229
       +
       		),

     

       230
       230
       +
       		panel.AddQuery(

     

       231
       231
       +
       			query.PromQL(

     

       232
       232
       +
       				"pds_request_count",

     

       233
       233
       +
       				query.SeriesNameFormat("{{res.statusCode}}"),

     

       234
       234
       +
       			),

     

       235
       235
       +
       		),

     

       236
       236
       +
       	)

     

       237
       237
       +
       

     

       238
       238
       +
       	var pdsLatencyPanel = panels.AddPanel("pds latency / min",

     

       239
       239
       +
       		timeSeries.Chart(

     

       240
       240
       +
       			timeSeries.WithYAxis(

     

       241
       241
       +
       				timeSeries.YAxis{

     

       242
       242
       +
       					Format: &common.Format{

     

       243
       243
       +
       						Unit: "milliseconds",

     

       244
       244
       +
       					},

     

       245
       245
       +
       					Max: 500,

     

       246
       246
       +
       				},

     

       247
       247
       +
       			),

     

       248
       248
       +
       		),

     

       249
       249
       +
       		panel.AddQuery(

     

       250
       250
       +
       			query.PromQL(

     

       251
       251
       +
       				"pds_response_latency",

     

       252
       252
       +
       				query.SeriesNameFormat("{{stats_result}}"),

     

       253
       253
       +
       			),

     

       254
       254
       +
       		),

     

       255
       255
       +
       	)

     

       256
       256
       +
       

     

       257
       257
       +
       	var pdsPanels = dash.AddPanelGroup("pds metrics",

     

       258
       258
       +
       		panels.PanelsPerLine(3),

     

       259
       259
       +
       		pdsPanel,

     

       260
       260
       +
       		pdsLatencyPanel,

     

       261
       261
       +
       	)

     

       262
       262
       +
       

     

       263
       263
       +
       	var anubisForgejoPanel = panels.AddPanel("anubis policy actions",

     

       264
       264
       +
       		bar.Chart(),

     

       265
       265
       +
       		panel.AddQuery(

     

       266
       266
       +
       			query.PromQL(

     

       267
       267
       +
       				"anubis_policy_results",

     

       268
       268
       +
       				query.SeriesNameFormat("{{action}}: {{rule}}"),

     

       269
       269
       +
       			),

     

       270
       270
       +
       		),

     

       271
       271
       +
       	)

     

       272
       272
       +
       

     

       273
       273
       +
       	var forgejoPanels = dash.AddPanelGroup("forgejo",

     

       274
       274
       +
       		panels.PanelsPerLine(3),

     

       275
       275
       +
       		anubisForgejoPanel,

     

       276
       276
       +
       	)

     

       277
       277
       +
       

     

       278
       278
       +
       	var gazesys_visit_panel = panels.AddPanel("gazesys visits",

     

       279
       279
       +
       		bar.Chart(),

     

       280
       280
       +
       		panel.AddQuery(

     

       281
       281
       +
       			query.PromQL(

     

       282
       282
       +
       				"gazesys_visit_real_total + gazesys_visit_fake_total",

     

       283
       283
       +
       				query.SeriesNameFormat("total visits"),

     

       284
       284
       +
       			),

     

       285
       285
       +
       		),

     

       286
       286
       +
       		panel.AddQuery(

     

       287
       287
       +
       			query.PromQL(

     

       288
       288
       +
       				"gazesys_visit_fake_total",

     

       289
       289
       +
       				query.SeriesNameFormat("(ai) bot visits"),

     

       290
       290
       +
       			),

     

       291
       291
       +
       		),

     

       292
       292
       +
       		panel.AddQuery(

     

       293
       293
       +
       			query.PromQL(

     

       294
       294
       +
       				"gazesys_visit_real_total",

     

       295
       295
       +
       				query.SeriesNameFormat("real visits"),

     

       296
       296
       +
       			),

     

       297
       297
       +
       		),

     

       298
       298
       +
       	)

     

       299
       299
       +
       

     

       300
       300
       +
       	var gazesys_pet_panel = panels.AddPanel("gazesys pet",

     

       301
       301
       +
       		stat.Chart(

     

       302
       302
       +
       			stat.Format(common.Format{

     

       303
       303
       +
       				Unit:          "decimal",

     

       304
       304
       +
       				ShortValues:   true,

     

       305
       305
       +
       				DecimalPlaces: 0,

     

       306
       306
       +
       			}),

     

       307
       307
       +
       		),

     

       308
       308
       +
       		panel.AddQuery(

     

       309
       309
       +
       			query.PromQL(

     

       310
       310
       +
       				"gazesys_pet_bounce_total",

     

       311
       311
       +
       				query.SeriesNameFormat("bounce count"),

     

       312
       312
       +
       			),

     

       313
       313
       +
       		),

     

       314
       314
       +
       		panel.AddQuery(

     

       315
       315
       +
       			query.PromQL(

     

       316
       316
       +
       				"gazesys_pet_distance_total",

     

       317
       317
       +
       				query.SeriesNameFormat("distance travelled"),

     

       318
       318
       +
       			),

     

       319
       319
       +
       		),

     

       320
       320
       +
       	)

     

       321
       321
       +
       

     

       322
       322
       +
       	var gazesys_panels = dash.AddPanelGroup("gazesys",

     

       323
       323
       +
       		panels.PanelsPerLine(3),

     

       324
       324
       +
       		gazesys_visit_panel, gazesys_pet_panel,

     

       325
       325
       +
       	)

     

       326
       326
       +
       

     

       327
       327
       +
       	builder, buildErr := dash.New("wolumonde",

     

       328
       328
       +
       		dash.ProjectName("private-infra"),

     

       329
       329
       +
       		dash.Duration(30*time.Minute),

     

       330
       330
       +
       		dash.RefreshInterval(time.Minute),

     

       331
       331
       +
       		resPanels, nginxPanels, pdsPanels, gazesys_panels, forgejoPanels,

     

       332
       332
       +
       	)

     

       333
       333
       +
       	exec.BuildDashboard(builder, buildErr)

     

       334
       334
       +
       }

hosts/wolumonde/modules/perses.nix/dashboards/.gitignore hosts/trimounts/modules/perses.nix/dashboards/.gitignore

hosts/wolumonde/modules/perses.nix/dashboards/go.mod hosts/trimounts/modules/perses.nix/dashboards/go.mod

hosts/wolumonde/modules/perses.nix/dashboards/go.sum hosts/trimounts/modules/perses.nix/dashboards/go.sum

hosts/wolumonde/modules/perses.nix/dashboards/wolumonde.go hosts/trimounts/modules/perses.nix/dashboards/wolumonde.go

hosts/wolumonde/modules/perses.nix/default.nix hosts/wolumonde/modules/perses.disabled/default.nix

hosts/wolumonde/modules/perses.nix/provision/1-private-infra.yaml hosts/wolumonde/modules/perses.disabled/provision/1-private-infra.yaml

hosts/wolumonde/modules/perses.nix/provision/2-admin-role.yaml hosts/wolumonde/modules/perses.disabled/provision/2-admin-role.yaml

hosts/wolumonde/modules/perses.nix/provision/3-admin-bind-role.yaml hosts/wolumonde/modules/perses.disabled/provision/3-admin-bind-role.yaml

hosts/wolumonde/modules/perses.nix/provision/4-victoria.yaml hosts/wolumonde/modules/perses.disabled/provision/4-victoria.yaml

hosts/wolumonde/modules/perses.nix/provision/6-guest-role.yaml hosts/wolumonde/modules/perses.disabled/provision/6-guest-role.yaml

hosts/wolumonde/modules/perses.nix/provision/7-guest-role-bind.yaml hosts/wolumonde/modules/perses.disabled/provision/7-guest-role-bind.yaml

hosts/wolumonde/modules/perses.nix/provision/90-wolumonde.yaml hosts/wolumonde/modules/perses.disabled/provision/90-wolumonde.yaml

+30

hosts/wolumonde/modules/pocket-id.disabled

···

       1
       1
       +
       { config, ... }:

     

       2
       2
       +
       let

     

       3
       3
       +
         domain = "id.gaze.systems";

     

       4
       4
       +
       in

     

       5
       5
       +
       {

     

       6
       6
       +
         services.pocket-id = {

     

       7
       7
       +
           enable = true;

     

       8
       8
       +
           settings = {

     

       9
       9
       +
             APP_URL = "https://${domain}";

     

       10
       10
       +
             TRUST_PROXY = true;

     

       11
       11
       +
             PORT = 6823;

     

       12
       12
       +
             ANALYTICS_DISABLED = true;

     

       13
       13
       +
           };

     

       14
       14
       +
         };

     

       15
       15
       +
       

     

       16
       16
       +
         security.acme.certs."gaze.systems".extraDomainNames = [ domain ];

     

       17
       17
       +
       

     

       18
       18
       +
         services.nginx.virtualHosts.${domain} = {

     

       19
       19
       +
           useACMEHost = "gaze.systems";

     

       20
       20
       +
           forceSSL = true;

     

       21
       21
       +
           quic = true;

     

       22
       22
       +
           kTLS = true;

     

       23
       23
       +
           locations."/".proxyPass = "http://localhost:${toString config.services.pocket-id.settings.PORT}";

     

       24
       24
       +
           locations."/".extraConfig = ''

     

       25
       25
       +
             proxy_busy_buffers_size 512k;

     

       26
       26
       +
             proxy_buffers 4 512k;

     

       27
       27
       +
             proxy_buffer_size 256k;

     

       28
       28
       +
           '';

     

       29
       29
       +
         };

     

       30
       30
       +
       }

hosts/wolumonde/modules/pocket-id.nix hosts/trimounts/modules/pocket-id.nix

-1

hosts/wolumonde/modules/secrets.nix

···

       1
       1
        
       { lib, ... }:

     

       2
       2
        
       {

     

       3
       3
        
         # age.secrets.bernbotToken.file = ../../../secrets/bernbotToken.age;

     

       4
       4
       -
         age.secrets.websiteConfig.file = ../../../secrets/websiteConfig.age;

     

       5
       4
        
         age.secrets.pdsConfig.file = ../../../secrets/pdsConfig.age;

     

       6
       5
        
         # age.secrets.wgWolumondeKey = {

     

       7
       6
        
         #   file = ../../../secrets/wgWolumondeKey.age;

hosts/wolumonde/modules/tangled.nix/default.nix hosts/wolumonde/modules/tangled.disabled/default.nix

hosts/wolumonde/modules/tangled.nix/knot.nix hosts/wolumonde/modules/tangled.disabled/knot.nix

hosts/wolumonde/modules/tangled.nix/motd hosts/wolumonde/modules/tangled.disabled/motd

hosts/wolumonde/modules/tangled.nix/spindle.nix hosts/wolumonde/modules/tangled.disabled/spindle.nix

hosts/wolumonde/modules/unbound.nix hosts/wolumonde/modules/unbound.disabled

+70

hosts/wolumonde/modules/victoria.disabled

···

       1
       1
       +
       { lib, config, ... }:

     

       2
       2
       +
       let

     

       3
       3
       +
         # syslogUdp = 5113;

     

       4
       4
       +
         metricsPort = 8428;

     

       5
       5
       +
         logsPort = 9428;

     

       6
       6
       +
       in

     

       7
       7
       +
       {

     

       8
       8
       +
         services.victoriametrics = {

     

       9
       9
       +
           enable = true;

     

       10
       10
       +
           listenAddress = ":${toString metricsPort}";

     

       11
       11
       +
         };

     

       12
       12
       +
       

     

       13
       13
       +
         services.victorialogs = {

     

       14
       14
       +
           enable = true;

     

       15
       15
       +
           listenAddress = ":${toString logsPort}";

     

       16
       16
       +
           # extraOptions = ["-syslog.listenAddr.udp=:${toString syslogUdp}" "-journald.maxRequestSize=1024000000"];

     

       17
       17
       +
         };

     

       18
       18
       +
       

     

       19
       19
       +
         services.vmalert.instances."" = {

     

       20
       20
       +
           enable = true;

     

       21
       21
       +
           settings =

     

       22
       22
       +
             let

     

       23
       23
       +
               l = "http://localhost";

     

       24
       24
       +
             in

     

       25
       25
       +
             {

     

       26
       26
       +
               "datasource.url" = "${l}${config.services.victorialogs.listenAddress}";

     

       27
       27
       +
               "remoteWrite.url" = "${l}${config.services.victoriametrics.listenAddress}";

     

       28
       28
       +
               "remoteRead.url" = "${l}${config.services.victoriametrics.listenAddress}";

     

       29
       29
       +
               "rule.defaultRuleType" = "vlogs";

     

       30
       30
       +
             };

     

       31
       31
       +
         };

     

       32
       32
       +
       

     

       33
       33
       +
         services.fluent-bit.settings.pipeline.outputs = [

     

       34
       34
       +
           # write metrics to victoriametrics via prometheus

     

       35
       35
       +
           {

     

       36
       36
       +
             name = "prometheus_remote_write";

     

       37
       37
       +
             match = "metrics.*";

     

       38
       38
       +
             port = lib.removePrefix ":" config.services.victoriametrics.listenAddress;

     

       39
       39
       +
             uri = "/api/v1/write";

     

       40
       40
       +
           }

     

       41
       41
       +
           {

     

       42
       42
       +
             name = "http";

     

       43
       43
       +
             match = "logs.*";

     

       44
       44
       +
             port = lib.removePrefix ":" config.services.victorialogs.listenAddress;

     

       45
       45
       +
             uri = "/insert/jsonline?_stream_fields=stream&_msg_field=log&_time_field=date";

     

       46
       46
       +
             format = "json_lines";

     

       47
       47
       +
             json_date_format = "iso8601";

     

       48
       48
       +
           }

     

       49
       49
       +
           # write logs via syslog

     

       50
       50
       +
           # {

     

       51
       51
       +
           #   name = "syslog";

     

       52
       52
       +
           #   match = "*.log";

     

       53
       53
       +
           #   port = syslogUdp;

     

       54
       54
       +
           #   syslog_maxsize = 4096;

     

       55
       55
       +
           #   syslog_severity_key = "severity";

     

       56
       56
       +
           #   syslog_facility_key = "facility";

     

       57
       57
       +
           #   syslog_hostname_key = "hostname";

     

       58
       58
       +
           #   syslog_appname_key = "appname";

     

       59
       59
       +
           #   syslog_procid_key = "procid";

     

       60
       60
       +
           #   syslog_msgid_key = "msgid";

     

       61
       61
       +
           #   syslog_sd_key = "sd";

     

       62
       62
       +
           #   syslog_message_key = "message";

     

       63
       63
       +
           # }

     

       64
       64
       +
         ];

     

       65
       65
       +
       

     

       66
       66
       +
         # services.journald.upload = {

     

       67
       67
       +
         #   enable = true;

     

       68
       68
       +
         #   settings.Upload.URL = "http://localhost${config.services.victorialogs.listenAddress}/insert/journald";

     

       69
       69
       +
         # };

     

       70
       70
       +
       }

hosts/wolumonde/modules/victoria.nix hosts/trimounts/modules/victoria.nix

secrets/clickeeProxyConfig.age

This is a binary file and will not be displayed.

+22

secrets/cloudflareDnsEdit.age

···

       1
       1
       +
       age-encryption.org/v1

     

       2
       2
       +
       -> ssh-rsa Abmvag

     

       3
       3
       +
       RLzSHns6rm+PKThSJC768KmC2a9odftJWSSWqNR36LA5wb1wU5YpP/EHt6P50AY/

     

       4
       4
       +
       JsFPydPP+XTso4rSclWuW1gjEEzfQdwBJy0c9QNo6WRwtLsR2jLC/VBULqTPsHUH

     

       5
       5
       +
       bSR138+wtdICBLRMY71VvEcdrtONMm8dqc/STV5e270yDU+HtCW2Vwxu837CpUzQ

     

       6
       6
       +
       6xHV1NDURR5NugjQspW3mVBrFSx7OpE2iGrSYsCzXNpFK9JsC40yG/YZzqf2ktM4

     

       7
       7
       +
       BlWTNGRd2M/QOXwCOOdsgQHfN4DtHBR/nrC+sdauJahKxSR0RVB2jQgrH2LsmnB9

     

       8
       8
       +
       Xh8ttoYKwkVHQmOEUbtCnqKpzf7qGqyRX2+smkGaB2RzSxhNmUEmdV0dAEMXtGZd

     

       9
       9
       +
       aBFMw233WioqNygHxfgYkUtA2jFjBEVeAp74iKH7fB1/8fKa+SSeLEcv/IuIAOSp

     

       10
       10
       +
       WjqI7El5U882SviAyMuQ6hzWBLejCNBueZTgJVR0Iyk0fTjeLNM4rhqTQswyDjBh

     

       11
       11
       +
       7jnjAgVMaqZTRHrQFkBimkjX3QXutvRcjyutY3niUNRCZacvJ8bVIuIhNbqFOLJR

     

       12
       12
       +
       Io/bRwys/qR1a44GFMxbQG6Hm0NRIIK791cxxilZpnNiJHs02TLTXzuIq0bfTssz

     

       13
       13
       +
       3FjUZa6Oaerum2I/BidWJuYm4Cm6tJuftYn7XS1q+4I

     

       14
       14
       +
       -> ssh-ed25519 y5W/qA /qpByEN29ydHS/WgwLlOQjby7fYCI7hDOUSMJ+s0ZHA

     

       15
       15
       +
       Je4qhR22hERajFv/7EbQodKo4ldYqsrUgFdtt1KbXUA

     

       16
       16
       +
       -> ssh-ed25519 KjIL7g v+JVYql3+Tm/eam/1Vl/VSN97rq/8idFMcea1u7JEgE

     

       17
       17
       +
       bqgK9JhL1CF9O/35WzOj3J2fHSUQcMesbamMatJRBbk

     

       18
       18
       +
       -> ssh-ed25519 LaQclg u0qjpT1TcL0sAapagUr6opDbr3FRFsTtnK9wEoIJvxM

     

       19
       19
       +
       Uof2ZOkgEtdY301j0Ql6i9+WjQusspUvn1kMGgaSfp0

     

       20
       20
       +
       --- 8kcgq1sQjU2uSmskmkb3SUmsXubI1HtWBhs2RuuVJcE

     

       21
       21
       +
       �5��;�h9���#`c֎�

     

       22
       22
       +
       ����9�k�4�S鯘��L:�/����׀P}a��oՇ:$��.����

secrets/develMobiTailscaleAuthKey.age

This is a binary file and will not be displayed.

secrets/headscaleOidcSecret.age

This is a binary file and will not be displayed.

secrets/nixGithubAccessToken.age

This is a binary file and will not be displayed.

+19 -17

secrets/pdsConfig.age

···

       1
       1
        
       age-encryption.org/v1

     

       2
       2
        
       -> ssh-rsa Abmvag

     

       3
       3
       -
       Ti+WByG/+vCEtMtvVSUYqnjhLnL6gmVHj+8+ARD12zrfV+l0LZxW7TFGqWvtQ+9N

     

       4
       4
       -
       0aCa5AGao4ngjom0JHhFm+DzklR13V6FyB1zAQugBuPDlJFPPZmRH9jTMpbiRWK0

     

       5
       5
       -
       +uAFreWIkRtsYrOYaFOWIVOUxAl7immdbx7y55Q6u55y936t8aRRP+r8LCIsd+5E

     

       6
       6
       -
       dlWmxTRyYBXG4MNkCfyDeuvCnFxGFlmPXVqJeXyHBL+/Gw4nLzMvRM0PQqlkOLeS

     

       7
       7
       -
       DfJUpeWT0fptykuf7nmYr0sYembv4pks9E4lLNJ51PcdR2NqC4Aaq6s9+dM+b9Yg

     

       8
       8
       -
       p8Zg7HvCWxlSeNuf/gnu5jisj93ImrwJJSpkSv+AqThGkVtRpN6gzErSXPOQe9tn

     

       9
       9
       -
       RuESiumGO+Thh8+1F9iMitCm9pvVDkBrVDPmTBZS5xT8v67VcIcCmkmfh1Svq/di

     

       10
       10
       -
       dWhMereLu9oXd9Nudtg3uvlzWp68kCAQFjOVyhi6Li15FuPw+vvkc72c2OPv9AeZ

     

       11
       11
       -
       vNmIuaCHLa5VIPqOPJEaLGMuHSd80TFCAhYq4laca9gg6cgufyGlFCR4SVXA9qy8

     

       12
       12
       -
       Gi8SI+wdBbi5+RKveju2/58Wbas6oIqmP6IOgTibwYl3uQ8EE4YhG1QocChN553X

     

       13
       13
       -
       0pjhtSBTyXgVuy3bqz5eA4QAkCcDocwT/4R4eaNGLW0

     

       14
       14
       -
       -> ssh-ed25519 KjIL7g QPvc+LbTi8URL1atJNHHalHRyVGlz7pmrbOeMtjP6gM

     

       15
       15
       -
       lH3IhynTXpQ3Z4hFGn4bJZ/vEWte7qZqeAhixghjoe8

     

       16
       16
       -
       --- rIrWSZf0Q7b4fWtd9+gXxJpD9AoC0xWE7iWkUGCekDc

     

       17
       17
       -
       ��)����ϲX� 0)��J�!���x�'E���vp�O�N~�23x��"��(Q�0�f_]7��ב��V�e���]+_/;:ؿ�g<.rJ��>W�R�K"�L#��/��+�Ƴ3M*Õ��:�Q'L��-}�#�Y�p������I

     

       18
       18
       -
       ��Dm���{��ܫ�L��s��b�;�

     

       19
       19
       -
       c*�ݷ�u�m�����+^d�ؓ�0k2yty��>����������F�L&����qk����Ⱦ��c�Y'{�,�G�V��tS�I���7�W�� ��Qp���a�f{f�2O`x�=��y��7�ߓ�}��{=﷋�Í�O����P0�=f�P�B\p���l�.��F�����bm|Oл;-��ǾS�����Ғ�_Ԥ
     

       3
       3
       +
       SbNEqnr2eT0YR293LnQtJInXLmx7g+iCJwnZ4GmmEM2euePiEY69s8lRQUb7MQU8

     

       4
       4
       +
       xghOLEo/gr74/wtrOUf+4Ge3OM8KiAZt3QLuREJYz1xI6+gnMaievWbinAA+Ly0L

     

       5
       5
       +
       KdmFyshVGl+xKA0QPpc6fTO4XnAEH0g5Rg5upZoAfRARmOYeIQvXaWW2ehjI1Izw

     

       6
       6
       +
       RINcoszonp5egzZ9QJ6huruT2actz2XIAsZX/0NYQdjC6xmChxfTOxuXQskbzzyK

     

       7
       7
       +
       42eholIkf/5fYre4HmB7ePKuZeUeVRhK0RYemBq/ZNNUCf1ExjE/wDKTWpuPOafV

     

       8
       8
       +
       J2/7kP7OkwIEeEYXvLPvYM2HRasIbDUBmLOlj7L4E8BgMzKV7FmCr2n27m7iCjhz

     

       9
       9
       +
       y0sTpEk1y2N/rDvc/GCuZNtGNZIrbfzGaz5fhgegvO0Jogc2km4LVaEOQlA+AI5w

     

       10
       10
       +
       fxew6hCZkISaw+CjNaBOk45XXhMsONfW63uba6kgzj3h2+9jG1UmEPJAuNdgkjze

     

       11
       11
       +
       32lBZ58np+cA+aENt4sZu5nKk90Rsq54aNntfaHuFMFIfvK4RZj3HwHCAND+9XJ1

     

       12
       12
       +
       SNkNetcehX9jzZYm5Npnlhleft92TACYbtIIoi/zqgYMLDaHeAW6ZDAnW9sgO7mo

     

       13
       13
       +
       uSVwa8Gf5SwUY6v8IgVDwQVHiq8WTtRgRJmImP/mvS4

     

       14
       14
       +
       -> ssh-ed25519 KjIL7g tRXe9XXGtJyjCQuHU4oD7L5veJ8BKCFHUdXuSAa6/D4

     

       15
       15
       +
       vjVwtS7dKxTkjGHeLzV0G2uzIyEYaaSLplxOvfApIa0

     

       16
       16
       +
       -> ssh-ed25519 LaQclg 81iLpPZTOiW2ZNnfy8lErpeHiQoTtIpariQ5153Nwl4

     

       17
       17
       +
       5wqZUoo5CxEPHwVy9SSspvECTWAQ8qgjbj44WCx/kdw

     

       18
       18
       +
       --- z1wPplzF3WsIHxojXxcZnq91akMO+Hj1WFth2ujJAvY

     

       19
       19
       +
       �X RM�V˛a^�Z2A욓ר)h���h��	hV�Z��e&�.��l��ɉ/n�aIد-��q��(�id�
DT

     

       20
       20
       +
       �d�e��T�cHiɂ*^�4��+�?� �����y��-nD=��]��(������ѝG�Z���ɲ���P�w9�g��j>��d��Ϥ�������F�t�~��P�QS�,z�%Ad�E�t=�R�B�ُܱ~����7��ެ{1=������kOV=W3���e��CN��q�Ϥ���.\���n�wW����c�R;G

     

       21
       21
       +
       �6�f"�W����7f_�MZ;���.Х�Ѓ�@���3���Ǫ&,��1�ܕ�����]l�J�L!a֟��r��}9	��o@�.]��ƈ�fS����=�@��

+17 -16

secrets/persesSecret.age

···

       1
       1
        
       age-encryption.org/v1

     

       2
       2
        
       -> ssh-rsa Abmvag

     

       3
       3
       -
       gnRXwWRObKH5JCBDDPVRDHsgSj4m3zwOHAFLDAXTmWjs0mVNKSu5AFtKkoJuUuzs

     

       4
       4
       -
       RQFGn3b4pv6duPjpEW4t0DBkAOCwgqTqvF3oSKNBSDuhNU4+XzCJgBZDesO3VZ/S

     

       5
       5
       -
       zZxM8kq14sM484pZSRI0A86VNSlR7q8lyF1kth+bn5dum7Ihq87Re6jW+OyFwL7L

     

       6
       6
       -
       tkTON5L4aMqjI4fMQl/PcRU+04sYkKug6JQO/DDyFXvjvROuO43ZChjqGGj4ol9b

     

       7
       7
       -
       mXPOJuabzUtWGoTwg7+IHhbyUbanoO+2gCMejRGbZbBTh+bOftNx0bvNj8lrxgit

     

       8
       8
       -
       oE5sXhqPeI9BhOGWiJvR+32YdHl2WRYQ/7nNdWsnA0UuiPRHPu827g91NrVgjxBk

     

       9
       9
       -
       SpgoabwZpCUl8GlfihtTvw3NbV6WnIUv0ew9bwlyf129uvH7Rn61o0JMnq5m37Zt

     

       10
       10
       -
       rJjLJ262zIdb4eS1QgycI+ugeb290Vh22niTLLKoJxAFdLyzSr84XsfUVyrjhJfz

     

       11
       11
       -
       Ll+12c7ApTcgwhuhOkFLmU8SUNwxhH523fV8zcQ/1E9yjpa26qQcTF+ujRV8FIwb

     

       12
       12
       -
       kVGLDHUXehU5gm/nsuQVaULYHRC50pvu7wKKZsj0UqdQeKCx1CwBOdFk6Qctxl9N

     

       13
       13
       -
       VvAenIra/FVImcrimQ/sNCeg8UasT+gvbY5KjhwPzkY

     

       14
       14
       -
       -> ssh-ed25519 KjIL7g +FQdRCFxlkayD4Hq9xb4WCE139upxkpSrvh7412gqlo

     

       15
       15
       -
       jxDJlUgJZfftyeyhikKi4zLhtM6fVXxAGMmD7gcQZgM

     

       16
       16
       -
       --- OXRvMmNqRzo4NGF4ihpPSHu77W8dH45HwJJIDI3hUCY

     

       17
       17
       -
       &}͘8��;YX5

     

       18
       18
       -
       �$m3�1r['�%<7�����W�D��h�0�%��C$�Il1;ɛl�1�i�A��E�z��,n݆�|b�?2N�}�m/Ӈ�	
     

       3
       3
       +
       IC9ZInud32ueWR3owngph/eKReklaRfgY6bDKDmA0OT5IEvisOYK8lhGwAzOZdIq

     

       4
       4
       +
       i+K5p7C30qe1+1fmZ3ZNcQMKeIq79LdpiR7Xb6DT+BAT5g++wsXqqsvxZYyR4Ux7

     

       5
       5
       +
       dPxr05VJXE6HkoUQ2gcG/rlED1M7EoRq1TBm1UV4wIDiWy/ZdZZRvM8C++CD2h4V

     

       6
       6
       +
       d4cLoDzVZxYdi3s+NRXpbg62fIO//suAYvlMjbKQasEBWv88R8rwj5br+o/AbCR8

     

       7
       7
       +
       hkjctI+EuMHzq7hwlZ211hb/HDLnFckWmIao9Hvw6PpyFMIUmuQWsgn6yHQ6zJQx

     

       8
       8
       +
       zIXNgAYpX5bR8i0VXvwNwlfWOOqNcOU4QD7ZO4qFs+ZYTlHvo1m1RNhDIBbhC9UM

     

       9
       9
       +
       v3C8fU0RTaWhUkcacXn3VXBiJIHXzFLiAfxQ1ft5HPOjsOOhHwphMFwblCukTJ45

     

       10
       10
       +
       SNVErkK32YeW6J0nyQGHRNHNSgbZC274caZ8R3nlTynkYRoF6/dy7Q1OLNILF4Vd

     

       11
       11
       +
       qW54oLZs9A6ralFkDfObl4rxOcz4HPdwH9p/kWzW1C1IrfZk0m5eOppFzZ2fUHra

     

       12
       12
       +
       FED8mJ0vH5E0oCL7JBDVx3A+Ss5vj7zpJePL10UQvfWI8qUIXHZT6wbIt/XfRvtq

     

       13
       13
       +
       rbr0g9tQtnnpOMJwgu1GzL1xQWGelAS8pvV8GPb5Vvg

     

       14
       14
       +
       -> ssh-ed25519 KjIL7g 0DtiBKi0aL82kjE3AgAbwkCw+fuIWXMvzi52eem0JgM

     

       15
       15
       +
       ujkcowuy/vokA+jqV7d5RcZGeg2yhzh8IdQQHJ/wZns

     

       16
       16
       +
       -> ssh-ed25519 LaQclg m/1lrK8ks3LlAQYG0/85pZiyQvhh16/Y5bX+k9HPpgU

     

       17
       17
       +
       zJD9xgF9GuHGHYSkczPGllccYqW7y/+UZrlCveFJIt4

     

       18
       18
       +
       --- ZM1sl++OddBxYlx8/57o/BWcSsU3rHQ41q7cJCoZiPs

     

       19
       19
       +
       �C{���9�C�yC��'�]����P�X��n��ZD��}�q2�[�@�R8�h���'����a�:�B2X��}<5��D�����6�������p���*��

+11 -1

secrets/secrets.nix

···

       2
       2
        
         yusdacra = builtins.readFile ./yusdacra.key.pub;

     

       3
       3
        
         wolumonde = builtins.readFile ./wolumonde.key.pub;

     

       4
       4
        
         dzwonek = builtins.readFile ./dzwonek.key.pub;

     

       5
       5
       +
         trimounts = builtins.readFile ./trimounts.key.pub;

     

       5
       6
        
         develMobi = builtins.readFile ./develMobi.key.pub;

     

       6
       7
        
       in

     

       7
       8
        
       {

     
···

       9
       10
        
         "websiteConfig.age".publicKeys = [

     

       10
       11
        
           yusdacra

     

       11
       12
        
           wolumonde

     

       13
       13
       +
           trimounts

     

       12
       14
        
         ];

     

       13
       15
        
         "pdsConfig.age".publicKeys = [

     

       14
       16
        
           yusdacra

     

       15
       17
        
           wolumonde

     

       18
       18
       +
           trimounts

     

       16
       19
        
         ];

     

       17
       20
        
         "clickeeProxyConfig.age".publicKeys = [

     

       18
       21
        
           yusdacra

     

       19
       22
        
           wolumonde

     

       23
       23
       +
           trimounts

     

       20
       24
        
         ];

     

       21
       21
       -
         "deployWebhook.age".publicKeys = [ yusdacra ];

     

       22
       25
        
         "persesSecret.age".publicKeys = [

     

       23
       26
        
           yusdacra

     

       24
       27
        
           wolumonde

     

       28
       28
       +
           trimounts

     

       25
       29
        
         ];

     

       26
       30
        
         "headscaleOidcSecret.age".publicKeys = [

     

       27
       31
        
           yusdacra

     
···

       30
       34
        
         "develMobiTailscaleAuthKey.age".publicKeys = [

     

       31
       35
        
           yusdacra

     

       32
       36
        
           develMobi

     

       37
       37
       +
         ];

     

       38
       38
       +
         "cloudflareDnsEdit.age".publicKeys = [

     

       39
       39
       +
           yusdacra

     

       40
       40
       +
           dzwonek

     

       41
       41
       +
           wolumonde

     

       42
       42
       +
           trimounts

     

       33
       43
        
         ];

     

       34
       44
        
       }

+1

secrets/trimounts.key.pub

···

       1
       1
       +
       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDLuA1/cZ/xTN4dv5U0fvD9Glo6HlF5YA4U1pvFjxx6V

secrets/websiteConfig.age

This is a binary file and will not be displayed.

+1 -1

users/modules/discord/default.nix

···

       39
       39
        
       

     

       40
       40
        
           Service = {

     

       41
       41
        
             Type = "simple";

     

       42
       42
       -
             ExecStart = "${pkgs.openssh}/bin/ssh -N -D 127.0.0.1:1337 root@wolumonde";

     

       42
       42
       +
             ExecStart = "${pkgs.openssh}/bin/ssh -N -D 127.0.0.1:1337 root@trimounts";

     

       43
       43
        
             Restart = "on-failure";

     

       44
       44
        
             RestartSec = "3s";

     

       45
       45
        
           };