From 5fae8ca63b29c220e527616000427d2a862e6e51 Mon Sep 17 00:00:00 2001 From: makefu Date: Sat, 24 Dec 2016 23:42:19 +0100 Subject: m 2 elchos/stats: krebs.nginx -> services.nginx --- makefu/2configs/elchos/stats.nix | 86 +++++++++++++++------------------------- 1 file changed, 33 insertions(+), 53 deletions(-) (limited to 'makefu') diff --git a/makefu/2configs/elchos/stats.nix b/makefu/2configs/elchos/stats.nix index 9f27b6647..b6133205f 100644 --- a/makefu/2configs/elchos/stats.nix +++ b/makefu/2configs/elchos/stats.nix @@ -1,73 +1,48 @@ { config, lib, pkgs, ... }: +# requires nsupdate to get correct hostname (from ./search.nix) # graphite-web on port 8080 # carbon cache on port 2003 (tcp/udp) + with import ; -let - sec = toString ; - acmepath = "/var/lib/acme/"; - acmechall = acmepath + "/challenges/"; - ext-dom = "stats.nsupdate.info"; - #ssl_cert = "${sec}/wildcard.krebsco.de.crt"; - #ssl_key = "${sec}/wildcard.krebsco.de.key"; - ssl_cert = "${acmepath}/${ext-dom}/fullchain.pem"; - ssl_key = "${acmepath}/${ext-dom}/key.pem"; -in { - networking.firewall = { - allowedTCPPorts = [ 2003 80 443 ]; - allowedUDPPorts = [ 2003 ]; +{ + + services.nginx = { + enable = mkDefault true; + virtualHosts = { + "stats.nsupdate.info" = { + enableACME = true; + forceSSL = true; + + locations = { + "/" = { + proxyPass = "http://localhost:3000/"; + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + ''; + }; + }; + }; + }; }; services.grafana = { enable = true; addr = "127.0.0.1"; - extraOptions = { "AUTH_ANONYMOUS_ENABLED" = "true"; }; users.allowSignUp = false; users.allowOrgCreate = false; users.autoAssignOrg = false; + auth.anonymous.enable = true; security = import ; # { AdminUser = ""; adminPassword = ""} }; - krebs.nginx = { - enable = true; - servers.elch-stats = { - server-names = [ ext-dom ]; - listen = [ "80" "443 ssl" ]; - ssl = { - enable = true; - # these certs will be needed if acme has not yet created certificates: - certificate = ssl_cert; - certificate_key = ssl_key; - force_encryption = true; - }; - - locations = [ - (nameValuePair "/" '' - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_pass http://localhost:3000/; - '') - (nameValuePair "/.well-known/acme-challenge" '' - root ${acmechall}/${ext-dom}/; - '') - ]; - }; - }; - - security.acme.certs."${ext-dom}" = { - email = "acme@syntax-fehler.de"; - webroot = "${acmechall}/${ext-dom}/"; - group = "nginx"; - allowKeysForGroup = true; - postRun = "systemctl reload nginx.service"; - extraDomains."${ext-dom}" = null ; - }; services.graphite = { - web = { + api = { enable = true; - host = "127.0.0.1"; - port = 8080; + listenAddress = "127.0.0.1"; + port = 18080; }; carbon = { enableCache = true; @@ -85,7 +60,7 @@ in { [elchos] patterhn = ^elchos\. - retention = 10s:30d,60s:1y + retentions = 10s:30d,60s:3y [default] pattern = .* @@ -93,4 +68,9 @@ in { ''; }; }; + + networking.firewall = { + allowedTCPPorts = [ 2003 80 443 ]; + allowedUDPPorts = [ 2003 ]; + }; } -- cgit v1.2.3