2024-07-30 12:07:43 +02:00
|
|
|
{
|
|
|
|
config,
|
|
|
|
_utils,
|
|
|
|
...
|
|
|
|
}: let
|
|
|
|
secrets = _utils.setupSharedSecrets config {
|
|
|
|
secrets = ["vmAuthToken"];
|
|
|
|
};
|
|
|
|
in {
|
|
|
|
imports = [
|
|
|
|
./common.nix
|
|
|
|
secrets.generate
|
|
|
|
];
|
2024-06-26 19:30:41 +02:00
|
|
|
|
2024-06-23 22:48:22 +02:00
|
|
|
_module.args.nixinate = {
|
|
|
|
host = config.networking.hostName;
|
2024-07-25 13:37:51 +02:00
|
|
|
sshUser = "leo";
|
2024-06-23 22:48:22 +02:00
|
|
|
buildOn = "remote";
|
|
|
|
substituteOnTarget = true;
|
2024-03-24 14:02:03 +01:00
|
|
|
hermetic = false; # hermetic fucks up for cross-system deployments
|
2024-06-23 22:48:22 +02:00
|
|
|
};
|
|
|
|
|
2024-06-20 16:49:12 +02:00
|
|
|
services = {
|
|
|
|
tailscale.extraUpFlags = ["--advertise-exit-node"];
|
|
|
|
|
|
|
|
openssh = {
|
|
|
|
enable = true;
|
|
|
|
settings = {
|
|
|
|
PermitRootLogin = "no";
|
|
|
|
PasswordAuthentication = false;
|
|
|
|
KbdInteractiveAuthentication = false;
|
|
|
|
X11Forwarding = false;
|
2024-08-17 19:00:00 +02:00
|
|
|
UseDns = false;
|
|
|
|
|
|
|
|
# Use key exchange algorithms recommended by `nixpkgs#ssh-audit`
|
|
|
|
KexAlgorithms = [
|
|
|
|
"curve25519-sha256"
|
|
|
|
"curve25519-sha256@libssh.org"
|
|
|
|
"diffie-hellman-group16-sha512"
|
|
|
|
"diffie-hellman-group18-sha512"
|
|
|
|
"sntrup761x25519-sha512@openssh.com"
|
|
|
|
];
|
2024-06-20 16:49:12 +02:00
|
|
|
};
|
|
|
|
};
|
2024-07-29 22:55:37 +02:00
|
|
|
|
|
|
|
prometheus.exporters.node = {
|
|
|
|
enable = true;
|
|
|
|
port = 9091;
|
|
|
|
enabledCollectors = ["systemd"];
|
|
|
|
};
|
2024-07-30 12:07:43 +02:00
|
|
|
|
|
|
|
vmagent = {
|
|
|
|
enable = true;
|
|
|
|
remoteWrite.url = "https://metrics.uku3lig.net/api/v1/write";
|
|
|
|
extraArgs = ["-remoteWrite.bearerToken $VM_AUTH_TOKEN"];
|
|
|
|
prometheusConfig = {
|
|
|
|
global.scrape_interval = "15s";
|
|
|
|
|
|
|
|
scrape_configs = [
|
|
|
|
{
|
|
|
|
job_name = "node";
|
|
|
|
static_configs = [{targets = ["localhost:${builtins.toString config.services.prometheus.exporters.node.port}"];}];
|
|
|
|
relabel_configs = [
|
|
|
|
{
|
|
|
|
target_label = "instance";
|
|
|
|
replacement = config.networking.hostName;
|
|
|
|
}
|
|
|
|
];
|
|
|
|
}
|
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
2024-06-20 16:49:12 +02:00
|
|
|
};
|
2024-07-30 12:07:43 +02:00
|
|
|
|
2024-08-17 19:00:00 +02:00
|
|
|
systemd = {
|
|
|
|
services.vmagent.serviceConfig.EnvironmentFile = secrets.get "vmAuthToken";
|
|
|
|
|
|
|
|
# For more detail, see:
|
|
|
|
# https://0pointer.de/blog/projects/watchdog.html
|
|
|
|
watchdog = {
|
|
|
|
# systemd will send a signal to the hardware watchdog at half the interval defined here, so every 10s.
|
|
|
|
# If the hardware watchdog does not get a signal for 20s, it will forcefully reboot the system.
|
|
|
|
runtimeTime = "20s";
|
|
|
|
# Forcefully reboot if the final stage of the reboot hangs without progress for more than 30s.
|
|
|
|
# For more info, see:
|
|
|
|
# https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdShutdownWatchdog
|
|
|
|
rebootTime = "30s";
|
|
|
|
};
|
|
|
|
|
|
|
|
sleep.extraConfig = ''
|
|
|
|
AllowSuspend=no
|
|
|
|
AllowHibernation=no
|
|
|
|
'';
|
|
|
|
};
|
2024-05-12 13:33:15 +02:00
|
|
|
}
|