xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

Browse source
This commit is contained in:
XenGi 2026-10-27 22:53:56 +01:00
commit 409e72cd85
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
4 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

12
flake.lock generated
View file

@ -7,11 +7,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1790734419, "lastModified": 1792507013,
"narHash": "sha256-n7wew722m1OTBT9DOIMxNX/NF4zfsSUABAO5eW3wikE=", "narHash": "sha256-8tKjSQajD3mUND1GaAuaWTcuyUpgcGsh5V+l4ibzC7U=",
"owner": "ryantm", "owner": "ryantm",
"repo": "agenix", "repo": "agenix",
"rev": "3daa710894355fa2fad8243380af373a2b4046ef", "rev": "5e5b88a0c8e56f291a108c2fe9934054d9745b2e",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -40,11 +40,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1791935857, "lastModified": 1793064696,
"narHash": "sha256-Zrhxwe8+HMRiDpjsOIoOIUvK6b8HCp3FL5R50N901hU=", "narHash": "sha256-IuHLjgL4i3x3q5VjIpVzRq3kI2kJqq1ogNTjOMQomHQ=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "952dd4355e1932709b993aa31de5e5b7bbe114f7", "rev": "4fb45a87dacd6124244d97a70dd04d0419964c33",
"type": "github" "type": "github"
}, },
"original": { "original": {

4
hosts/sql/prometheus-postgres.nix
View file

@ -7,9 +7,9 @@
runAsLocalSuperUser = true; runAsLocalSuperUser = true;
firewallRules = '' firewallRules = ''
ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de"
ip6 saddr 2a0a:4cc0:c2:b028::/64 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip6 saddr 2a03:4000:3b:28b::/64 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow uptime-kuma on mon.xengi.de"
ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de"
ip saddr 159.195.204.204/32 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip saddr 185.163.117.133/32 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept comment "Allow uptime-kuma on mon.xengi.de"
''; '';
}; };
} }

8
services/prometheus-nginx.nix
View file

@ -1,8 +1,8 @@
{ config, ... }: { config, ... }:
let let
kaede_ipv4 = "159.195.204.204/32"; mariko_ipv4 = "185.163.117.133/32";
kaede_ipv6 = "2a0a:4cc0:c2:b028::/64"; mariko_ipv6 = "2a03:4000:3b:28b::/64";
cccb_mon_ipv4 = "195.160.173.14/32"; cccb_mon_ipv4 = "195.160.173.14/32";
cccb_mon_ipv6 = "2001:678:760:cccb::14/128"; cccb_mon_ipv6 = "2001:678:760:cccb::14/128";
in in
@ -12,9 +12,9 @@ in
openFirewall = true; openFirewall = true;
firewallRules = '' firewallRules = ''
ip6 saddr ${cccb_mon_ipv6} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" ip6 saddr ${cccb_mon_ipv6} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de"
ip6 saddr ${kaede_ipv6} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip6 saddr ${mariko_ipv6} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de"
ip saddr ${cccb_mon_ipv4} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" ip saddr ${cccb_mon_ipv4} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de"
ip saddr ${kaede_ipv4} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip saddr ${mariko_ipv4} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de"
''; '';
}; };
} }

8
services/prometheus-node.nix
View file

@ -1,8 +1,8 @@
{ config, ... }: { config, ... }:
let let
kaede_ipv4 = "159.195.204.204/32"; mariko_ipv4 = "185.163.117.133/32";
kaede_ipv6 = "2a0a:4cc0:c2:b028::/64"; mariko_ipv6 = "2a03:4000:3b:28b::/64";
cccb_mon_ipv4 = "195.160.173.14/32"; cccb_mon_ipv4 = "195.160.173.14/32";
cccb_mon_ipv6 = "2001:678:760:cccb::14/128"; cccb_mon_ipv6 = "2001:678:760:cccb::14/128";
in in
@ -12,9 +12,9 @@ in
openFirewall = true; openFirewall = true;
firewallRules = '' firewallRules = ''
ip6 saddr ${cccb_mon_ipv6} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" ip6 saddr ${cccb_mon_ipv6} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de"
ip6 saddr ${kaede_ipv6} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip6 saddr ${mariko_ipv6} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de"
ip saddr ${cccb_mon_ipv4} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" ip saddr ${cccb_mon_ipv4} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de"
ip saddr ${kaede_ipv4} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" ip saddr ${mariko_ipv4} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de"
''; '';
enabledCollectors = [ ]; enabledCollectors = [ ];
disabledCollectors = [ ]; disabledCollectors = [ ];