From 8238a74057ca38b8b6867863b675cf6567801c30 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Sun, 20 Sep 2026 00:19:05 +0200 Subject: [PATCH] foo --- services/prometheus-nginx.nix | 14 ++++++++++---- services/prometheus-node.nix | 14 ++++++++++---- 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/services/prometheus-nginx.nix b/services/prometheus-nginx.nix index bba40a4..58b028e 100644 --- a/services/prometheus-nginx.nix +++ b/services/prometheus-nginx.nix @@ -1,14 +1,20 @@ { config, ... }: +let + kaede_ipv4 = "159.195.204.204/32"; + kaede_ipv6 = "2a0a:4cc0:c2:b028::/64"; + cccb_mon_ipv4 = "195.160.173.14/32"; + cccb_mon_ipv6 = "2001:678:760:cccb::14/128"; +in { services.prometheus.exporters.nginx = { enable = true; openFirewall = true; firewallRules = '' - ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip6 saddr 2a0a:4cc0:c2:b028::/64 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" - ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip saddr 159.195.204.204/32 tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip6 saddr ${cccb_mon_ipv6} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" + ip6 saddr ${kaede_ipv6} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip saddr ${cccb_mon_ipv4} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" + ip saddr ${kaede_ipv4} tcp dport ${toString config.services.prometheus.exporters.nginx.port} accept comment "Allow uptime-kuma on mon.xengi.de" ''; }; } diff --git a/services/prometheus-node.nix b/services/prometheus-node.nix index a840d3e..acce6a3 100644 --- a/services/prometheus-node.nix +++ b/services/prometheus-node.nix @@ -1,14 +1,20 @@ { config, ... }: +let + kaede_ipv4 = "159.195.204.204/32"; + kaede_ipv6 = "2a0a:4cc0:c2:b028::/64"; + cccb_mon_ipv4 = "195.160.173.14/32"; + cccb_mon_ipv6 = "2001:678:760:cccb::14/128"; +in { services.prometheus.exporters.node = { enable = true; openFirewall = true; firewallRules = '' - ip6 saddr 2001:678:760:cccb::14/128 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip6 saddr 2a0a:4cc0:c2:b028::/64 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" - ip saddr 195.160.173.14/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" - ip saddr 159.195.204.204/32 tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip6 saddr ${cccb_mon_ipv6} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" + ip6 saddr ${kaede_ipv6} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" + ip saddr ${cccb_mon_ipv4} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow prometheus on monitoring.berlin.ccc.de" + ip saddr ${kaede_ipv4} tcp dport ${toString config.services.prometheus.exporters.node.port} accept comment "Allow uptime-kuma on mon.xengi.de" ''; enabledCollectors = [ ]; disabledCollectors = [ ];