95 lines
2.6 KiB
Nix
95 lines
2.6 KiB
Nix
{ config, ... }:
|
|
|
|
# Dashboards:
|
|
# - Synapse: https://github.com/element-hq/synapse/tree/master/contrib/grafana
|
|
|
|
let
|
|
fqdn = "monitoring.${config.networking.domain}";
|
|
in
|
|
{
|
|
imports = [
|
|
../../services/nginx.nix
|
|
../../services/prometheus-nginx.nix
|
|
];
|
|
|
|
services = {
|
|
grafana = {
|
|
enable = true;
|
|
settings = {
|
|
server = {
|
|
domain = fqdn;
|
|
enable_gzip = true;
|
|
enforce_domain = true;
|
|
root_url = "https://${fqdn}:443/";
|
|
protocol = "socket";
|
|
socket_mode = "0666";
|
|
};
|
|
database = {
|
|
type = "postgres";
|
|
name = "grafana";
|
|
user = "grafana";
|
|
host = "sql.berlin.ccc.de:5432";
|
|
password = "$__file{${config.age.secrets.postgres-grafana.path}}";
|
|
};
|
|
security = {
|
|
secret_key = "$__file{${config.age.secrets.grafana_secret_key.path}}";
|
|
admin_user = "xengi";
|
|
admin_password = "$__file{${config.age.secrets.grafana_admin_password.path}}";
|
|
admin_email = "cccb-grafana@xengi.de";
|
|
cookie_samesite = "strict";
|
|
cookie_secure = true;
|
|
disable_gravatar = true;
|
|
strict_transport_security = true;
|
|
strict_transport_security_preload = true;
|
|
strict_transport_security_subdomains = true;
|
|
x_xss_protection = true;
|
|
};
|
|
analytics = {
|
|
reporting_enabled = false;
|
|
feedback_links_enabled = false;
|
|
};
|
|
};
|
|
provision = {
|
|
enable = true;
|
|
datasources.settings.datasources = [
|
|
{
|
|
name = "Prometheus";
|
|
type = "prometheus";
|
|
url = "http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}";
|
|
jsonData = {
|
|
httpMethod = "GET";
|
|
prometheusType = "Prometheus";
|
|
cacheLevel = "High";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
nginx.virtualHosts."monitoring.${config.networking.domain}" = {
|
|
default = true;
|
|
quic = true;
|
|
kTLS = true;
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
#extraConfig = ''
|
|
# map $http_upgrade $connection_upgrade {
|
|
# default upgrade;
|
|
# \'\' close;
|
|
# }
|
|
#'';
|
|
locations = {
|
|
"/" = {
|
|
basicAuthFile = config.age.secrets.grafana_basic_auth.path;
|
|
proxyPass = "http://unix:/run/grafana/grafana.sock";
|
|
recommendedProxySettings = true;
|
|
};
|
|
"/api/live/" = {
|
|
proxyPass = "http://unix:/run/grafana/grafana.sock";
|
|
recommendedProxySettings = true;
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|