Global nginx and letsencrypt config

common/default.nix

@@ -72,5 +72,16 @@
     permitRootLogin = "yes";
   };
 
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "vcp-letsencrypt@clerie.de";
+  services.nginx = {
+   enable = true;
+   clientMaxBodySize = "400M";
+   recommendedGzipSettings = true;
+   recommendedOptimisation = true;
+   recommendedProxySettings = true;
+   recommendedTlsSettings = true;
+  };
+
   security.sudo.wheelNeedsPassword = false;
 }

flake.nix

@@ -21,6 +21,10 @@
         deployment.targetUser = null;
       };
 
+      monitoring = { config, pkgs, ... }: {
+        deployment.targetHost = "monitoring.bula22.de";
+      };
+
       nixdeploy = {...}: {
         deployment.targetHost = "nixdeploy.bula22.de";
         deployment.allowLocalDeployment = true;

hosts/monitoring/alertmanager-rules.yml

@@ -0,0 +1,11 @@
+groups:
+- name: alert.rules
+  rules:
+  - alert: InstanceDown
+    expr: up{job="node-exporter"} == 0
+    for: 5m
+    labels:
+      severity: critical
+    annotations:
+      summary: "Endpoint {{ $labels.instance }} down"
+      description: "{{ $labels.instance }} of job {{ $labels.job }} has been down for more than 5 minutes."

hosts/monitoring/configuration.nix

@@ -6,13 +6,18 @@ with lib;
     [
       ./hardware-configuration.nix
     ];
-  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
-  boot.loader.grub.device = "/dev/sda";
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
   networking.hostName = "monitoring";
   networking.useDHCP = false;
-  networking.interfaces.ens18.ipv4.addresses = [ { address = ""; prefixLength = 24; } ];
-  networking.interfaces.ens18.ipv6.addresses = [ { address = ""; prefixLength = 64; } ];
+  networking.interfaces.ens18.ipv4.addresses = [
+    {address = "10.42.10.7"; prefixLength = 24; }
+  ];
+  networking.interfaces.ens18.ipv6.addresses = [
+    {address = "2a01:4f8:1c0c:8221::7"; prefixLength = 64; }
+    {address = "2a01:4f8:1c0c:8221::1984"; prefixLength = 64; }
+  ];
   networking.defaultGateway = { address = "10.42.10.1"; interface = "ens18"; };
   networking.defaultGateway6 = { address = "2a01:4f8:1c0c:8221::1"; interface = "ens18"; };
   networking.nameservers = [ "2a01:4f8:1c0c:8221::1" "10.42.10.1" ];
@@ -21,7 +26,17 @@ with lib;
     enable = true;
     listenAddress = "[::1]";
     port = 9093;
-    configuration = {};
+    configuration = {
+      route = {
+        receiver = "default";
+        group_by = [ "instance" ];
+      };
+      receivers = [
+        {
+          name = "default";
+        }
+      ];
+    };
   };
   services.prometheus = {
     enable = true;
@@ -60,7 +75,7 @@ with lib;
         } ];
       }
     ];
-    rules = [ (readFile ./rules.yml) ];
+    rules = [ (readFile ./alertmanager-rules.yml) ];
   };
   services.grafana = {
     enable  = true;
@@ -79,11 +94,7 @@ with lib;
           isDefault = true;
         }
       ];
-      dashboards = [
-        {
-          options.path = ./dashboards;
-        }
-      ];
+      dashboards = [];
     };
   };
   services.nginx = {
@@ -102,5 +113,6 @@ with lib;
     };
   };
   networking.firewall.allowedTCPPorts = [ 80 443 ];
-  system.stateVersion = "";
+
+  system.stateVersion = "22.05";
 }

hosts/monitoring/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/121f5b0c-2726-4d38-befe-52a27ef310a8";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/E1EE-618A";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}