logging: consolidate, flakify
This commit is contained in:
parent
ed69ee970f
commit
1f7aea3a28
|
@ -355,6 +355,14 @@
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
logging = nixosSystem' {
|
||||||
|
modules = [
|
||||||
|
./lib/lxc-container.nix
|
||||||
|
./hosts/containers/logging
|
||||||
|
];
|
||||||
|
system = "x86_64-linux";
|
||||||
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
nixosModule = import ./lib;
|
nixosModule = import ./lib;
|
||||||
|
|
|
@ -1,75 +0,0 @@
|
||||||
# Edit this configuration file to define what should be installed on
|
|
||||||
# your system. Help is available in the configuration.nix(5) man page
|
|
||||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
|
||||||
|
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
../../../lib
|
|
||||||
../../../lib/lxc-container.nix
|
|
||||||
../../../lib/shared.nix
|
|
||||||
../../../lib/admins.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
hostName = "elastic1";
|
|
||||||
interfaces.eth0.ipv4.addresses = [{
|
|
||||||
address = "172.20.73.15";
|
|
||||||
prefixLength = 26;
|
|
||||||
}];
|
|
||||||
defaultGateway = "172.20.73.1";
|
|
||||||
firewall = {
|
|
||||||
allowedTCPPorts = [ 22 9200 9300 ];
|
|
||||||
enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
nixpkgs.config.allowUnfree = true;
|
|
||||||
|
|
||||||
services.openssh = {
|
|
||||||
enable = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
services.elasticsearch = {
|
|
||||||
enable = true;
|
|
||||||
cluster_name = "zentralwerk";
|
|
||||||
dataDir = "/srv/elasticsearch";
|
|
||||||
listenAddress = "0.0.0.0";
|
|
||||||
extraJavaOptions = [ "-Xms2g" "-Xmx2g" ];
|
|
||||||
};
|
|
||||||
systemd.services.elasticsearch.serviceConfig.Restart = "always";
|
|
||||||
|
|
||||||
# does not work, needs to be set on hv (done through ansible)
|
|
||||||
boot.kernel.sysctl = { "vm.max_map_count" = "262144"; };
|
|
||||||
|
|
||||||
services.elasticsearch-curator = {
|
|
||||||
enable = true;
|
|
||||||
actionYAML = ''
|
|
||||||
---
|
|
||||||
actions:
|
|
||||||
1:
|
|
||||||
action: delete_indices
|
|
||||||
description: >-
|
|
||||||
Delete indices older than 45 days (based on index name), for logstash-
|
|
||||||
prefixed indices. Ignore the error if the filter does not result in an
|
|
||||||
actionable list of indices (ignore_empty_list) and exit cleanly.
|
|
||||||
options:
|
|
||||||
ignore_empty_list: True
|
|
||||||
disable_action: False
|
|
||||||
filters:
|
|
||||||
- filtertype: pattern
|
|
||||||
kind: prefix
|
|
||||||
value: logstash-
|
|
||||||
- filtertype: age
|
|
||||||
source: name
|
|
||||||
direction: older
|
|
||||||
timestring: '%Y.%m.%d'
|
|
||||||
unit: days
|
|
||||||
unit_count: 45
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
system.stateVersion = "20.09"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
|
@ -1,73 +0,0 @@
|
||||||
# Edit this configuration file to define what should be installed on
|
|
||||||
# your system. Help is available in the configuration.nix(5) man page
|
|
||||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
|
||||||
|
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
../../../lib
|
|
||||||
../../../lib/lxc-container.nix
|
|
||||||
../../../lib/shared.nix
|
|
||||||
../../../lib/admins.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
hostName = "logging";
|
|
||||||
interfaces.eth0.ipv4.addresses = [{
|
|
||||||
address = "172.20.73.13";
|
|
||||||
prefixLength = 26;
|
|
||||||
}];
|
|
||||||
defaultGateway = "172.20.73.1";
|
|
||||||
firewall = {
|
|
||||||
allowedTCPPorts = [ 22 9000 80 443 5044 12201 514 ];
|
|
||||||
allowedUDPPorts = [ 514 ];
|
|
||||||
enable = false;
|
|
||||||
};
|
|
||||||
dhcpcd.denyInterfaces = [ "eth1" ];
|
|
||||||
# interface for mgmt network
|
|
||||||
interfaces.eth1 = {
|
|
||||||
ipv4.addresses = [{
|
|
||||||
address = "10.0.0.251";
|
|
||||||
prefixLength = 24;
|
|
||||||
}];
|
|
||||||
useDHCP = false;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.openssh = {
|
|
||||||
enable = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts = {
|
|
||||||
default = { locations = { "/".proxyPass = "http://127.0.0.1:9000/"; }; };
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.graylog = {
|
|
||||||
enable = true;
|
|
||||||
passwordSecret =
|
|
||||||
"SDwK3ug9U4gYSVtj3h22i0l57QO6p5RE58sNehAgU3vXgqGa2HuNyhL19vhoUKFqy28rqGfDQkRD5834NqPi5wLsy8H1hz5V";
|
|
||||||
# mongo.serv.zentralwerk. ?
|
|
||||||
elasticsearchHosts = [ "http://elastic1.serv.zentralwerk.org:9200" ];
|
|
||||||
rootPasswordSha2 =
|
|
||||||
"3e784172684dcd89d66175b8719cd7894cc96b454ef1d5aa74bd92b3c57da7cd";
|
|
||||||
# mongo.serv.zentralwerk. ?
|
|
||||||
mongodbUri = "mongodb://mongo.serv.zentralwerk.org/graylog";
|
|
||||||
extraConfig = ''
|
|
||||||
http_bind_address = 0.0.0.0:9000
|
|
||||||
http_publish_uri = http://logging.serv.zentralwerk.org/
|
|
||||||
elasticsearch_shards = 1
|
|
||||||
allow_highlighting = true
|
|
||||||
allow_leading_wildcard_searches = true
|
|
||||||
'';
|
|
||||||
user = "root";
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.graylog.serviceConfig.Restart = "always";
|
|
||||||
|
|
||||||
system.stateVersion = "20.09"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
|
@ -0,0 +1,113 @@
|
||||||
|
{ hostRegistry, config, pkgs, lib, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
graylogPort = 9000;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
networking = {
|
||||||
|
hostName = "logging";
|
||||||
|
interfaces.eth0.ipv4.addresses = [{
|
||||||
|
address = hostRegistry.hosts.logging.ip4;
|
||||||
|
prefixLength = 26;
|
||||||
|
}];
|
||||||
|
defaultGateway = "172.20.73.1";
|
||||||
|
firewall = {
|
||||||
|
allowedTCPPorts = [ 22 80 443 5044 12201 514 ];
|
||||||
|
allowedUDPPorts = [ 514 ];
|
||||||
|
enable = false;
|
||||||
|
};
|
||||||
|
dhcpcd.denyInterfaces = [ "eth1" ];
|
||||||
|
# interface for mgmt network
|
||||||
|
interfaces.eth1 = {
|
||||||
|
ipv4.addresses = [{
|
||||||
|
address = "10.0.0.251";
|
||||||
|
prefixLength = 24;
|
||||||
|
}];
|
||||||
|
useDHCP = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Don't loop
|
||||||
|
services.journalbeat.enable = lib.mkForce false;
|
||||||
|
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
virtualHosts = {
|
||||||
|
"logging.serv.zentralwerk.org" = {
|
||||||
|
default = true;
|
||||||
|
enableACME = true;
|
||||||
|
forceSSL = true;
|
||||||
|
locations = { "/".proxyPass = "http://127.0.0.1:${toString graylogPort}/"; };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
services.graylog = {
|
||||||
|
enable = true;
|
||||||
|
passwordSecret =
|
||||||
|
"SDwK3ug9U4gYSVtj3h22i0l57QO6p5RE58sNehAgU3vXgqGa2HuNyhL19vhoUKFqy28rqGfDQkRD5834NqPi5wLsy8H1hz5V";
|
||||||
|
elasticsearchHosts = [ "http://localhost:9200" ];
|
||||||
|
rootPasswordSha2 =
|
||||||
|
"2bed7d6138c04098c05f492174c31d45d873f5146ad775e4c26a4863fa370d7d";
|
||||||
|
mongodbUri = "mongodb://localhost/graylog";
|
||||||
|
extraConfig = ''
|
||||||
|
http_bind_address = 127.0.0.1:${toString graylogPort}
|
||||||
|
http_publish_uri = https://logging.serv.zentralwerk.org/
|
||||||
|
elasticsearch_shards = 1
|
||||||
|
allow_highlighting = true
|
||||||
|
allow_leading_wildcard_searches = true
|
||||||
|
'';
|
||||||
|
user = "root";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.mongodb = {
|
||||||
|
enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
|
# noXlibs breaks cairo:
|
||||||
|
environment.noXlibs = false;
|
||||||
|
nixpkgs.config.allowUnfree = true;
|
||||||
|
services.elasticsearch = {
|
||||||
|
enable = true;
|
||||||
|
extraJavaOptions = [ "-Xms2g" "-Xmx2g" ];
|
||||||
|
};
|
||||||
|
systemd.services.elasticsearch.serviceConfig.Restart = "always";
|
||||||
|
|
||||||
|
# does not work, needs to be set on hv (done through ansible)
|
||||||
|
boot.kernel.sysctl = { "vm.max_map_count" = "262144"; };
|
||||||
|
|
||||||
|
services.elasticsearch-curator = {
|
||||||
|
enable = true;
|
||||||
|
actionYAML = ''
|
||||||
|
---
|
||||||
|
actions:
|
||||||
|
1:
|
||||||
|
action: delete_indices
|
||||||
|
description: >-
|
||||||
|
Delete indices older than 45 days (based on index name), for logstash-
|
||||||
|
prefixed indices. Ignore the error if the filter does not result in an
|
||||||
|
actionable list of indices (ignore_empty_list) and exit cleanly.
|
||||||
|
options:
|
||||||
|
ignore_empty_list: True
|
||||||
|
disable_action: False
|
||||||
|
filters:
|
||||||
|
- filtertype: pattern
|
||||||
|
kind: prefix
|
||||||
|
value: logstash-
|
||||||
|
- filtertype: age
|
||||||
|
source: name
|
||||||
|
direction: older
|
||||||
|
timestring: '%Y.%m.%d'
|
||||||
|
unit: days
|
||||||
|
unit_count: 45
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.graylog.serviceConfig.Restart = "always";
|
||||||
|
|
||||||
|
system.stateVersion = "21.05";
|
||||||
|
}
|
|
@ -1,42 +0,0 @@
|
||||||
# Edit this configuration file to define what should be installed on
|
|
||||||
# your system. Help is available in the configuration.nix(5) man page
|
|
||||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
|
||||||
|
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
../../../lib
|
|
||||||
../../../lib/lxc-container.nix
|
|
||||||
../../../lib/shared.nix
|
|
||||||
../../../lib/admins.nix
|
|
||||||
];
|
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [ mongodb-tools ];
|
|
||||||
|
|
||||||
networking = {
|
|
||||||
hostName = "mongo";
|
|
||||||
interfaces.eth0.ipv4.addresses = [{
|
|
||||||
address = "172.20.73.21";
|
|
||||||
prefixLength = 26;
|
|
||||||
}];
|
|
||||||
defaultGateway = "172.20.73.1";
|
|
||||||
firewall = {
|
|
||||||
allowedTCPPorts = [ 22 27017 ];
|
|
||||||
enable = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
services.openssh = {
|
|
||||||
enable = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
services.mongodb = {
|
|
||||||
enable = true;
|
|
||||||
bind_ip = "0.0.0.0";
|
|
||||||
dbpath = "/srv/mongodb";
|
|
||||||
};
|
|
||||||
|
|
||||||
system.stateVersion = "19.03"; # Did you read the comment?
|
|
||||||
|
|
||||||
}
|
|
Loading…
Reference in New Issue