radiobert: feed adsb to chaos-consulting

flake.lock

@@ -327,11 +327,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1640393547,
+        "lastModified": 1640802687,
-        "narHash": "sha256-UCCzxswpYTBW5Iv56rhtydsgrpvul0cAfxysCWmVgYk=",
+        "narHash": "sha256-ITEKxmlg4ectAqSp8mM3M/VCHu973UEcdt8yDb+hzDg=",
         "ref": "master",
-        "rev": "9a1eef32664986af8797eab1b14b273d90faf6e6",
+        "rev": "6ae85faf2f864c6a004915cce7d071e827dda314",
-        "revCount": 114,
+        "revCount": 115,
         "type": "git",
         "url": "ssh://gitea@gitea.c3d2.de/c3d2-admins/secrets.git"
       },

flake.nix

@@ -252,7 +252,11 @@
         radiobert = nixosSystem' {
           modules = [
             "${inputs.nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
-            { nixpkgs.overlays = [ heliwatch.overlay ]; }
+            {
+              nixpkgs.overlays = [ heliwatch.overlay ];
+              sops.defaultSopsFile = "${secrets}/hosts/radiobert/secrets.yaml";
+            }
+            sops-nix.nixosModules.sops
             ./hosts/radiobert
           ];
           system = "aarch64-linux";

hosts/radiobert/base.nix

@@ -75,6 +75,7 @@
     buildCores = 4;
     maxJobs = 2;
   };
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   networking = {
     hostName = "radiobert"; # Define your hostname.

hosts/radiobert/readsb.nix

@@ -4,11 +4,30 @@ let
   lat = "51.081";
   lon = "13.728";
   altitude = "150";
+
+  makeMlatClientService = args: {
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "readsb.service" ];
+    serviceConfig = {
+      User = "mlat-client";
+      Group = "adsb";
+      ProtectHome = true;
+      Restart = "always";
+      RestartSec = "10s";
+    };
+    path = with pkgs; [ mlat-client ];
+    script = ''
+      mlat-client --input-type beast --input-connect localhost:30005 --lat ${lat} --lon ${lon} --alt ${altitude} ${args}
+    '';
+  };
 in {
   boot.blacklistedKernelModules = [
     # no watching TV intended
     "dvb_usb_rtl28xxu"
   ];
+  sops.secrets = {
+    "chaos-consulting/user".owner = "mlat-client";
+  };
   users.users.readsb = {
     isSystemUser = true;
     group = "adsb";
@@ -32,19 +51,9 @@ in {
     group = "adsb";
   };
   # Feeds adsbexchange.com, test at https://www.adsbexchange.com/myip/
-  systemd.services.mlat-client = {
+  systemd.services.mlat-client-adsbexchange = makeMlatClientService "--server feed.adsbexchange.com:31090 --user C3D2";
-    wantedBy = [ "multi-user.target" ];
+  # Feeds https://adsb.chaos-consulting.de/map/
-    requires = [ "mlat-client.service" ];
+  systemd.services.mlat-client-chaos-consulting = makeMlatClientService "--server feed.adsbexchange.com:31090 --user \"$(cat ${config.sops.secrets."chaos-consulting/user".path})\"";
-    serviceConfig = {
-      ExecStart = "${pkgs.mlat-client}/bin/mlat-client --input-type beast --input-connect radiobert.serv.zentralwerk.org:30005 --lat ${lat} --lon ${lon} --alt ${altitude} --user C3D2";
-      User = "mlat-client";
-      Group = "adsb";
-      ProtectSystem = "full";
-      ProtectHome = true;
-      Restart = "always";
-      RestartSec = "10s";
-    };
-  };
 
   users.users.sbs2json = {
     isSystemUser = true;
@@ -65,6 +74,33 @@ in {
     };
   };
 
+  systemd.services.feed-chaos-consulting = {
+    wantedBy = [ "multi-user.target" ];
+    requires = [ "sbs2json.service" ];
+    serviceConfig = {
+      User = "mlat-client";
+      Group = "adsb";
+      ProtectHome = true;
+      Restart = "always";
+      RestartSec = "10s";
+    };
+    path = with pkgs; [ curl gzip ];
+    script = ''
+      while curl -s http://localhost:8080/data.json \
+          | gzip -c \
+          | curl -s \
+            -u "$(cat ${config.sops.secrets."chaos-consulting/user".path})" \
+            -X POST \
+            -H "Content-type: application/json" \
+            -H "Content-encoding: gzip" \
+            --data-binary @- \
+            https://adsb.chaos-consulting.de/aircraftin/index.php
+      do
+        sleep 1
+      done
+    '';
+  };
+
   users.users.dump1090-influxdb = {
     isSystemUser = true;
     group = "adsb";