115 lines
3.1 KiB
Nix
115 lines
3.1 KiB
Nix
{ zentralwerk, config, pkgs, lib, ... }:
|
|
|
|
{
|
|
sops.defaultSopsFile = ./secrets.yaml;
|
|
|
|
networking = {
|
|
hostName = "prometheus";
|
|
firewall = {
|
|
allowedTCPPorts = [ 22 80 443 9090 9091 9093 9094 ];
|
|
enable = true;
|
|
};
|
|
};
|
|
|
|
services.prometheus = {
|
|
enable = true;
|
|
retentionTime = "7d";
|
|
|
|
alertmanager = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
webExternalUrl = "https://prometheus.serv.zentralwerk.org/alertmanager/";
|
|
listenAddress = "0.0.0.0";
|
|
configuration = {
|
|
"global" = {
|
|
"smtp_smarthost" = "mail.serv.zentralwerk.org:587";
|
|
"smtp_from" = "alertmanager@prometheus.serv.zentralwerk.org";
|
|
};
|
|
"route" = {
|
|
"group_by" = [ "alertname" "alias" ];
|
|
"group_wait" = "30s";
|
|
"group_interval" = "2m";
|
|
"repeat_interval" = "4h";
|
|
"receiver" = "team-admins";
|
|
};
|
|
"receivers" = [{
|
|
"name" = "team-admins";
|
|
# "email_configs" = [
|
|
# {
|
|
# "to" = "devnull@example.com";
|
|
# "send_resolved" = true;
|
|
# }
|
|
# ];
|
|
# "webhook_configs" = [
|
|
# {
|
|
# "url" = "https://example.com/prometheus-alerts";
|
|
# "send_resolved" = true;
|
|
# }
|
|
# ];
|
|
}];
|
|
};
|
|
};
|
|
|
|
# alertmanagerURL = [ "https://prometheus.serv.zentralwerk.org/alertmanager/" ];
|
|
|
|
pushgateway = {
|
|
enable = true;
|
|
web.external-url = "https://prometheus.serv.zentralwerk.org/push/";
|
|
};
|
|
|
|
scrapeConfigs = [ {
|
|
# TODO: authorization?
|
|
job_name = "node";
|
|
scrape_interval = "1m";
|
|
static_configs =
|
|
let
|
|
zwNets = zentralwerk.lib.config.site.net;
|
|
fromNet = net: filter:
|
|
map (host:
|
|
"${host}.${net}.zentralwerk.org:9100"
|
|
) (builtins.attrNames zwNets.${net}.hosts4);
|
|
in [ {
|
|
targets =
|
|
fromNet "serv" (_: true);
|
|
labels.__meta_net = "net-serv";
|
|
} {
|
|
targets =
|
|
fromNet "flpk" (host: host != "flpk-gw");
|
|
labels.__meta_net = "net-flpk";
|
|
} {
|
|
targets =
|
|
fromNet "cluster" (host: builtins.elem host [
|
|
"server8" "server9" "server10"
|
|
]);
|
|
labels.__meta_net = "net-flpk";
|
|
} ];
|
|
} ];
|
|
|
|
exporters.collectd.enable = true;
|
|
exporters.collectd.openFirewall = true;
|
|
|
|
exporters.nginx.enable = true;
|
|
exporters.nginx.openFirewall = true;
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
|
|
virtualHosts."prometheus.serv.zentralwerk.org" = {
|
|
# serverAliases = [ "registry.serv.zentralwerk.org" ];
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:9090";
|
|
extraConfig = ''
|
|
auth_basic "Prometheus";
|
|
auth_basic_user_file ${config.sops.secrets."nginx/httpAuth".path};
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
sops.secrets."nginx/httpAuth".owner = config.systemd.services.nginx.serviceConfig.User;
|
|
|
|
system.stateVersion = "22.11"; # Did you read the comment?
|
|
}
|