-

oluceps · Mar 9, 2024 · cf7b796 · cf7b796
1 parent 240bf9d
commit cf7b796
Show file tree

Hide file tree

Showing 11 changed files with 141 additions and 7 deletions.
diff --git a/home/home.nix b/home/home.nix
@@ -71,6 +71,7 @@
   home.packages = with pkgs;
 
     [
+      qq
       gtkcord4
       celeste
       stellarium

diff --git a/home/programs/sway/default.nix b/home/programs/sway/default.nix
@@ -144,6 +144,11 @@
               mode = "2160x1440";
               scale = "2";
             };
+            HDMI-A-1 = {
+              bg = "/home/${user}/Src/nixos/.attachs/wall.jpg fill";
+              mode = "2560x1660";
+              scale = "2";
+            };
           } else {
 
             eDP-1 = {

diff --git a/hosts/hastur/prometheus.nix b/hosts/hastur/prometheus.nix
@@ -0,0 +1,90 @@
+{ config, pkgs, lib, data, ... }:
+let
+  # cfg = config.services.prometheus;
+  targets = map (n: "${n}.nyaw.xyz") data.withoutHeads;
+in
+{
+  services.prometheus = {
+    enable = true;
+    webExternalUrl = "https://${config.networking.fqdn}/prom";
+    listenAddress = "127.0.0.1";
+    port = 9090;
+    retentionTime = "7d";
+    globalConfig = {
+      scrape_interval = "1m";
+      evaluation_interval = "1m";
+    };
+    scrapeConfigs = [
+      # {
+      #   job_name = "metrics";
+      #   scheme = "https";
+      #   basic_auth = {
+      #     username = "prometheus";
+      #     password_file = config.sops.secrets.prometheus.path;
+      #   };
+      #   static_configs = [{ inherit targets; }];
+      # }
+      {
+        job_name = "caddy";
+        scheme = "https";
+        basic_auth = {
+          username = "prometheus";
+          password_file = config.age.secrets.wg.path;
+        };
+        metrics_path = "/caddy";
+        static_configs = [{ inherit targets; }];
+      }
+      {
+        job_name = "dns";
+        scheme = "http";
+        # basic_auth = {
+        #   username = "prometheus";
+        #   password_file = config.sops.secrets.prometheus.path;
+        # };
+        metrics_path = "/metric";
+        static_configs = [{ targets = [ "hastur.nyaw.xyz:9092" ]; }];
+        # relabel_configs = [{
+        #   source_labels = [ "__param_target" ];
+        #   target_label = "target";
+        # }];
+      }
+
+    ];
+    rules = lib.singleton (builtins.toJSON {
+      groups = [{
+        name = "metrics";
+        rules = [
+          {
+            alert = "NodeDown";
+            expr = ''up == 0'';
+          }
+          {
+            alert = "OOM";
+            expr = ''node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes < 0.1'';
+          }
+          {
+            alert = "DiskFull";
+            expr = ''node_filesystem_avail_bytes{mountpoint=~"/persist|/data"} / node_filesystem_size_bytes < 0.1'';
+          }
+          {
+            alert = "UnitFailed";
+            expr = ''node_systemd_unit_state{state="failed"} == 1'';
+          }
+        ];
+      }];
+    });
+    # alertmanagers = [{
+    #   static_configs = [{
+    #     targets = [ "127.0.0.1:8009" ];
+    #   }];
+    # }];
+  };
+
+  # cloud.services.prometheus-ntfy-bridge.config = {
+  #   ExecStart = "${pkgs.deno}/bin/deno run --allow-env --allow-net --no-check ${../../../fn/alert.ts}";
+  #   MemoryDenyWriteExecute = false;
+  #   EnvironmentFile = [ config.sops.secrets.alert.path ];
+  #   Environment = [ "PORT=8009" "DENO_DIR=/tmp" ];
+  # };
+
+}
diff --git a/hosts/kaambl/hardware.nix b/hosts/kaambl/hardware.nix
@@ -146,7 +146,7 @@
       "amd_pstate=active"
       "zswap.enabled=1"
       "zswap.zpool=zsmalloc"
-      "systemd.gpt_auto=0"
+      # "systemd.gpt_auto=0"
       "noresume"
     ];
     extraModulePackages = with config.boot.kernelPackages; [

diff --git a/modules/caddy.nix b/modules/caddy.nix
@@ -36,14 +36,8 @@ in
 
       serviceConfig = {
         Type = "notify";
-        ExecStartPre = pkgs.writeShellScript "init-caddy" ''
-          set -euo pipefail
-          umask u=rwx,g=,o=
-          ${utils.genJqSecretsReplacementSnippet cfg.settings "/var/lib/caddy/config.json"}
-        '';
         ExecStart = "${cfg.package}/bin/caddy run --config /var/lib/caddy/config.json";
         ExecReload = "${cfg.package}/bin/caddy reload --force --config /var/lib/caddy/config.json";
-        # DynamicUser = true;
         User = "root";
         StateDirectory = "caddy";
         AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

diff --git a/sec/metric.age b/sec/metric.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> X25519 VYknc7h4HfiLcFbJYnuMHDyf2X9yzOFcn1c8m9EmkHM
+PwWZFNPANz4HyUYeJT6KbXbBEaQ0SqxV9dQsLT0M6+k
+-> piv-p256 fV1VQA A9gtnflSQ/YFQhMJKzBtMQ/vy4/igTm5OylXbJq19sJO
+dtxLsOMqLZPEzM/t7oCDrzuUpWKFIUPMbtRinvpcVgM
+-> "-grease g _q| w7y/<[[ 6M
+scD/5Hn0k95bc5dGwnR2/bs8f1FKHgRFd2lD1HEJOuQE/3v7PjdVLTXaOcfFxTzy
+Yi/QYXiWftUNt53nSRjc4mI
+--- LFCT5b8UehCsebde4jjp5J2uyDqfhRvPnPxnGbka6+w
+��cau%��%6:1'Y<B==PQw
+z5<��0�`�EU�S��w���c��G�K��7L��( ��mt�
diff --git a/sec/rekeyed/colour/a1e0f81d0a5117da5add01bef725edb5-metric.age b/sec/rekeyed/colour/a1e0f81d0a5117da5add01bef725edb5-metric.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 vL61NA rYY/817cb+089OcXrknLYq2G2sWr0X7gRR2A69so0Fs
+z9rAAV5OYMfmfBHH4LhwOGjTpRjKMyPnkEwDA/B8AEE
+-> ]h-&<*K-grease &
+PHFhzL+WA4g6YG/od0G96+B+fw0lFGKq7xGhQyCSqNYf3p6t3zsv4WDTxPsuHVgr
+Q73X4OOYlPxeKREISTCho/FV/Q
+--- rbVNc592e8RMDp6C9hHREQLAKqkHmlxczLrsBHEg8Xc
+��'�XQǩ-Z�|��t�dd��49~�E��x�4�\Ϳn����du��ë��e7�`���V�$Ct��jd��At

diff --git a/sec/rekeyed/eihort/26364ed5718e377cf6a73de78489fb41-metric.age b/sec/rekeyed/eihort/26364ed5718e377cf6a73de78489fb41-metric.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 /dedbw NDAy8ryRtr2v3m2gRfg9P+ap0yt6uRu7Vf8H+evkCw8
+rsHfNX4FdX5fgLToU6bVEJ8wzu6a/vNgcTXG98btGKI
+-> )-grease }30#z$f% D95>]x*g Kl5
+/l+093ryeukn3MHerfyMf1gUeiC8lejqESTxMPKq/dU6GIr5jwtcEZPeZkfy7H/2
++Mn+9MhSlKjlxaEm3ZiFrDfhSxAnXbxxLOMQZX7WjbEYT+5GchQj5Q
+--- vmaY1hYdK2dMQfeIKdaon8Go/A4boGZWu9cYdbrNEZw
+H�TØ*�\/>S<��ewH�."�c|�eA�)�������sˤrk5�C-<[ME
+���H�Iz>^�O��oE�5wg�נ��
+
diff --git a/sec/rekeyed/hastur/111c06a823aaaf52d54b9d8165d0ba5f-metric.age b/sec/rekeyed/hastur/111c06a823aaaf52d54b9d8165d0ba5f-metric.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 9tTW2g lkL759nBtevxnwVaA5BNdwEyd3SQqQTg/LvVXXdBIGs
+81PXhWvBGzTBr0whR986bbfxx8vS2q2bDQxJg2M/ONc
+-> M$a`h+V-grease &JFI
+asry39BESin9ggAt7ciMOaFE4yxSqFh5r7mFGKc
+--- hujsM+1j0FmPEV+kc0vvrCNW/2eKoFCtsQL1kzfEsIk
+�>�t~�+U�e�(�ws]*����q��M��B���~>���9%����ģ��t���1ށ�A��Lr}��?9\��Pf꽕
diff --git a/sec/rekeyed/kaambl/dd788a3428bec6c88c5ac4e143ec0b11-metric.age b/sec/rekeyed/kaambl/dd788a3428bec6c88c5ac4e143ec0b11-metric.age
diff --git a/sec/rekeyed/nodens/06a8485aaa473a141854234f5e2ba9d1-metric.age b/sec/rekeyed/nodens/06a8485aaa473a141854234f5e2ba9d1-metric.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 OyH5xQ XTw2UciwTk0G6Ad6pYiNAIQPFK26BBVimLCmbiu1+yE
+PsQdsNf5s2nczHkXQd16smV2efz75bPLMxSg8FS3Jws
+-> X+$x&y&$-grease uU(<a 9*' mYzE*ii GXm
+MePj8BQgOyGumhfGCj4Y+aGqGsBcMGRI2B616t2UkEtWtcm0Raf4BerfS0tHhTaw
+rwSGpJPkhw2kefOACMODQwkUyV7o/hFVuK8SG16xIui4dVM8J3Kp5NHNFqdVog
+--- ch0KBzJPQO5PftURjA9StKd5//1Gi5hsvu1gV8nXFOM
+�&��{Z�x_����ӊ�rz�[��r�V4)�S��:��1S�X;�b�H(�|H�+=�[��^c�Mr%����6�U