admin-vm: logging module to centralize logs collection

modules/common/log/journal-remote-upload.nix

@@ -0,0 +1,26 @@
+# Copyright 2022-2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+{pkgs, ...}: let
+  log-vm-ip-port = "192.168.101.66:19532";
+in {
+  users.users.systemd-journal-upload = {
+    isSystemUser = true;
+    group = "systemd-journal-upload";
+  };
+  users.groups.systemd-journal-upload = {};
+  users.users.systemd-journal-upload.extraGroups = ["systemd-journal"];
+
+  systemd.services.systemd-journal-upload = {
+    description = "Service to upload journal logs to log-vm";
+    enable = true;
+    after = ["microvm@log-vm.service"];
+    serviceConfig = {
+      #ExecStart = "${pkgs.systemd}/lib/systemd/systemd-journal-upload --save-state -u http://${log-vm-ip-port}";
+      ExecStart = "${pkgs.systemd}/lib/systemd/systemd-journal-upload -u http://${log-vm-ip-port}";
+      User = "systemd-journal-upload";
+      Restart = "on-failure";
+      RestartSec = "1";
+    };
+    wantedBy = ["multi-user.target"];
+  };
+}

modules/microvm/default.nix

@@ -11,6 +11,7 @@
     ./virtualization/microvm/idsvm/mitmproxy
     ./virtualization/microvm/appvm.nix
     ./virtualization/microvm/guivm.nix
+    ./virtualization/microvm/logvm.nix
     ./networking.nix
     ./power-control.nix
   ];

modules/microvm/virtualization/microvm/logvm.nix

@@ -0,0 +1,129 @@
+# Copyright 2022-2024 TII (SSRC) and the Ghaf contributors
+# SPDX-License-Identifier: Apache-2.0
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  configHost = config;
+  vmName = "log-vm";
+  macAddress = "02:00:00:01:01:02";
+  logvmBaseConfiguration = {
+    imports = [
+      (import ./common/vm-networking.nix {inherit vmName macAddress;})
+      ({lib, ...}: {
+        ghaf = {
+          users.accounts.enable = lib.mkDefault configHost.ghaf.users.accounts.enable;
+          development = {
+            # NOTE: SSH port also becomes accessible on the network interface
+            #       that has been passed through to NetVM
+            ssh.daemon.enable = lib.mkDefault configHost.ghaf.development.ssh.daemon.enable;
+            debug.tools.enable = lib.mkDefault configHost.ghaf.development.debug.tools.enable;
+            nix-setup.enable = lib.mkDefault configHost.ghaf.development.nix-setup.enable;
+          };
+          systemd = {
+            enable = true;
+            withName = "logvm-systemd";
+            withPolkit = true;
+            withDebug = configHost.ghaf.profiles.debug.enable;
+          };
+        };
+
+        system.stateVersion = lib.trivial.release;
+
+        nixpkgs.buildPlatform.system = configHost.nixpkgs.buildPlatform.system;
+        nixpkgs.hostPlatform.system = configHost.nixpkgs.hostPlatform.system;
+
+        networking = {
+          firewall.allowedTCPPorts = [19532];
+        };
+
+        environment.systemPackages = lib.mkIf config.ghaf.profiles.debug.enable [];
+
+        systemd.network = {
+          enable = true;
+          networks."10-ethint0" = {
+            matchConfig.MACAddress = macAddress;
+            addresses = [
+              {
+                addressConfig.Address = "192.168.100.66/24";
+              }
+              {
+                # IP-address for debugging subnet
+                addressConfig.Address = "192.168.101.66/24";
+              }
+            ];
+            linkConfig.ActivationPolicy = "always-up";
+          };
+        };
+
+        users.users.systemd-journal-remote = {
+          isSystemUser = true;
+          group = "systemd-journal";
+        };
+
+        systemd.tmpfiles.rules = ["d /var/log/journal/remote 755 systemd-journal-remote systemd-journal"];
+
+        systemd.services.systemd-journal-remote = {
+          enable = true;
+          description = "Central logging service";
+          serviceConfig = {
+            ExecStart = "${pkgs.systemd}/lib/systemd/systemd-journal-remote --output=/var/log/journal/remote --listen-http=19532";
+            User = "systemd-journal-remote";
+          };
+          wantedBy = ["multi-user.target"];
+        };
+
+        microvm = {
+          optimize.enable = true;
+          hypervisor = "cloud-hypervisor";
+          shares = [
+            {
+              # Creating a persistent log-store which is mapped on ghaf-host
+              tag = "log-store";
+              source = "/var/log/journal/remote";
+              mountPoint = "/var/log/journal/remote";
+              proto = "virtiofs";
+            }
+            {
+              tag = "ro-store";
+              source = "/nix/store";
+              mountPoint = "/nix/.ro-store";
+              proto = "virtiofs";
+            }
+          ];
+          writableStoreOverlay = lib.mkIf config.ghaf.development.debug.tools.enable "/nix/.rw-store";
+        };
+
+        imports = [../../../common];
+      })
+    ];
+  };
+  cfg = config.ghaf.virtualization.microvm.logvm;
+in {
+  options.ghaf.virtualization.microvm.logvm = {
+    enable = lib.mkEnableOption "LogVM";
+
+    extraModules = lib.mkOption {
+      description = ''
+        List of additional modules to be imported and evaluated as part of
+        LogVM's NixOS configuration.
+      '';
+      default = [];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    microvm.vms."${vmName}" = {
+      autostart = true;
+      config =
+        logvmBaseConfiguration
+        // {
+          imports =
+            logvmBaseConfiguration.imports
+            ++ cfg.extraModules;
+        };
+    };
+  };
+}

targets/lenovo-x1/appvms/chromium.nix

@@ -61,6 +61,8 @@ in {
       programs.chromium.extraOpts."AlwaysOpenPdfExternally" = true;
       # Set default PDF XDG handler
       xdg.mime.defaultApplications."application/pdf" = "ghaf-pdf.desktop";
+      # Import journal remote upload service for central logging
+      imports = [../../../modules/common/log/journal-remote-upload.nix];
     }
   ];
   borderColor = "#630505";

targets/lenovo-x1/appvms/gala.nix

@@ -18,6 +18,8 @@
       security.pki.certificateFiles =
         lib.mkIf config.ghaf.virtualization.microvm.idsvm.mitmproxy.enable
         [../../../modules/microvm/virtualization/microvm/idsvm/mitmproxy/mitmproxy-ca/mitmproxy-ca-cert.pem];
+      # Import journal remote upload service for central logging
+      imports = [../../../modules/common/log/journal-remote-upload.nix];
     }
   ];
   borderColor = "#027d7b";

targets/lenovo-x1/appvms/zathura.nix

@@ -10,6 +10,8 @@
   extraModules = [
     {
       time.timeZone = "Asia/Dubai";
+      # Import journal remote upload service for central logging
+      imports = [../../../modules/common/log/journal-remote-upload.nix];
     }
   ];
   borderColor = "#122263";

targets/lenovo-x1/everything.nix

@@ -33,6 +33,10 @@
           self.nixosModules.disko-lenovo-x1-basic-v1
           self.nixosModules.hw-lenovo-x1
 
+          ../../modules/common/security/sshkeys.nix
+          # Import journal remote upload service for central logging
+          ../../modules/common/log/journal-remote-upload.nix
+
           ({
             pkgs,
             config,
@@ -95,6 +99,9 @@
                 mitmproxy.enable = false;
               };
 
+              virtualization.microvm.logvm = {
+                enable = true;
+              };
               virtualization.microvm.guivm = {
                 enable = true;
                 extraModules =

targets/lenovo-x1/guivmExtraModules.nix

@@ -176,6 +176,9 @@
   };
 in
   [
+    ../../modules/common/security/sshkeys.nix
+    # Import journal remote upload service for central logging
+    ../../modules/common/log/journal-remote-upload.nix
     guivmPCIPassthroughModule
     guivmVirtioInputHostEvdevModule
     guivmExtraConfigurations

targets/lenovo-x1/netvmExtraModules.nix

@@ -99,4 +99,10 @@
     # DNS host record has been added for element-vm static ip
     services.dnsmasq.settings.host-record = "element-vm,element-vm.ghaf,${elemen-vmIp}";
   };
-in [netvmPCIPassthroughModule netvmAdditionalConfig]
+in [
+  ../../modules/common/security/sshkeys.nix
+  # Import journal remote upload service for central logging
+  ../../modules/common/log/journal-remote-upload.nix
+  netvmPCIPassthroughModule
+  netvmAdditionalConfig
+]