DerGrumpf/cyper-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' of ssh://git.cyperpunk.de:12222/DerGrumpf/cyper-nix

Browse Source
This commit is contained in:
DerGrumpf
2026-05-25 01:31:43 +02:00
parent d84b2e882d 42868908a6
commit c344fbbe0e
7 changed files with 223 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/packages/gs1200-exporter.nix
+5
View File
@@ -6,13 +6,18 @@
buildGoModule rec {
pname = "gs1200-exporter";
version = "2.11.12";
__structuredAttrs = true;
src = fetchFromGitHub {
owner = "robinelfrink";
repo = "gs1200-exporter";
rev = "v${version}";
hash = "sha256-8s2VgaqYXp9PN2oNU/sWpjQjDPSWolbWEVSZcx9Lh3M=";
};
vendorHash = "sha256-204bFaywOolKVNoeH/w72Ba1PYAVgQawEmlaEXgRaRY=";
meta = {
description = "Prometheus exporter for Zyxel GS1200 switches";
homepage = "https://github.com/robinelfrink/gs1200-exporter";
nixos/packages/oidcwarden.nix
+4 -3
View File
@@ -1,5 +1,6 @@
{
pkgs,
vaultwarden,
rustPlatform,
fetchFromGitHub,
...
}:
@@ -11,10 +12,10 @@ let
hash = "sha256-tHacn9RtoByWpqnWX2/gWwODDSeXJa4mk4MfxHiiJ8A=";
};
in
pkgs.vaultwarden.overrideAttrs (old: {
vaultwarden.overrideAttrs (old: {
pname = "oidcwarden";
inherit src;
cargoDeps = pkgs.rustPlatform.importCargoLock {
cargoDeps = rustPlatform.importCargoLock {
lockFile = "${src}/Cargo.lock";
};
postInstall = (old.postInstall or "") + ''
nixos/packages/overlays.nix
+1 -1
View File
@@ -1,4 +1,4 @@
final: prev: {
gs1200-exporter = final.callPackage ./gs1200-exporter.nix { };
oidcwarden = final.callPackage ./oidcwarden.nix { };
oidcwarden = final.callPackage ./oidcwarden.nix { inherit (prev) vaultwarden; };
}
nixos/roles/gs-exporter.nix
+177
View File
@@ -0,0 +1,177 @@
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.gs1200-exporter;
instanceOpts =
{ name, ... }:
{
options = {
address = lib.mkOption {
type = lib.types.str;
description = "IP address or hostname of the GS1200 switch.";
example = "192.168.1.3";
};
port = lib.mkOption {
type = lib.types.port;
default = 9934;
description = "Port on which to expose Prometheus metrics.";
};
password = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
description = ''
Password to log in to the GS1200 web interface.
Use passwordFile instead to avoid storing the password in the Nix store.
'';
};
passwordFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
Path to a file containing the password to log in to the GS1200 web interface.
This is the recommended option as it avoids storing the password in the Nix store.
Compatible with sops-nix and agenix.
'';
example = "/run/secrets/gs1200-password";
};
debug = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable debug logging. Logs are accessible via journalctl -u gs1200-exporter-<name>.";
};
verbose = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable verbose logging. Logs are accessible via journalctl -u gs1200-exporter-<name>.";
};
json = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Output logs in JSON format. Logs are accessible via journalctl -u gs1200-exporter-<name>.";
};
user = lib.mkOption {
type = lib.types.str;
default = "gs1200-exporter-${name}";
description = "User under which the service runs.";
};
group = lib.mkOption {
type = lib.types.str;
default = "gs1200-exporter-${name}";
description = "Group under which the service runs.";
};
};
};
mkService = name: icfg: {
"gs1200-exporter-${name}" = {
description = "Prometheus exporter for Zyxel GS1200 switch '${name}'";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
serviceConfig = {
User = icfg.user;
Group = icfg.group;
Restart = "always";
RestartSec = "10s";
# Hardening
NoNewPrivileges = true;
PrivateTmp = true;
ProtectSystem = "strict";
ProtectHome = true;
CapabilityBoundingSet = "";
};
script =
let
args = lib.concatStringsSep " " (
[
"--address ${icfg.address}"
"--port ${toString icfg.port}"
]
++ lib.optional icfg.debug "--debug"
++ lib.optional icfg.verbose "--verbose"
++ lib.optional icfg.json "--json"
);
in
if icfg.passwordFile != null then
''
export GS1200_PASSWORD=$(cat ${icfg.passwordFile})
exec ${lib.getExe pkgs.gs1200-exporter} ${args}
''
else
''
export GS1200_PASSWORD=${lib.escapeShellArg icfg.password}
exec ${lib.getExe pkgs.gs1200-exporter} ${args}
'';
};
};
in
{
options.services.gs1200-exporter = {
instances = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule instanceOpts);
default = { };
description = ''
Each attribute defines a separate gs1200-exporter instance for one switch.
Use this to monitor multiple GS1200 switches on the same host.
'';
example = lib.literalExpression ''
{
switch-1 = {
address = "192.168.1.3";
port = 9934;
passwordFile = "/run/secrets/gs1200-password";
};
switch-2 = {
address = "192.168.1.4";
port = 9935;
passwordFile = "/run/secrets/gs1200-password";
};
}
'';
};
};
config = lib.mkIf (cfg.instances != { }) {
assertions = lib.flatten (
lib.mapAttrsToList (name: icfg: [
{
assertion = icfg.address != "";
message = "services.gs1200-exporter.instances.${name}: address must be set.";
}
{
assertion = (icfg.password == null) != (icfg.passwordFile == null);
message = "services.gs1200-exporter.instances.${name}: exactly one of password or passwordFile must be set.";
}
]) cfg.instances
);
users.users = lib.mapAttrs' (
name: icfg:
lib.nameValuePair icfg.user {
isSystemUser = true;
inherit (icfg) group;
description = "gs1200-exporter '${name}' service user";
}
) cfg.instances;
users.groups = lib.mapAttrs' (_name: icfg: lib.nameValuePair icfg.group { }) cfg.instances;
systemd.services = lib.mkMerge (lib.mapAttrsToList mkService cfg.instances);
};
}
nixos/roles/monitoring.nix
+32
View File
@@ -23,6 +23,9 @@ let
};
in
{
imports = [ ./gs-exporter.nix ];
sops.secrets = {
grafana_secret_key = {
owner = "grafana";
@@ -32,7 +35,13 @@ in
owner = "grafana";
group = "grafana";
};
zyxel_pass = {
group = "gs1200-exporter";
mode = "0440";
};
};
users.groups.gs1200-exporter = { };
services = {
grafana = {
@@ -141,9 +150,32 @@ in
}
];
}
{
job_name = "gs1200-zyxel1";
static_configs = [ { targets = [ "localhost:9934" ]; } ];
}
{
job_name = "gs1200-zyxel2";
static_configs = [ { targets = [ "localhost:9935" ]; } ];
}
]
++ (lib.mapAttrsToList mkNodeJob extraNodes);
};
gs1200-exporter.instances = {
zyxel1 = {
address = "192.168.2.3";
port = 9934;
passwordFile = config.sops.secrets.zyxel_pass.path;
group = "gs1200-exporter";
};
zyxel2 = {
address = "192.168.2.4";
port = 9935;
passwordFile = config.sops.secrets.zyxel_pass.path;
group = "gs1200-exporter";
};
};
};
networking.firewall.allowedTCPPorts = [
nixos/roles/vaultwarden.nix
+1 -12
View File
@@ -1,29 +1,21 @@
{
config,
pkgs,
inputs,
...
}:
let
port = 8222;
oidcwarden = import ../packages/oidcwarden.nix {
inherit pkgs;
oidcwarden-src = inputs.oidcwarden;
};
in
{
sops.secrets.vaultwarden_env = {
owner = "vaultwarden";
group = "vaultwarden";
};
services.vaultwarden = {
enable = true;
package = oidcwarden;
package = pkgs.oidcwarden;
environmentFile = config.sops.secrets.vaultwarden_env.path;
backupDir = "/var/local/vaultwarden/backup";
config = {
DOMAIN = "https://vault.cyperpunk.de";
ROCKET_ADDRESS = "0.0.0.0";
@@ -38,9 +30,7 @@ in
SSO_PKCE = false;
};
};
networking.firewall.allowedTCPPorts = [ port ];
systemd = {
services.vaultwarden-backup-rotate = {
description = "Rotate old Vaultwarden backups";
@@ -49,7 +39,6 @@ in
ExecStart = "${pkgs.findutils}/bin/find /var/lib/vaultwarden/backup -mtime +30 -delete";
};
};
timers.vaultwarden-backup-rotate = {
wantedBy = [ "timers.target" ];
timerConfig = {
secrets/secrets.yaml
+3 -3
View File
@@ -1,4 +1,4 @@
test: ENC[AES256_GCM,data:MDd0sD9oGirw,iv:jhnNjMTqD6lyXckiuuySXnuxMf0N9w1AlsJvbt0GB+8=,tag:DssZmmRbErs99dds89Cr4A==,type:str]
zyxel_pass: ENC[AES256_GCM,data:yEqvWjeII7Uk7w==,iv:j7Lj2HCzlPRnVlvd1c0dTd41gdJAGRi+U6jrH0Vm71U=,tag:AvcPhHJVTCubu/YD9RBivg==,type:str]
cachix_auth_token: ENC[AES256_GCM,data:nR7e2ZOA3q5DmkrqFEzINpKFEHVD5nyzc3DQ3QgD42fdyABV+r1Ela3iEcbU8SWj5JMRq8T1r7QxqcYW+VSMsT2cjQV2e4ZrpUmkX2QnhfmLqQBdJLhgNKBnu+x8QGJpQ3j7mG23atJ3BDTYBEKlI8y6wLEgpTX8GIVzHJVwfbqewTX4EfFyh3mVMtxAK9II/w==,iv:CSMcUdsqC97fmu1Po3cRrUj9h51Wv+KaUPfEToE7qVs=,tag:s1XHG2eyZYJJ5xd9CZb+Pw==,type:str]
GROQ_API_KEY: ENC[AES256_GCM,data:OyuC4jfw67sCDa0XBGr78S6pzPV1ruy7KiIqPMgWWcOCVm3Y/khXEYPMjUTGrq9YLOw1MLso0OE=,iv:0y9klMYVtGsqAaLc2JidjZYSLhhbcbWbnBf8sZiC3rM=,tag:r6G2pzZn2d9JIaS+ozKnmg==,type:str]
OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNFqROI=,iv:VCzse1a1/k1ZDIpFPL1QhjuS6YaDyohWi61JZaoc0Ws=,tag:UJSNyniNNLfGGRY/uiJcRA==,type:str]
@@ -38,7 +38,7 @@ sops:
N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-05-19T17:36:24Z"
mac: ENC[AES256_GCM,data:1tWUPr3njHiQeTH8jdVTIPRIIhOvQSJthGTgjT0P+WvOSZlRgwPK/vM6beweK6xfxdDk4dzRNKxZv3QzKiCwJTaP91MZaRVOly3u2ST0tE1FANo3ZqM34ePBVtlR9q+pDO05JczIjWBTlUcBsVqGKMSpAhn1jZDSY45r18HNwqQ=,iv:6X5FoNb7vl4BYniUE3D4e8wGZVGHbqgsFC1Wv70dCKc=,tag:bRxXg2UfXBhqeXZqdR9Unw==,type:str]
lastmodified: "2026-05-20T08:25:30Z"
mac: ENC[AES256_GCM,data:rh4FcdDtUVvEvv/0XR/J62SgRlv/c0Wve4IIjlr3jItdPkIIkncX+ychxwSIqQEzcQD4BO6MJ7Ex1HXcOP0+5pg3Qvysj+J8y5JGpoIi2dAGh9A7uzMG/cOQD4TuUAQl+HsO6U9b/hrJg6qwyqxrvsupEkH4c7zCb7WbpZfn0o0=,iv:ZQ59dQXJqvLIqlyJmHCByF12Oi6e9vp9ikGGIERIyQE=,tag:Mgbxhu7rOdiHFv+EoYAPuA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.12.2