diff --git a/nixos/roles/gitea.nix b/nixos/roles/gitea.nix index ad1386d..148354b 100644 --- a/nixos/roles/gitea.nix +++ b/nixos/roles/gitea.nix @@ -36,6 +36,11 @@ in owner = "gitea"; group = "gitea"; }; + "kanidm_gitea_secret" = { + owner = "gitea"; + group = "gitea"; + mode = "0444"; + }; }; services.postgresql = { diff --git a/nixos/roles/monitoring.nix b/nixos/roles/monitoring.nix index 16e4479..a6409e6 100644 --- a/nixos/roles/monitoring.nix +++ b/nixos/roles/monitoring.nix @@ -21,44 +21,6 @@ let "cyper-node-2" = "192.168.2.31"; "cyper-proxy" = "178.254.8.35"; }; - - mkWeatherScrapeConfigs = - cities: - map (city: { - job_name = "weather_${lib.strings.toLower (lib.strings.replaceStrings [ " " ] [ "_" ] city)}"; - scrape_interval = "5m"; - scrape_timeout = "30s"; - metrics_path = "/${city}"; - params.format = [ "p1" ]; - static_configs = [ { targets = [ "wttr.in" ]; } ]; - scheme = "https"; - metric_relabel_configs = [ - { - target_label = "location"; - replacement = city; - } - ]; - }) cities; - - weatherCities = [ - # Braunschweig itself - "Braunschweig" - - # Immediate surroundings (~15km) - "Wolfenbuettel" - "Salzgitter" - "Peine" - "Cremlingen" - "Wendeburg" - "Sickte" - - # Greater region (~50km) - "Wolfsburg" - "Gifhorn" - "Goslar" - "Hildesheim" - "Hannover" - ]; in { sops.secrets = { @@ -66,7 +28,10 @@ in owner = "grafana"; group = "grafana"; }; - + kanidm_grafana_secret = { + owner = "grafana"; + group = "grafana"; + }; }; services = { @@ -83,12 +48,6 @@ in url = "http://127.0.0.1:${toString config.services.prometheus.port}"; isDefault = true; } - { - name = "Loki"; - type = "loki"; - url = "http://127.0.0.1:${toString config.services.loki.configuration.server.http_listen_port}"; - isDefault = false; - } ]; }; }; @@ -97,7 +56,7 @@ in domain = "www.cyperpunk.de"; # serverIP; # "grafana.cyperpunk.de"; http_port = 2342; http_addr = "0.0.0.0"; - root_url = "http://www.cyperpunk.de/grafana/"; + root_url = "https://www.cyperpunk.de/grafana/"; serve_from_sub_path = true; }; security = { @@ -106,6 +65,23 @@ in }; auth = { disable_login_form = false; + oauth_allow_insecure_email_lookup = true; + }; + "auth.generic_oauth" = { + enabled = true; + name = "Kanidm"; + client_id = "grafana"; + client_secret = "$__file{${config.sops.secrets.kanidm_grafana_secret.path}}"; + scopes = "openid profile email"; + auth_url = "https://auth.cyperpunk.de/ui/oauth2"; + token_url = "https://auth.cyperpunk.de/oauth2/token"; + api_url = "https://auth.cyperpunk.de/oauth2/openid/grafana/userinfo"; + use_pkce = false; + allow_sign_up = true; + auto_assign_org = true; + auto_assign_org_id = 1; + auto_assign_org_role = "Admin"; + skip_org_role_sync = true; }; }; }; @@ -136,7 +112,7 @@ in { targets = [ "100.109.10.91:9009" ]; labels = { - instance = config.networking.hostName; + instance = "cyper-proxy"; job = "master"; index = "1"; }; @@ -166,50 +142,7 @@ in ]; } ] - ++ (lib.mapAttrsToList mkNodeJob extraNodes) - ++ (mkWeatherScrapeConfigs weatherCities); - }; - - loki = { - enable = true; - configuration = { - auth_enabled = false; - server.http_listen_port = 3100; - ingester = { - lifecycler = { - address = "127.0.0.1"; - ring = { - kvstore.store = "inmemory"; - replication_factor = 1; - }; - }; - chunk_idle_period = "5m"; - chunk_retain_period = "30s"; - }; - schema_config.configs = [ - { - from = "2024-01-01"; - store = "tsdb"; - object_store = "filesystem"; - schema = "v13"; - index = { - prefix = "index_"; - period = "24h"; - }; - } - ]; - storage_config = { - tsdb_shipper = { - active_index_directory = "/var/lib/loki/tsdb-index"; - cache_location = "/var/lib/loki/tsdb-cache"; - }; - filesystem.directory = "/var/lib/loki/chunks"; - }; - limits_config = { - reject_old_samples = true; - reject_old_samples_max_age = "168h"; - }; - }; + ++ (lib.mapAttrsToList mkNodeJob extraNodes); }; }; @@ -218,8 +151,4 @@ in 9001 3100 ]; - - systemd.tmpfiles.rules = [ - "d /var/loki 0700 loki loki -" - ]; } diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index ebaa6d0..b1b5442 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -2,6 +2,7 @@ GROQ_API_KEY: ENC[AES256_GCM,data:OyuC4jfw67sCDa0XBGr78S6pzPV1ruy7KiIqPMgWWcOCVm OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNFqROI=,iv:VCzse1a1/k1ZDIpFPL1QhjuS6YaDyohWi61JZaoc0Ws=,tag:UJSNyniNNLfGGRY/uiJcRA==,type:str] smb_passwd: ENC[AES256_GCM,data:+9RYomcnCZSME5DzuJWTLbS3IGJHhIYWZ5SmsgOn6YQ=,iv:VRPVR7DD+swjeUZKe54XYm3wn/KB4RqvQAyYXQbS+A8=,tag:NnA89efo6HVL0scHgyTZMQ==,type:str] grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds0adfgYetN852G25Z8/g=,iv:uWuwGBZVK1syhEfO9nLZUWwa801759tNJx+Pmnz3xeg=,tag:X6/NcdGZHAdIlOwxNPo/Ew==,type:str] +kanidm_grafana_secret: ENC[AES256_GCM,data:rqK3hkpvtg24P4UVV0pFuabUhxoTgtZvK+h8EiSfVyOSrnRy6jtyGvOMMlIOAQDr,iv:I6e++KrpxAFhM8VDQkx8YsrQSvT4brc+Fh1cY5PlwKY=,tag:sEq91Yucb2pUTDbRir+NyA==,type:str] matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str] matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str] kanidm_synapse_secret: ENC[AES256_GCM,data:F770siYcYLm3RAQ+3epfVTyp5mv0OJfiOdFiHD8CudjceNkkSuXIX7pxQYkhS3VY,iv:hqYMKLS5m+o3leFE0gBS05Npjy9uyqgSe7yJpPzxvQY=,tag:lLjVZ7/iYoIZh06VyF8zSw==,type:str] @@ -15,6 +16,7 @@ coturn_static_auth_secret: ENC[AES256_GCM,data:7AI0E8Hu4WxI5q4j1GqBMSQ+evE006uPM discord_bot_token: ENC[AES256_GCM,data:j37Qo3FCyRwNFqWSWpnQKCs+AxH5HlQ8U5If7ylHilQoORp8Pb3TtNETTJSjZyvUXllldevAbHrbAEEKnNfoUJx1U8/wl6H0,iv:WQqxFXTE+0LIB2lSvVcnr4LNXPE7uzNc0Kk8NU6Z/aE=,tag:fNeQLhoThEgfa4sSGKLZCw==,type:str] discord_client_id: ENC[AES256_GCM,data:U/iUKXT6Nsl6LRN9lPh1xaIaqw==,iv:k7kQ8rJBrMs3YwD9aDfZ6qhd7H3aVsSPTOwEIxVTw2Y=,tag:2wKhxGbf+P+h3BYeWUSczA==,type:str] pg_replication_password: ENC[AES256_GCM,data:w2h07D+j3LNkcbvoKQ2Qp3HSvC2Wf5HRAPAo/HNhmUkHBOaDyILNxo7IDjqajv0jytpG7q4joCJQhS7tEUlA9Q==,iv:26ZurAq61IDqGdAl0yPpoTJElo93hJJIEUlza4DGDNc=,tag:a46FOKgeqEEZE+rC+H9NbQ==,type:str] +kanidm_gitea_secret: ENC[AES256_GCM,data:RavtSb5BaJGwwLB/oGzG/KK2AyV+IzEjihVxnD3/dVnxmxcG+CITIYPLvFUJjmvY,iv:Cg8dAhtJXDvRGULIkpWAyuhhlLEdvN+4lyjHPR/740I=,tag:8kMGrOjXEA4GWSLlP7oIkA==,type:str] gitea: dbPassword: ENC[AES256_GCM,data:S6VvRgkdYk1AzXljyQEEq68UJ9zrFy6+INBMIAspXNcqcM6o+es19o0mcXA=,iv:/pHYpkZZq+9Md+75uSCb2YXfSvaDzUh6mMfH53wb7eg=,tag:ZnbyCQwrK2JnbO5HFqgJYw==,type:str] internalToken: ENC[AES256_GCM,data:7N8TkPNb1YdCk2uAcCvVd2pKRVOf85//DYxAvz0UCg1E8ccEI5630xVyKafDFiSTM4ER7xiYelartzXL0jLWSf3QNOjSHUP8TIAz4bJRAZUJPxO917bURSLGGe7WEOfONzqy3Ts5QhrJ,iv:DiIs1ytlwLvqD/Ejep6m2fmpSqdFZkxBcgLNt6+29jY=,tag:8jsEcOkH0p+1mP9cnVjiDQ==,type:str] @@ -33,7 +35,7 @@ sops: N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-15T09:03:17Z" - mac: ENC[AES256_GCM,data:1rSwkArJPxLpyatnp+EJDX4//B7aWUScfM5u0XEQlWeKWjHPYxvZ7b2Vvqx8RFJcWp3QgqQf3f+Mp2DmuDdxAuK94XxHIRk3c1bimKeNrCBPZqQkTjJH8tyklrW1Grob7Xi82GXhk96/s0bTzU58uSdvJXGReYraqvnAuitehPY=,iv:JsImUF/7zQCmIRz34LEOJStL2kAqw8QcARE5eHGsGyU=,tag:8CpmWPVozDPTyNwhoZqC9A==,type:str] + lastmodified: "2026-05-15T10:39:04Z" + mac: ENC[AES256_GCM,data:wXTasAyCQWSX25Npcvg9RewgKZqRlbAtI0Mk1XXLsuvgMoLVCDQWM0VVA4IDp0SUMzU3iocP4FKjhtNve054DT6a/Fcv3laY7dMLrgdJEvGfwsR0kNtIYsTFb5vVF3+h1Za18/9S9M7UINL38Bhwa56O8jnShZpwxe3y9XqMGQ4=,iv:t4ekytZ6dy6QeWcOSho877yK/DFYYFfCi/bHHezrAIc=,tag:HZaE3bWZe+9OtZsVmb52+Q==,type:str] unencrypted_suffix: _unencrypted version: 3.12.2