Compare commits

...

4 commits

Author SHA1 Message Date
488d6fe6df
Add openssl to devshell 2024-02-29 14:25:30 +01:00
3e637b15c5
Clean up sops file 2024-02-29 14:25:29 +01:00
a69997d875
Add .dir-locals.el 2024-02-29 14:25:26 +01:00
d0d9277387
saga: Add incus metrics 2024-02-29 14:25:23 +01:00
7 changed files with 124 additions and 74 deletions

4
.dir-locals.el Normal file
View file

@ -0,0 +1,4 @@
;;; Directory Local Variables -*- no-byte-compile: t; -*-
;;; For more information see (info "(emacs) Directory Variables")
((nix-mode . ((eglot-workspace-configuration . (:nil (:formatting (:command ["nixfmt"])))))))

View file

@ -11,37 +11,32 @@ keys:
- &minio age1cjxe2e7zemvs0jacjawug6k2qnmcpvnka3e04mfzp939h7hppydqrlp6l5
- &nix-cache age1ffpkfl4ged52ym7ynyhjc40t9v2g6pgjp4ue670lxcr6mxy7mdtqt5qjlq
- &proxy age1yz7k9s5plamjq425memjh00y4sdldgdhpwxqpx9gk9wutttx9scsdg3qd5
- &k3s-1 age1gsjy4em8u668tnx77jr7kk345m4hzmmt3seclzvsd25ldgwd45pq6zu7cv
- &k3s-2 age1ghda0mj5wc2vpksjuvaf3t0xklpcgnykvepzu9k5csf482ngpans9h05pp
- &k3s-3 age1mpyg2qcrehfcpksygk9hduz79l93gy2crpwn0vu70mtcmzapeyvqrrjw5r
- &saga age10advysga7fpkh7uuv9a7phs77c5khswf5c9q9txvrauxtqr4yu0sk2r75v
creation_rules:
- path_regex: machines/loki/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *loki
- *k3s-1
- *k3s-2
- *k3s-3
- *erwin
- *erwin_horus
- *loki
- path_regex: machines/ci/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *ci
- *erwin
- *erwin_horus
- *ci
- path_regex: machines/frigate/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *frigate
- *erwin
- *erwin_horus
- *frigate
- path_regex: machines/gitea/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *gitea
- *erwin
- *erwin_horus
- *gitea
- path_regex: machines/gitea-runner/[^/]+\.yaml$
key_groups:
- age:
@ -51,9 +46,9 @@ creation_rules:
- path_regex: machines/heimdall/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *heimdall
- *erwin
- *erwin_horus
- *heimdall
- path_regex: machines/mimir/[^/]+\.ya?ml$
key_groups:
- age:
@ -63,9 +58,9 @@ creation_rules:
- path_regex: machines/minio/[^/]+\.yaml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *minio
- *erwin
- *erwin_horus
- *minio
- path_regex: machines/nix-cache/[^/]+\.yaml$
key_groups:
- age:
@ -75,6 +70,12 @@ creation_rules:
- path_regex: machines/proxy/[^/]+\.ya?ml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *proxy
- *erwin
- *erwin_horus
- *proxy
- path_regex: machines/saga/[^/]+\.ya?ml$
key_groups:
- age:
- *erwin
- *erwin_horus
- *saga

View file

@ -263,6 +263,7 @@
nix-prefetch-scripts
nix-tree
nix-top
openssl
pciutils
pkgs.sops
ssh-to-age

View file

@ -14,56 +14,29 @@ sops:
- recipient: age1h7ddyj66gcqt5vnzphjfn6y5tul79q0glcdl0et9w44z2evl999qe02wht
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1UysxelR5dzk0c29zanpn
ZmtPSHNhRXJtYjA3a2xTdkVFYjZPSUFROXh3CjdXNmg1Rk9MMERMYzRHaVdhU3pY
TUdEdzh5b1Z2a2FZdkZzcy9WRVFBTmsKLS0tIDgxNXNtVDJjN1dMR2Eza1BRRGJP
TGVITVM3b3drM2Y0WVJDckRUYzIrMjgKtEVhrvkm8z3LVwQi4AuOJxjkQ5kLJFtb
lxQIN8hrgkGMwsiOUyVbDw6z5tt4AmukHuSUaP7AXX3xvOl3eFPT3w==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZ25lRzQ2c0x4VC8vUWZW
ZFhtUi9vb01KRENVdDNMZUZKd2ZPcWwrOFZRCjJJaVUrUXh2dWZqUExxb1ljSk5X
K0x2MVhLRUZWa3R4cytvVFRhakl3ZzAKLS0tIHVhQ0RYcytiM3pxUm13UUhmUndD
aTdXbkxMUmlGVzJOR1RYcDlocWE0MWsKBeZPCt/CoAIZLboih1a2RRCD0YFkVFBM
2dJJOXHTwuGfJ046vUCJoOng5iCE/ltB5KA3PWmFok8Geeqo9bjY7w==
-----END AGE ENCRYPTED FILE-----
- recipient: age1435gxhlpu55pp86r8pullhc6wg43nv6qm5l3g2vl5000xhn8apdqtlf8cg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlVDZ5N1g2Y0dYYURZWnhG
SEo1WFNIYjY2d2dyTlRtOFFVazJwcUNiOTI4ClpTZXZqNW9QNmtRQmljb0wwTHJW
K0p6TDRMTnFTWldSd2QrNFRuV05tVDQKLS0tIHp6MStBTzUrUlBLSUlpc3N4N3Fk
a2FINk1wekg1cW1JZDRJRmJMK00rMEEK4U4WQl+z0V9CH8PBI2BINwC/fjtLVbj4
d7CEm6QajGIsI2YBgzlbXhL+zIQSCGaPsyRcYSLGxWmPTc6/On2Z0g==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2c2pGcld6OGI2SWZWMEhG
RStjRVovczlaUDJORE8zVjNnV3FKWitqd2g4CnZuWDF2Nk5oYlJBNFdEVHo0andT
ZDlwOUd1eEJHS3Vld1FuUng0VXNvSTAKLS0tIGY0REdlRERYUzBNVEhVRXdxWmti
QURXUEY2Qk1XK2dlTnF5QkNoSi95bWMKCT4lp/lIKa1Tfz2wDIu5JIsarQajzWnt
GFeHaPz825Eh1h9HlE8UW4WDdvG4NfsujzealNgu5fa6CUcOawZBiw==
-----END AGE ENCRYPTED FILE-----
- recipient: age1m93jeyexus2uqvrk99r7hh0xp7qxk55tgmju4h422dfkf92jce2sxpntu5
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cDBYYjhjSDBrd05JbjRP
UWhVWjNHYWdPY2VOell4VDdpOWVZOEZROVNrCk84U09xN09nK09kc3l3M2RuUVpN
ZkRMZVNCdmlDbVc5VXUyOUROWE1HQncKLS0tIGZMZXQ2RXg5ZTh4aEdTajR0Z2xj
S0s2emlQVXBibmRSNURCQVZabi90aVUK08sP7ERNk2QKIIuOgICjHhb9s5ot6wSg
k9VOXYzTAbXuF9Wbj7niSA9aZ4Ik0HbGFNTMMeqdSVDeySCIAkw5nQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1gsjy4em8u668tnx77jr7kk345m4hzmmt3seclzvsd25ldgwd45pq6zu7cv
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxNE02VWdDR0dJTGJnckZO
Nk9RaHMzUUtxWUVaMjRYeXM2dGo1M3lQRm1RCkJENWtVYW5JTm9MMEtyYnNVZ2ZN
Rk9WWG5BMkorWXM1MnJwczhuMEFaK2MKLS0tIGZGS1A0QjhhbUxpZnV0WkVqT1Zs
NEFmakFPK1BZWk1xZ1hBZk9HMGlMZ3cK+p/ErT0Kjga7hjebrEW+jnPvLb3LJqv0
RfIBQwk79ZDcdqtKKQcDt7HfXggkGPsDD5LZRxE8sasbnd7C3V8VEA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1ghda0mj5wc2vpksjuvaf3t0xklpcgnykvepzu9k5csf482ngpans9h05pp
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzclIyNC9KQW5lb3M1SDZZ
SEhxZGtWek90Y1pHTFNNSGk3eE5mbzUwUnlFCi9UVXJSeEJiaUgzeWVrMHhlTVov
UVVqWWpxRmIxVWhPTzF1M3U5dncyM1EKLS0tIGpnUTJ2dGh5eGN1OC84bkFmQ2xW
bm1pM05hMlAwL1FmT0RXZlBHQ3kvemsK53X9hG/3Xtv4QUk/F9Un0uhIOfbLnDmn
6n5HVJtVf90Ol1r3soNuDD2PnQpGc4V9Dml8oMm5Rinz9fcPwN7vvg==
-----END AGE ENCRYPTED FILE-----
- recipient: age1mpyg2qcrehfcpksygk9hduz79l93gy2crpwn0vu70mtcmzapeyvqrrjw5r
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEa0JnckdoZS95U2dhSm04
UU1BYk1MOC9KWHMwT2JDUjRSWnZ2bTE2RDFFCnlZZ0JPdFQxa3MwU3k1SHp3TmVX
bW1yRmpUU1dKdjgwUUY4TFBadDBKQU0KLS0tIFVYaDlHVVNGVkpSaks4T3A5dStp
YlFmNzNseHZXSk01SmEwK0ZIRlFmb0kKPms5J3yViVwgwvQhI5XYwcNQZs4Bhwv4
scaA7FZV2sa4x+EXrYAxg3AioH7QOky02FujCOrUaThlLIzDVucgKg==
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaY1BROUx3L3ZRT1ZSZHJo
WG1ySC9oVWtsSUZMaUV2OHIwUmJmL1lITW5VCm95STVkN1VSZFNTbGlTMmMxMUdO
VEtQZE5idExFdEUzK01Ud2UxSmpXWUEKLS0tIHFoZEVKSHpoTTJZVHF6NkRVWUVk
c0dlMkVlRG9LYU00M2M3UGJpUkxDOWsKiwc5oM63ezv1TVng0zQOqILOxuRMU+j7
hHl6AWg0iorXJ1IWmGxLINDAK/RQVEFLK6gRjfN7qB+6wdmrKl8seQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-02-07T22:49:34Z"
mac: ENC[AES256_GCM,data:e3HW2LmCFwxXt2QkKf7pGKrpBQLFETVzz6w4/EEtxSzcuFn7p/S0AYk/4/FPXO+Gke1ccklXINFb/Qk0KlaWeToNg3Pp19xt5b9apvJQsoXQOuzjxqHDRkwZjGIFsYUvVgt/YNXs3AsTJzeMq0RjaI96xbwCitKvZl+sJP1nUBY=,iv:vA8xjOljqXwHwG+aJuCORgcHcNGgNf4L9RRV+dZv4+w=,tag:1Ukh7LQ/yTurdANzygxvXQ==,type:str]

View file

@ -1,5 +1,10 @@
{ self, ... }:
{ modulesPath, lib, ... }:
{
modulesPath,
lib,
config,
...
}:
{
imports = [
(modulesPath + "/virtualisation/lxc-container.nix")
@ -71,10 +76,18 @@
sudo.enable = false;
};
# sops.defaultSopsFile = ./secrets.yaml;
# sops.secrets = {
# };
sops.defaultSopsFile = ./secrets.yaml;
sops.secrets = {
metrics_ca = {
owner = config.systemd.services.prometheus.serviceConfig.User;
};
metrics_cert = {
owner = config.systemd.services.prometheus.serviceConfig.User;
};
metrics_key = {
owner = config.systemd.services.prometheus.serviceConfig.User;
};
};
system.stateVersion = "24.05";
}

View file

@ -2,6 +2,12 @@
{
services.prometheus = {
enable = true;
globalConfig = {
scrape_interval = "15s";
};
# Only check the configuration syntax, because the check is run during the build phase
# and secrets are not accessible to the build environment
checkConfig = "syntax-only";
scrapeConfigs = [
{
@ -25,6 +31,17 @@
}
];
}
{
job_name = "incus";
metrics_path = "/1.0/metrics";
scheme = "https";
tls_config = {
ca_file = config.sops.secrets.metrics_ca.path;
cert_file = config.sops.secrets.metrics_cert.path;
key_file = config.sops.secrets.metrics_key.path;
};
static_configs = [ { targets = [ "odin:8443" ]; } ];
}
];
exporters = {

View file

@ -0,0 +1,41 @@
metrics_cert: ENC[AES256_GCM,data:hxI6B6h1eOaHlYpUeHcsXMAEPZwuKpAgZ9gYkkqK73guUymi6g38kd1ULarm4cDHQC6ugaS5SadBxCExzxvTHpxXJWS+mc+GxJgU6u0wxitWG6h1M2btCHH6blvb/dKrSHcVNEBm+se/XwcPDvDuKJckS3JRfQ6dUpziNcguF1g0RSk7rWtKyLJx40O3Mc1BivAaPirNxOeExhwG7UX4rfwzw3ajqPg0AnaXfRlHA5vfvZAGhTYh1qXrUWXQgtjZj/B30vMB18oA6vxZnmkFVbZyUwh9O65hkdWY8kGQSc1IuhmzK7vcLquTAymdVgmW6Zmy/49bRgC5+aZKiIwiXnnK1e/Ygy+WvvQ/dpJZ0YANhLFiC1ygXiUHGOzh4gvo23c5NPcH8PDnMx6z1j5V4QTqi2w5RCA3A7pobP/u7Jn0pqFqRB2ws9bpsLQXGifOoGhTGiEfM6XJPSELNx3OMYmNSMbtM9PrMTs8ajaT3Vo0alwR67hSEU4i13vpgcEErcf+bxo8DoBRi3qwoU7bc/y2XLIWdxy9I2UTE2gMxuINHUuWX+n8J6WFYTs66KwXDY16G2WBBPh7zbjQqa8HLM4/K6bZVDKvhEuoDDz+Mp9bf2dlaM9qADnjumjRXbivdYg45rT3nuAsJ5pcEbz3RPP8j9Ri6cbb/eChWqCXcWyzEY8NfMNAdph3jetduaic+SgCqUnhJptM2lOPgdo0uscqD1O08giAvqLciTBR/kB2N9hIXOXwVVLgkSLvryduD/q1plfEnVzcsrUauJ6lleS0EUqQlVdrvM+DSYMPBZgecAmjrpvDdNP5gMseLrpd2/vVZOM3An/wrgf2vTOA3HNm1Fjj/iyKvIVsj+ZV0TAsXJh8BwyF09mJLm7kwKP+wkUmJkWJUW2yG/Dx9LHKaMhUEsMpF0ogP9aekyYG8d5PJ2d8VdKjQI2aanSkkh7kXPghemjfjP9T,iv:irh5m+oLYqMVsSmZNZK7s9nQtLxRvZ80lIAfE4nrAf4=,tag:xL5/SAP9b07yuiZUdizwwA==,type:str]
metrics_key: ENC[AES256_GCM,data:fGpIg3k/PBcq4dVdLL5oNEdbrPTFarDAi9QLw7ViEfzG4jdxOec8rdFNtECX3IdtGIFZ7VtLd7hTISYrklafBqYMyBw0y3dxmbQaG7CQoIPoxnoJlbwAxofjfgFyVa69V6/o1mvCBfw3Tv8akRQel+3lTTB7RgqBsd+JNjiIsrC5r4JAr6KJCkKKLbNJZ79W1PGdKb2VEeVwGmdfWcvKz4TN6Za4cwhc51IAnZBH+2QnNNCYM6JnT0LVIzERS6ljF8MOb2Xmaqb9w6QxxTLX4nheEceWpOMLc71nIGtMSsU+SiRiZtHEdcUsDGBUdriqQ2mP5Q10Yz0K0u1wqXiLiz/wfeFGIvRPNOpP/b/cSFQSp494ZnMdO2bsnXOKQNFVBkkIO2jvB2SOlIJwC329n9vG,iv:jktiYgPJluYrQOpOOTwwpQ9SDJVvsO4lEwDe+l2cn3Q=,tag:rduGq7/XVShG9SqQeWl19g==,type:str]
metrics_ca: ENC[AES256_GCM,data:nMocCNsco+iYrrZbJxuoWhQ5ytDyy+JjaRTbalTof4CPK3CtWpu2KhHhVJNN+XaThns3jzBEjEDyuPqhb27CaUG871Z8O8BGAEtYWUa886sIdgPgOkL3rsDCELxnnEkCKIcyfu3DZFIcs+hWQGOVQ3KBY44dpwJzm5xm/PbbpiPo7QawAzEhOynmRz1eN+At+aDgBNMRJ9fWg5qaImf6iFL804M7q6mjVAOopvL+I5vMAn4FODWWn93Vm0edHWjhIDb2NHuwSL0WRdt74GMES+ZPvBjpnGsMFteCC1sWGuAMY9S78V54+o95Ijf6j8yzPadyayZb51K2/qGWas/wpaQlmva2mQvv/y1jpDfewLt4ZstzqCamVhhXzZfguf7F+MpbEGpNUl7SvCnS6BtNU7XCaV5bEp8vTKfhYVh+/AqBPYG2BpLB0N/Q198/nTkW82CgP1V4BJ8HD8FiWympZjhLjdglkMZ3h1u9k6VQIAZ9kQS3B60kKBq1mWhDVmZmNTSMf85zfV48XrBPF/ttCfCjd33gxopok5OLMZqVHNKY4PxCLI6e5FKOwwEmrzf6MffGiDWZWMgTaz3OM+d9Yv8yjNDeboGb6TGRn4yXfKlcsl4mYZi+C3IJ0BkmUA9BXaLXhhWKl/e5Xs5Ajtgf3fwSVEgsQ8G3kC2OQT0qoIMKx37K4YmABYVFx0qcJy2diQ3ZoFmvGAwvYb5vKtlyJHnbDz6OyXWfYc1UkAG4mtHNMrsgSL7ruju4QvIeZPwXDsNazI9R3dWaLbnz041JQNRvA0Kpwg3LxHaf4D0Ln7nBokEmvRycuBXljPk35B3CuGoj2qnCJzx057MTQoX/UKtQ/KRbGP0Dmmu+s1cH9dHw8l3ya+zZEKBJHt2w7rmmMiYVXMetjoPIHevePumDeXFRyCvU3mWwj7xUtzbrpTwY0zSYi5brdMRe4NBtmYJsMmH7Jgc+HOgtbm8MC++FApxiKpV2,iv:08lM7WQLcnuC7DvTZ1999sOojo9l35gAZpp4oIMuJBY=,tag:YW0xjTJkycV7xJHZuhE0uQ==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1h7ddyj66gcqt5vnzphjfn6y5tul79q0glcdl0et9w44z2evl999qe02wht
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIMlFrZ0NESnJ5cnFtRkxi
RjI5cDRtd0tkRWZTTHY2MXFoN21NUWJjVWlRCm8vN043dUUvTVF2VDJhWmFHeSs5
NUdkTnhLbnViMm9nM2xUK2ZTZmFTMnMKLS0tIERjU0hweGVwTUJ2blhadVF4OGJO
bVl1R1d1TmxVVGN4eWliVE1GM1FhcncKlUv/IG0zAyyuQx3AC6aZr1dv9aujSSnS
bhaMBbfi0NFAWTWhX/2aNtg7Yn+WHcaYZtfUs7Jb93txJQa6oW6ZDA==
-----END AGE ENCRYPTED FILE-----
- recipient: age1435gxhlpu55pp86r8pullhc6wg43nv6qm5l3g2vl5000xhn8apdqtlf8cg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZHJUQ0xEa20yczdldTh4
V0E4SDY2MWpwVW0vWDBQejJ5VEFYQXFVZGlFCnpnN09mS1p2eUFGTSt0T0VZQTBI
cno3YUFFQjhSNVZJZ2NNdG9ZSHZLS0EKLS0tIEU4b1p6eFhGT1VjMmFwNjcxNDcy
a2hyZzZqS21mQk52WktWSnNqRFhuQ2MKnNTAwSMVjIFNpbtCYvmtemm4NssJ/N7D
9b/Y6i1cEvjkzsx/q5GOsPIUWJkrQ2pV8q5qUB3c6cKsaQO7TNFqcg==
-----END AGE ENCRYPTED FILE-----
- recipient: age10advysga7fpkh7uuv9a7phs77c5khswf5c9q9txvrauxtqr4yu0sk2r75v
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrWkExNUc2SU5pVWQzWW5u
TXgzUHFtN2pZYnhOVC9pUngvbEVzMnp3Z0NjCmdsbXlhQ0lUOUtJQ0ZmaWl5dFNn
SVdUUlByZjdwZUIraGlRN3BCa3h3ZkUKLS0tIEYwZC96MnorRWlMUmFjRGs4Q0FN
K1FHaGVOQlo2cjBTQ3ZIYXZ5ZzNsNlEKLZWrUkNXTv8ECwXz1aPdnrpMs6r9Q+yI
k5rFkaa+ylIk4OqouKRxxlNFdgcdqqYdZEqLrfuLnamzr6LNaoL1dQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-02-29T10:40:34Z"
mac: ENC[AES256_GCM,data:mofYtl2tbmOhe12j1murXcx4GAosmE4ezZZ1Uby8F0TS6Ob2J+13SBS1jwhEkU8S9ylVgx0jSET2weoEHfYS+d0/RDd9bjdXrnI8DeIA46D3wNNssYID9RAuPE18Dc98eVMOOBwH/hT46Bj630l0Rm8H/HB+fwcOFR5ahcvm2Pw=,iv:p2+aTSaOqL1jQpUt9+FBf8QgcwA13haKXLrGV4wdH84=,tag:ecgweBQiXOyiRVY9yBwDIw==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1