tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Working postgresql crowdsec config + remove fail2ban
Some checks are pending
/ Build Nix targets (push) Waiting to run
Details

Browse source
This commit is contained in:
Théo Barnouin 2025-04-14 15:28:01 +02:00
parent fd8349cf91
commit d6eb45c45a
4 changed files with 42 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
services/grafana/default.nix
View file

@ -189,7 +189,7 @@ in {
job_name = "jellyfin";
static_configs = [
{
targets = ["192.168.1.42:9100"];
targets = ["192.168.1.42:9002"];
}
];
}
@ -256,6 +256,15 @@ in {
}
];
}
{
job_name = "crowdsec_postgresql";
metrics_path = "/metrics";
static_configs = [
{
targets = ["192.168.1.13:6060"];
}
];
}
];
};
loki = {

65
services/postgresql/default.nix
View file

@ -45,9 +45,8 @@ in {
localConfig = {
acquisitions = [
{
filenames = [
"/var/log/postgresql/*.log"
];
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=postgresql.service" ];
labels = {
type = "syslog";
};
@ -89,37 +88,37 @@ in {
GRANT ALL PRIVILEGES ON DATABASE onlyoffice TO onlyoffice;
'';
};
# Stolen from https://discourse.nixos.org/t/assign-password-to-postgres-user-declaratively/9726/3
# This is an awful situation
systemd.services.postgresql.postStart = let
nextcloudDBPass = config.age.secrets.nextcloudDBPass.path;
giteaDBPass = config.age.secrets.giteaDBPass.path;
authentikDBPass = config.age.secrets.authentikDBPass.path;
grafanaDBPass = config.age.secrets.grafanaDBPass.path;
onlyofficeDBPass = config.age.secrets.onlyofficeDBPass.path;
in ''
$PSQL -tA <<'EOF'
DO $$
DECLARE password TEXT;
BEGIN
password := trim(both from replace(pg_read_file('${nextcloudDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE nextcloud WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${giteaDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE gitea WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${authentikDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE authentik WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${grafanaDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE grafana WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${onlyofficeDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE onlyoffice WITH PASSWORD '''%s''';', password);
END $$;
EOF
'';
};
# Stolen from https://discourse.nixos.org/t/assign-password-to-postgres-user-declaratively/9726/3
# This is an awful situation
systemd.services.postgresql.postStart = let
nextcloudDBPass = config.age.secrets.nextcloudDBPass.path;
giteaDBPass = config.age.secrets.giteaDBPass.path;
authentikDBPass = config.age.secrets.authentikDBPass.path;
grafanaDBPass = config.age.secrets.grafanaDBPass.path;
onlyofficeDBPass = config.age.secrets.onlyofficeDBPass.path;
in ''
$PSQL -tA <<'EOF'
DO $$
DECLARE password TEXT;
BEGIN
password := trim(both from replace(pg_read_file('${nextcloudDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE nextcloud WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${giteaDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE gitea WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${authentikDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE authentik WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${grafanaDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE grafana WITH PASSWORD '''%s''';', password);
password := trim(both from replace(pg_read_file('${onlyofficeDBPass}'), E'\n', '''));
EXECUTE format('ALTER ROLE onlyoffice WITH PASSWORD '''%s''';', password);
END $$;
EOF
'';
networking.firewall.allowedTCPPorts = [5432];
};
}

3
systems/minimalLXCConfig.nix
View file

@ -112,9 +112,6 @@
}
];
};
fail2ban = {
enable = true;
};
crowdsec = {
enable = true;
package = pkgs.crowdsec;

3
systems/minimalVMConfig.nix
View file

@ -99,9 +99,6 @@
}
];
};
fail2ban = {
enable = true;
};
crowdsec = {
enable = true;
package = pkgs.crowdsec;