trying akvorado
This commit is contained in:
parent
5aab046d7b
commit
2db9235ad0
4 changed files with 636 additions and 14 deletions
538
akvorado.nix
Normal file
538
akvorado.nix
Normal file
|
|
@ -0,0 +1,538 @@
|
|||
# Auto-generated by compose2nix.
|
||||
|
||||
{ pkgs, lib, config, ... }:
|
||||
|
||||
{
|
||||
# Runtime
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
|
||||
# Enable container name DNS for all Podman networks.
|
||||
networking.firewall.interfaces = let
|
||||
matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
|
||||
in {
|
||||
"${matchAll}".allowedUDPPorts = [ 53 ];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.backend = "podman";
|
||||
|
||||
# Containers
|
||||
virtualisation.oci-containers.containers."akvoado-akvorado-console" = {
|
||||
image = "ghcr.io/akvorado/akvorado:2.1.1";
|
||||
environment = {
|
||||
"AKVORADO_CFG_CONSOLE_BRANDING" = "false";
|
||||
"AKVORADO_CFG_CONSOLE_DATABASE_DSN" = "/run/akvorado/console.sqlite";
|
||||
};
|
||||
volumes = [
|
||||
"akvoado_akvorado-console-db:/run/akvorado:rw"
|
||||
];
|
||||
cmd = [ "console" "http://akvorado-orchestrator:8080" ];
|
||||
labels = {
|
||||
"metrics.path" = "/api/v0/metrics";
|
||||
"metrics.port" = "8080";
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.middlewares.console-auth.headers.customrequestheaders.Remote-Email" = "alfred@example.com";
|
||||
"traefik.http.middlewares.console-auth.headers.customrequestheaders.Remote-Name" = "Alfred Pennyworth";
|
||||
"traefik.http.middlewares.console-auth.headers.customrequestheaders.Remote-User" = "alfred";
|
||||
"traefik.http.routers.akvorado-console-debug.entrypoints" = "private";
|
||||
"traefik.http.routers.akvorado-console-debug.rule" = "PathPrefix(`/debug`)";
|
||||
"traefik.http.routers.akvorado-console-debug.service" = "akvorado-console";
|
||||
"traefik.http.routers.akvorado-console-metrics.observability.accesslogs" = "false";
|
||||
"traefik.http.routers.akvorado-console-metrics.rule" = "PathPrefix(`/api/v0/console/metrics`)";
|
||||
"traefik.http.routers.akvorado-console-metrics.service" = "akvorado-console";
|
||||
"traefik.http.routers.akvorado-console.middlewares" = "console-auth";
|
||||
"traefik.http.routers.akvorado-console.priority" = "1";
|
||||
"traefik.http.routers.akvorado-console.rule" = "!PathPrefix(`/debug`)";
|
||||
"traefik.http.services.akvorado-console.loadbalancer.server.port" = "8080";
|
||||
};
|
||||
dependsOn = [
|
||||
"akvoado-akvorado-orchestrator"
|
||||
"akvoado-clickhouse"
|
||||
"akvoado-redis"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=akvorado-console"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-akvorado-console" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-console-db.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-console-db.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."akvoado-akvorado-inlet" = {
|
||||
image = "ghcr.io/akvorado/akvorado:2.1.1";
|
||||
volumes = [
|
||||
"akvoado_akvorado-run:/run/akvorado:rw"
|
||||
];
|
||||
ports = [
|
||||
"2055:2055/udp"
|
||||
"4739:4739/udp"
|
||||
"6343:6343/udp"
|
||||
];
|
||||
cmd = [ "inlet" "http://akvorado-orchestrator:8080" ];
|
||||
labels = {
|
||||
"metrics.path" = "/api/v0/metrics";
|
||||
"metrics.port" = "8080";
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.routers.akvorado-inlet-metrics.observability.accesslogs" = "false";
|
||||
"traefik.http.routers.akvorado-inlet-metrics.rule" = "PathPrefix(`/api/v0/inlet/metrics`)";
|
||||
"traefik.http.routers.akvorado-inlet-metrics.service" = "akvorado-inlet";
|
||||
"traefik.http.routers.akvorado-inlet.entrypoints" = "private";
|
||||
"traefik.http.routers.akvorado-inlet.rule" = "PathPrefix(`/api/v0/inlet`)";
|
||||
"traefik.http.services.akvorado-inlet.loadbalancer.server.port" = "8080";
|
||||
};
|
||||
dependsOn = [
|
||||
"akvoado-akvorado-orchestrator"
|
||||
"akvoado-kafka"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=akvorado-inlet"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-akvorado-inlet" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-run.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-run.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."akvoado-akvorado-orchestrator" = {
|
||||
image = "ghcr.io/akvorado/akvorado:2.1.1";
|
||||
volumes = [
|
||||
"/root/akvorado/config:/etc/akvorado:ro"
|
||||
"akvoado_akvorado-geoip:/usr/share/GeoIP:ro"
|
||||
];
|
||||
cmd = [ "orchestrator" "/etc/akvorado/akvorado.yaml" ];
|
||||
labels = {
|
||||
"metrics.path" = "/api/v0/metrics";
|
||||
"metrics.port" = "8080";
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.routers.akvorado-orchestrator-metrics.observability.accesslogs" = "false";
|
||||
"traefik.http.routers.akvorado-orchestrator-metrics.rule" = "PathPrefix(`/api/v0/orchestrator/metrics`)";
|
||||
"traefik.http.routers.akvorado-orchestrator-metrics.service" = "akvorado-orchestrator";
|
||||
"traefik.http.routers.akvorado-orchestrator.entrypoints" = "private";
|
||||
"traefik.http.routers.akvorado-orchestrator.rule" = "PathPrefix(`/api/v0/orchestrator`)";
|
||||
"traefik.http.services.akvorado-orchestrator.loadbalancer.server.port" = "8080";
|
||||
};
|
||||
dependsOn = [
|
||||
"akvoado-kafka"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=akvorado-orchestrator"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-akvorado-orchestrator" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-geoip.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-geoip.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."akvoado-akvorado-outlet" = {
|
||||
image = "ghcr.io/akvorado/akvorado:2.1.1";
|
||||
environment = {
|
||||
"AKVORADO_CFG_OUTLET_FLOW_STATEPERSISTFILE" = "/run/akvorado/flow.state";
|
||||
"AKVORADO_CFG_OUTLET_METADATA_CACHEPERSISTFILE" = "/run/akvorado/metadata.cache";
|
||||
};
|
||||
volumes = [
|
||||
"akvoado_akvorado-run:/run/akvorado:rw"
|
||||
];
|
||||
ports = [
|
||||
"10179:10179/tcp"
|
||||
];
|
||||
cmd = [ "outlet" "http://akvorado-orchestrator:8080" ];
|
||||
labels = {
|
||||
"metrics.path" = "/api/v0/metrics";
|
||||
"metrics.port" = "8080";
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.routers.akvorado-outlet-metrics.observability.accesslogs" = "false";
|
||||
"traefik.http.routers.akvorado-outlet-metrics.rule" = "PathPrefix(`/api/v0/outlet/metrics`)";
|
||||
"traefik.http.routers.akvorado-outlet-metrics.service" = "akvorado-outlet";
|
||||
"traefik.http.routers.akvorado-outlet.entrypoints" = "private";
|
||||
"traefik.http.routers.akvorado-outlet.rule" = "PathPrefix(`/api/v0/outlet`)";
|
||||
"traefik.http.services.akvorado-outlet.loadbalancer.server.port" = "8080";
|
||||
};
|
||||
dependsOn = [
|
||||
"akvoado-akvorado-orchestrator"
|
||||
"akvoado-clickhouse"
|
||||
"akvoado-kafka"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=akvorado-outlet"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-akvorado-outlet" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-run.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-run.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."akvoado-clickhouse" = {
|
||||
image = "clickhouse/clickhouse-server:25.8";
|
||||
environment = {
|
||||
"CLICKHOUSE_INIT_TIMEOUT" = "60";
|
||||
"CLICKHOUSE_SKIP_USER_SETUP" = "1";
|
||||
};
|
||||
volumes = [
|
||||
"/root/akvorado/docker/clickhouse/observability.xml:/etc/clickhouse-server/config.d/observability.xml:rw"
|
||||
"/root/akvorado/docker/clickhouse/server.xml:/etc/clickhouse-server/config.d/akvorado.xml:rw"
|
||||
"akvoado_akvorado-clickhouse:/var/lib/clickhouse:rw"
|
||||
];
|
||||
labels = {
|
||||
"metrics.port" = "8123";
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.middlewares.clickhouse-strip.stripprefix.prefixes" = "/clickhouse";
|
||||
"traefik.http.routers.clickhouse.entrypoints" = "private";
|
||||
"traefik.http.routers.clickhouse.middlewares" = "clickhouse-strip";
|
||||
"traefik.http.routers.clickhouse.rule" = "PathPrefix(`/clickhouse`)";
|
||||
};
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--cap-add=SYS_NICE"
|
||||
"--health-cmd=[\"wget\", \"-T\", \"1\", \"--spider\", \"--no-proxy\", \"http://127.0.0.1:8123/ping\"]"
|
||||
"--health-interval=20s"
|
||||
"--network-alias=clickhouse"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-clickhouse" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-clickhouse.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-clickhouse.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."akvoado-kafka" = {
|
||||
image = "apache/kafka:4.1.1";
|
||||
environment = {
|
||||
"KAFKA_ADVERTISED_LISTENERS" = "CLIENT://kafka:9092";
|
||||
"KAFKA_CONTROLLER_LISTENER_NAMES" = "CONTROLLER";
|
||||
"KAFKA_CONTROLLER_QUORUM_VOTERS" = "1@kafka:9093";
|
||||
"KAFKA_DELETE_TOPIC_ENABLE" = "true";
|
||||
"KAFKA_INTER_BROKER_LISTENER_NAME" = "CLIENT";
|
||||
"KAFKA_LISTENERS" = "CLIENT://:9092,CONTROLLER://:9093";
|
||||
"KAFKA_LISTENER_SECURITY_PROTOCOL_MAP" = "CLIENT:PLAINTEXT,CONTROLLER:PLAINTEXT";
|
||||
"KAFKA_LOG_DIRS" = "/var/lib/kafka/data";
|
||||
"KAFKA_NODE_ID" = "1";
|
||||
"KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR" = "1";
|
||||
"KAFKA_PROCESS_ROLES" = "controller,broker";
|
||||
"KAFKA_SHARE_COORDINATOR_STATE_TOPIC_MIN_ISR" = "1";
|
||||
"KAFKA_SHARE_COORDINATOR_STATE_TOPIC_REPLICATION_FACTOR" = "1";
|
||||
"KAFKA_TRANSACTION_STATE_LOG_MIN_ISR" = "1";
|
||||
"KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR" = "1";
|
||||
};
|
||||
volumes = [
|
||||
"akvoado_akvorado-kafka:/var/lib/kafka/data:rw"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--health-cmd=[\"/opt/kafka/bin/kafka-topics.sh\", \"--list\", \"--bootstrap-server\", \"kafka:9092\"]"
|
||||
"--health-interval=20s"
|
||||
"--network-alias=kafka"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-kafka" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-kafka.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
"podman-volume-akvoado_akvorado-kafka.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."akvoado-kafka-ui" = {
|
||||
image = "ghcr.io/kafbat/kafka-ui:v1.4.2";
|
||||
environment = {
|
||||
"KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS" = "kafka:9092";
|
||||
"KAFKA_CLUSTERS_0_NAME" = "local";
|
||||
"KAFKA_CLUSTERS_0_READONLY" = "true";
|
||||
"SERVER_SERVLET_CONTEXT_PATH" = "/kafka-ui";
|
||||
};
|
||||
labels = {
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.routers.kafka-ui.rule" = "PathPrefix(`/kafka-ui`)";
|
||||
};
|
||||
dependsOn = [
|
||||
"akvoado-kafka"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=kafka-ui"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-kafka-ui" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."akvoado-redis" = {
|
||||
image = "valkey/valkey:7.2";
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--health-cmd=timeout 3 redis-cli ping | grep -q PONG"
|
||||
"--health-interval=20s"
|
||||
"--network-alias=redis"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-redis" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
virtualisation.oci-containers.containers."akvoado-traefik" = {
|
||||
image = "traefik:v3.6";
|
||||
environment = {
|
||||
"TRAEFIK_ACCESSLOG" = "true";
|
||||
"TRAEFIK_API" = "true";
|
||||
"TRAEFIK_API_BASEPATH" = "/traefik";
|
||||
"TRAEFIK_ENTRYPOINTS_private_ADDRESS" = ":8080";
|
||||
"TRAEFIK_ENTRYPOINTS_private_HTTP_MIDDLEWARES" = "compress@docker";
|
||||
"TRAEFIK_ENTRYPOINTS_public_ADDRESS" = ":8081";
|
||||
"TRAEFIK_ENTRYPOINTS_public_HTTP_MIDDLEWARES" = "compress@docker";
|
||||
"TRAEFIK_METRICS_PROMETHEUS" = "true";
|
||||
"TRAEFIK_METRICS_PROMETHEUS_ADDROUTERSLABELS" = "true";
|
||||
"TRAEFIK_METRICS_PROMETHEUS_MANUALROUTING" = "true";
|
||||
"TRAEFIK_PROVIDERS_DOCKER" = "true";
|
||||
"TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT" = "false";
|
||||
};
|
||||
volumes = [
|
||||
"/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
];
|
||||
ports = [
|
||||
"127.0.0.1:8080:8080/tcp"
|
||||
"8081:8081/tcp"
|
||||
];
|
||||
labels = {
|
||||
"metrics.path" = "/traefik/metrics";
|
||||
"metrics.port" = "8080";
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.middlewares.compress.compress" = "true";
|
||||
"traefik.http.middlewares.compress.compress.includedcontenttypes" = "application/javascript,application/json,application/xml,image/svg+xml,text/css,text/csv,text/javascript,text/markdown,text/plain,text/xml";
|
||||
"traefik.http.routers.traefik-metrics.priority" = "200";
|
||||
"traefik.http.routers.traefik-metrics.rule" = "PathPrefix(`/traefik/metrics`)";
|
||||
"traefik.http.routers.traefik-metrics.service" = "prometheus@internal";
|
||||
"traefik.http.routers.traefik.rule" = "PathPrefix(`/traefik`) && !PathPrefix(`/traefik/debug`)";
|
||||
"traefik.http.routers.traefik.service" = "api@internal";
|
||||
};
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
"--network-alias=traefik"
|
||||
"--network=akvoado_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-akvoado-traefik" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
};
|
||||
after = [
|
||||
"podman-network-akvoado_default.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-akvoado_default.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-akvoado-root.target"
|
||||
];
|
||||
};
|
||||
|
||||
# Networks
|
||||
systemd.services."podman-network-akvoado_default" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStop = "podman network rm -f akvoado_default";
|
||||
};
|
||||
script = ''
|
||||
podman network inspect akvoado_default || podman network create akvoado_default --driver=bridge --opt=com.docker.network.bridge.name=br-akvorado --subnet=247.16.14.0/24 --subnet=fd1c:8ce3:6fb:1::/64 --ipv6
|
||||
'';
|
||||
partOf = [ "podman-compose-akvoado-root.target" ];
|
||||
wantedBy = [ "podman-compose-akvoado-root.target" ];
|
||||
};
|
||||
|
||||
# Volumes
|
||||
systemd.services."podman-volume-akvoado_akvorado-clickhouse" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
podman volume inspect akvoado_akvorado-clickhouse || podman volume create akvoado_akvorado-clickhouse
|
||||
'';
|
||||
partOf = [ "podman-compose-akvoado-root.target" ];
|
||||
wantedBy = [ "podman-compose-akvoado-root.target" ];
|
||||
};
|
||||
systemd.services."podman-volume-akvoado_akvorado-console-db" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
podman volume inspect akvoado_akvorado-console-db || podman volume create akvoado_akvorado-console-db
|
||||
'';
|
||||
partOf = [ "podman-compose-akvoado-root.target" ];
|
||||
wantedBy = [ "podman-compose-akvoado-root.target" ];
|
||||
};
|
||||
systemd.services."podman-volume-akvoado_akvorado-geoip" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
podman volume inspect akvoado_akvorado-geoip || podman volume create akvoado_akvorado-geoip
|
||||
'';
|
||||
partOf = [ "podman-compose-akvoado-root.target" ];
|
||||
wantedBy = [ "podman-compose-akvoado-root.target" ];
|
||||
};
|
||||
systemd.services."podman-volume-akvoado_akvorado-kafka" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
podman volume inspect akvoado_akvorado-kafka || podman volume create akvoado_akvorado-kafka
|
||||
'';
|
||||
partOf = [ "podman-compose-akvoado-root.target" ];
|
||||
wantedBy = [ "podman-compose-akvoado-root.target" ];
|
||||
};
|
||||
systemd.services."podman-volume-akvoado_akvorado-run" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
podman volume inspect akvoado_akvorado-run || podman volume create akvoado_akvorado-run
|
||||
'';
|
||||
partOf = [ "podman-compose-akvoado-root.target" ];
|
||||
wantedBy = [ "podman-compose-akvoado-root.target" ];
|
||||
};
|
||||
|
||||
# Root service
|
||||
# When started, this will automatically create all resources and start
|
||||
# the containers. When stopped, this will teardown all resources.
|
||||
systemd.targets."podman-compose-akvoado-root" = {
|
||||
unitConfig = {
|
||||
Description = "Root target generated by compose2nix.";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
}
|
||||
|
|
@ -14,6 +14,7 @@
|
|||
imports = [
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./akvorado.nix
|
||||
specialArgs.inputs.vscode-server.nixosModules.default
|
||||
];
|
||||
|
||||
|
|
@ -32,7 +33,7 @@
|
|||
# "net.bridge.bridge-nf-call-iptables" = 1;
|
||||
# "net.bridge.bridge-nf-call-ip6tables" = 1;
|
||||
};
|
||||
|
||||
|
||||
boot.supportedFilesystems = [ "zfs" ];
|
||||
boot.zfs.forceImportRoot = false;
|
||||
|
||||
|
|
@ -63,12 +64,23 @@
|
|||
443
|
||||
2222 # forgejo ssh
|
||||
3000 # forgejo frontend
|
||||
2055 # akvorado sink
|
||||
8080 # akvorado frontend
|
||||
8081 # akvorado frontend
|
||||
8123 # homeassistant
|
||||
5580 # homeassistant matter
|
||||
2283 # immich
|
||||
3003 # immich ml
|
||||
1984 # frigate go2rtc
|
||||
8971 # frigate
|
||||
8554 # frigate rtsp
|
||||
8555 # frigate rtsp
|
||||
9000
|
||||
];
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
8555 # frigate rtsp
|
||||
2055 # ntopng sink
|
||||
];
|
||||
|
||||
# Users
|
||||
users.users.root = {
|
||||
|
|
@ -99,6 +111,7 @@
|
|||
inetutils
|
||||
smartmontools
|
||||
parted
|
||||
borgbackup
|
||||
|
||||
nil
|
||||
];
|
||||
|
|
@ -115,7 +128,6 @@
|
|||
hardware.bluetooth.enable = true;
|
||||
services.blueman.enable = true;
|
||||
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "mail@kempinger.xyz";
|
||||
|
|
@ -123,7 +135,7 @@
|
|||
};
|
||||
|
||||
services.resolved.enable = true;
|
||||
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
|
@ -204,6 +216,34 @@
|
|||
# USER = "noreply@${srv.DOMAIN}";
|
||||
# };
|
||||
};
|
||||
dump = {
|
||||
enable = true;
|
||||
backupDir = "/backup/forgejo";
|
||||
age = "6 months";
|
||||
interval = "weekly";
|
||||
};
|
||||
};
|
||||
|
||||
# services.borgbackup.jobs."forgejo" = {
|
||||
# paths = config.services.forgejo.repositoryRoot;
|
||||
# repo = "/backup/forgejo";
|
||||
# startAt = "Sat 04:00";
|
||||
# compression = "zstd";
|
||||
# encryption.mode = "none";
|
||||
# prune.keep = {
|
||||
# last = 2;
|
||||
# };
|
||||
# };
|
||||
|
||||
services.borgbackup.jobs."immich" = {
|
||||
paths = config.services.immich.mediaLocation;
|
||||
repo = "/backup/immich";
|
||||
startAt = "Sat 04:00";
|
||||
compression = "zstd";
|
||||
encryption.mode = "none";
|
||||
prune.keep = {
|
||||
last = 2;
|
||||
};
|
||||
};
|
||||
|
||||
# systemd.services.forgejo.preStart =
|
||||
|
|
@ -230,6 +270,7 @@
|
|||
volumes = [
|
||||
"home-assistant:/config"
|
||||
"/run/dbus:/run/dbus:ro"
|
||||
"/backup/home-assistant:/config/backups"
|
||||
];
|
||||
environment.TZ = "Europe/Berlin";
|
||||
# Note: The image will not be updated on rebuilds, unless the version label changes
|
||||
|
|
@ -256,6 +297,36 @@
|
|||
"--privileged"
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
containers.frigate = {
|
||||
#autoStart = true;
|
||||
volumes = [
|
||||
"frigate:/config"
|
||||
"/run/dbus:/run/dbus:ro"
|
||||
"/etc/localtime:/etc/localtime:ro"
|
||||
];
|
||||
environment.FRIGATE_RTSP_PASSWORD = "password123";
|
||||
# Note: The image will not be updated on rebuilds, unless the version label changes
|
||||
image = "ghcr.io/blakeblackshear/frigate:stable";
|
||||
extraOptions = [
|
||||
"--shm-size=512m"
|
||||
"--network=host"
|
||||
];
|
||||
};
|
||||
containers.mosquitto = {
|
||||
#autoStart = true;
|
||||
volumes = [
|
||||
"mosquitto:/mosquitto"
|
||||
"/run/dbus:/run/dbus:ro"
|
||||
"/etc/localtime:/etc/localtime:ro"
|
||||
];
|
||||
# Note: The image will not be updated on rebuilds, unless the version label changes
|
||||
image = "eclipse-mosquitto";
|
||||
extraOptions = [
|
||||
"--network=host"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.immich = {
|
||||
|
|
|
|||
6
flake.lock
generated
6
flake.lock
generated
|
|
@ -20,11 +20,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1763835633,
|
||||
"narHash": "sha256-HzxeGVID5MChuCPESuC0dlQL1/scDKu+MmzoVBJxulM=",
|
||||
"lastModified": 1766651565,
|
||||
"narHash": "sha256-QEhk0eXgyIqTpJ/ehZKg9IKS7EtlWxF3N7DXy42zPfU=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "050e09e091117c3d7328c7b2b7b577492c43c134",
|
||||
"rev": "3e2499d5539c16d0d173ba53552a4ff8547f4539",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
|
|
@ -1,13 +1,25 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
|
||||
|
||||
boot.initrd.availableKernelModules =
|
||||
[ "nvme" "ahci" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"ahci"
|
||||
"xhci_pci"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-amd" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
|
@ -20,18 +32,19 @@
|
|||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/467A-A4E4";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
|
||||
fileSystems."/backup" = {
|
||||
device = "backup";
|
||||
fsType = "zfs";
|
||||
};
|
||||
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.amd.updateMicrocode =
|
||||
lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue