trying akvorado

This commit is contained in:
Stefan Kempinger 2026-01-18 01:55:39 +01:00
parent 5aab046d7b
commit 2db9235ad0
4 changed files with 636 additions and 14 deletions

538
akvorado.nix Normal file
View file

@ -0,0 +1,538 @@
# Auto-generated by compose2nix.
{ pkgs, lib, config, ... }:
{
# Runtime
virtualisation.podman = {
enable = true;
autoPrune.enable = true;
dockerCompat = true;
};
# Enable container name DNS for all Podman networks.
networking.firewall.interfaces = let
matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
in {
"${matchAll}".allowedUDPPorts = [ 53 ];
};
virtualisation.oci-containers.backend = "podman";
# Containers
virtualisation.oci-containers.containers."akvoado-akvorado-console" = {
image = "ghcr.io/akvorado/akvorado:2.1.1";
environment = {
"AKVORADO_CFG_CONSOLE_BRANDING" = "false";
"AKVORADO_CFG_CONSOLE_DATABASE_DSN" = "/run/akvorado/console.sqlite";
};
volumes = [
"akvoado_akvorado-console-db:/run/akvorado:rw"
];
cmd = [ "console" "http://akvorado-orchestrator:8080" ];
labels = {
"metrics.path" = "/api/v0/metrics";
"metrics.port" = "8080";
"traefik.enable" = "true";
"traefik.http.middlewares.console-auth.headers.customrequestheaders.Remote-Email" = "alfred@example.com";
"traefik.http.middlewares.console-auth.headers.customrequestheaders.Remote-Name" = "Alfred Pennyworth";
"traefik.http.middlewares.console-auth.headers.customrequestheaders.Remote-User" = "alfred";
"traefik.http.routers.akvorado-console-debug.entrypoints" = "private";
"traefik.http.routers.akvorado-console-debug.rule" = "PathPrefix(`/debug`)";
"traefik.http.routers.akvorado-console-debug.service" = "akvorado-console";
"traefik.http.routers.akvorado-console-metrics.observability.accesslogs" = "false";
"traefik.http.routers.akvorado-console-metrics.rule" = "PathPrefix(`/api/v0/console/metrics`)";
"traefik.http.routers.akvorado-console-metrics.service" = "akvorado-console";
"traefik.http.routers.akvorado-console.middlewares" = "console-auth";
"traefik.http.routers.akvorado-console.priority" = "1";
"traefik.http.routers.akvorado-console.rule" = "!PathPrefix(`/debug`)";
"traefik.http.services.akvorado-console.loadbalancer.server.port" = "8080";
};
dependsOn = [
"akvoado-akvorado-orchestrator"
"akvoado-clickhouse"
"akvoado-redis"
];
log-driver = "journald";
extraOptions = [
"--network-alias=akvorado-console"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-akvorado-console" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-console-db.service"
];
requires = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-console-db.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
virtualisation.oci-containers.containers."akvoado-akvorado-inlet" = {
image = "ghcr.io/akvorado/akvorado:2.1.1";
volumes = [
"akvoado_akvorado-run:/run/akvorado:rw"
];
ports = [
"2055:2055/udp"
"4739:4739/udp"
"6343:6343/udp"
];
cmd = [ "inlet" "http://akvorado-orchestrator:8080" ];
labels = {
"metrics.path" = "/api/v0/metrics";
"metrics.port" = "8080";
"traefik.enable" = "true";
"traefik.http.routers.akvorado-inlet-metrics.observability.accesslogs" = "false";
"traefik.http.routers.akvorado-inlet-metrics.rule" = "PathPrefix(`/api/v0/inlet/metrics`)";
"traefik.http.routers.akvorado-inlet-metrics.service" = "akvorado-inlet";
"traefik.http.routers.akvorado-inlet.entrypoints" = "private";
"traefik.http.routers.akvorado-inlet.rule" = "PathPrefix(`/api/v0/inlet`)";
"traefik.http.services.akvorado-inlet.loadbalancer.server.port" = "8080";
};
dependsOn = [
"akvoado-akvorado-orchestrator"
"akvoado-kafka"
];
log-driver = "journald";
extraOptions = [
"--network-alias=akvorado-inlet"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-akvorado-inlet" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-run.service"
];
requires = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-run.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
virtualisation.oci-containers.containers."akvoado-akvorado-orchestrator" = {
image = "ghcr.io/akvorado/akvorado:2.1.1";
volumes = [
"/root/akvorado/config:/etc/akvorado:ro"
"akvoado_akvorado-geoip:/usr/share/GeoIP:ro"
];
cmd = [ "orchestrator" "/etc/akvorado/akvorado.yaml" ];
labels = {
"metrics.path" = "/api/v0/metrics";
"metrics.port" = "8080";
"traefik.enable" = "true";
"traefik.http.routers.akvorado-orchestrator-metrics.observability.accesslogs" = "false";
"traefik.http.routers.akvorado-orchestrator-metrics.rule" = "PathPrefix(`/api/v0/orchestrator/metrics`)";
"traefik.http.routers.akvorado-orchestrator-metrics.service" = "akvorado-orchestrator";
"traefik.http.routers.akvorado-orchestrator.entrypoints" = "private";
"traefik.http.routers.akvorado-orchestrator.rule" = "PathPrefix(`/api/v0/orchestrator`)";
"traefik.http.services.akvorado-orchestrator.loadbalancer.server.port" = "8080";
};
dependsOn = [
"akvoado-kafka"
];
log-driver = "journald";
extraOptions = [
"--network-alias=akvorado-orchestrator"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-akvorado-orchestrator" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-geoip.service"
];
requires = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-geoip.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
virtualisation.oci-containers.containers."akvoado-akvorado-outlet" = {
image = "ghcr.io/akvorado/akvorado:2.1.1";
environment = {
"AKVORADO_CFG_OUTLET_FLOW_STATEPERSISTFILE" = "/run/akvorado/flow.state";
"AKVORADO_CFG_OUTLET_METADATA_CACHEPERSISTFILE" = "/run/akvorado/metadata.cache";
};
volumes = [
"akvoado_akvorado-run:/run/akvorado:rw"
];
ports = [
"10179:10179/tcp"
];
cmd = [ "outlet" "http://akvorado-orchestrator:8080" ];
labels = {
"metrics.path" = "/api/v0/metrics";
"metrics.port" = "8080";
"traefik.enable" = "true";
"traefik.http.routers.akvorado-outlet-metrics.observability.accesslogs" = "false";
"traefik.http.routers.akvorado-outlet-metrics.rule" = "PathPrefix(`/api/v0/outlet/metrics`)";
"traefik.http.routers.akvorado-outlet-metrics.service" = "akvorado-outlet";
"traefik.http.routers.akvorado-outlet.entrypoints" = "private";
"traefik.http.routers.akvorado-outlet.rule" = "PathPrefix(`/api/v0/outlet`)";
"traefik.http.services.akvorado-outlet.loadbalancer.server.port" = "8080";
};
dependsOn = [
"akvoado-akvorado-orchestrator"
"akvoado-clickhouse"
"akvoado-kafka"
];
log-driver = "journald";
extraOptions = [
"--network-alias=akvorado-outlet"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-akvorado-outlet" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-run.service"
];
requires = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-run.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
virtualisation.oci-containers.containers."akvoado-clickhouse" = {
image = "clickhouse/clickhouse-server:25.8";
environment = {
"CLICKHOUSE_INIT_TIMEOUT" = "60";
"CLICKHOUSE_SKIP_USER_SETUP" = "1";
};
volumes = [
"/root/akvorado/docker/clickhouse/observability.xml:/etc/clickhouse-server/config.d/observability.xml:rw"
"/root/akvorado/docker/clickhouse/server.xml:/etc/clickhouse-server/config.d/akvorado.xml:rw"
"akvoado_akvorado-clickhouse:/var/lib/clickhouse:rw"
];
labels = {
"metrics.port" = "8123";
"traefik.enable" = "true";
"traefik.http.middlewares.clickhouse-strip.stripprefix.prefixes" = "/clickhouse";
"traefik.http.routers.clickhouse.entrypoints" = "private";
"traefik.http.routers.clickhouse.middlewares" = "clickhouse-strip";
"traefik.http.routers.clickhouse.rule" = "PathPrefix(`/clickhouse`)";
};
log-driver = "journald";
extraOptions = [
"--cap-add=SYS_NICE"
"--health-cmd=[\"wget\", \"-T\", \"1\", \"--spider\", \"--no-proxy\", \"http://127.0.0.1:8123/ping\"]"
"--health-interval=20s"
"--network-alias=clickhouse"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-clickhouse" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-clickhouse.service"
];
requires = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-clickhouse.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
virtualisation.oci-containers.containers."akvoado-kafka" = {
image = "apache/kafka:4.1.1";
environment = {
"KAFKA_ADVERTISED_LISTENERS" = "CLIENT://kafka:9092";
"KAFKA_CONTROLLER_LISTENER_NAMES" = "CONTROLLER";
"KAFKA_CONTROLLER_QUORUM_VOTERS" = "1@kafka:9093";
"KAFKA_DELETE_TOPIC_ENABLE" = "true";
"KAFKA_INTER_BROKER_LISTENER_NAME" = "CLIENT";
"KAFKA_LISTENERS" = "CLIENT://:9092,CONTROLLER://:9093";
"KAFKA_LISTENER_SECURITY_PROTOCOL_MAP" = "CLIENT:PLAINTEXT,CONTROLLER:PLAINTEXT";
"KAFKA_LOG_DIRS" = "/var/lib/kafka/data";
"KAFKA_NODE_ID" = "1";
"KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR" = "1";
"KAFKA_PROCESS_ROLES" = "controller,broker";
"KAFKA_SHARE_COORDINATOR_STATE_TOPIC_MIN_ISR" = "1";
"KAFKA_SHARE_COORDINATOR_STATE_TOPIC_REPLICATION_FACTOR" = "1";
"KAFKA_TRANSACTION_STATE_LOG_MIN_ISR" = "1";
"KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR" = "1";
};
volumes = [
"akvoado_akvorado-kafka:/var/lib/kafka/data:rw"
];
log-driver = "journald";
extraOptions = [
"--health-cmd=[\"/opt/kafka/bin/kafka-topics.sh\", \"--list\", \"--bootstrap-server\", \"kafka:9092\"]"
"--health-interval=20s"
"--network-alias=kafka"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-kafka" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-kafka.service"
];
requires = [
"podman-network-akvoado_default.service"
"podman-volume-akvoado_akvorado-kafka.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
virtualisation.oci-containers.containers."akvoado-kafka-ui" = {
image = "ghcr.io/kafbat/kafka-ui:v1.4.2";
environment = {
"KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS" = "kafka:9092";
"KAFKA_CLUSTERS_0_NAME" = "local";
"KAFKA_CLUSTERS_0_READONLY" = "true";
"SERVER_SERVLET_CONTEXT_PATH" = "/kafka-ui";
};
labels = {
"traefik.enable" = "true";
"traefik.http.routers.kafka-ui.rule" = "PathPrefix(`/kafka-ui`)";
};
dependsOn = [
"akvoado-kafka"
];
log-driver = "journald";
extraOptions = [
"--network-alias=kafka-ui"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-kafka-ui" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
];
requires = [
"podman-network-akvoado_default.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
virtualisation.oci-containers.containers."akvoado-redis" = {
image = "valkey/valkey:7.2";
log-driver = "journald";
extraOptions = [
"--health-cmd=timeout 3 redis-cli ping | grep -q PONG"
"--health-interval=20s"
"--network-alias=redis"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-redis" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
];
requires = [
"podman-network-akvoado_default.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
virtualisation.oci-containers.containers."akvoado-traefik" = {
image = "traefik:v3.6";
environment = {
"TRAEFIK_ACCESSLOG" = "true";
"TRAEFIK_API" = "true";
"TRAEFIK_API_BASEPATH" = "/traefik";
"TRAEFIK_ENTRYPOINTS_private_ADDRESS" = ":8080";
"TRAEFIK_ENTRYPOINTS_private_HTTP_MIDDLEWARES" = "compress@docker";
"TRAEFIK_ENTRYPOINTS_public_ADDRESS" = ":8081";
"TRAEFIK_ENTRYPOINTS_public_HTTP_MIDDLEWARES" = "compress@docker";
"TRAEFIK_METRICS_PROMETHEUS" = "true";
"TRAEFIK_METRICS_PROMETHEUS_ADDROUTERSLABELS" = "true";
"TRAEFIK_METRICS_PROMETHEUS_MANUALROUTING" = "true";
"TRAEFIK_PROVIDERS_DOCKER" = "true";
"TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT" = "false";
};
volumes = [
"/var/run/docker.sock:/var/run/docker.sock:ro"
];
ports = [
"127.0.0.1:8080:8080/tcp"
"8081:8081/tcp"
];
labels = {
"metrics.path" = "/traefik/metrics";
"metrics.port" = "8080";
"traefik.enable" = "true";
"traefik.http.middlewares.compress.compress" = "true";
"traefik.http.middlewares.compress.compress.includedcontenttypes" = "application/javascript,application/json,application/xml,image/svg+xml,text/css,text/csv,text/javascript,text/markdown,text/plain,text/xml";
"traefik.http.routers.traefik-metrics.priority" = "200";
"traefik.http.routers.traefik-metrics.rule" = "PathPrefix(`/traefik/metrics`)";
"traefik.http.routers.traefik-metrics.service" = "prometheus@internal";
"traefik.http.routers.traefik.rule" = "PathPrefix(`/traefik`) && !PathPrefix(`/traefik/debug`)";
"traefik.http.routers.traefik.service" = "api@internal";
};
log-driver = "journald";
extraOptions = [
"--network-alias=traefik"
"--network=akvoado_default"
];
};
systemd.services."podman-akvoado-traefik" = {
serviceConfig = {
Restart = lib.mkOverride 90 "always";
};
after = [
"podman-network-akvoado_default.service"
];
requires = [
"podman-network-akvoado_default.service"
];
partOf = [
"podman-compose-akvoado-root.target"
];
wantedBy = [
"podman-compose-akvoado-root.target"
];
};
# Networks
systemd.services."podman-network-akvoado_default" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "podman network rm -f akvoado_default";
};
script = ''
podman network inspect akvoado_default || podman network create akvoado_default --driver=bridge --opt=com.docker.network.bridge.name=br-akvorado --subnet=247.16.14.0/24 --subnet=fd1c:8ce3:6fb:1::/64 --ipv6
'';
partOf = [ "podman-compose-akvoado-root.target" ];
wantedBy = [ "podman-compose-akvoado-root.target" ];
};
# Volumes
systemd.services."podman-volume-akvoado_akvorado-clickhouse" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect akvoado_akvorado-clickhouse || podman volume create akvoado_akvorado-clickhouse
'';
partOf = [ "podman-compose-akvoado-root.target" ];
wantedBy = [ "podman-compose-akvoado-root.target" ];
};
systemd.services."podman-volume-akvoado_akvorado-console-db" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect akvoado_akvorado-console-db || podman volume create akvoado_akvorado-console-db
'';
partOf = [ "podman-compose-akvoado-root.target" ];
wantedBy = [ "podman-compose-akvoado-root.target" ];
};
systemd.services."podman-volume-akvoado_akvorado-geoip" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect akvoado_akvorado-geoip || podman volume create akvoado_akvorado-geoip
'';
partOf = [ "podman-compose-akvoado-root.target" ];
wantedBy = [ "podman-compose-akvoado-root.target" ];
};
systemd.services."podman-volume-akvoado_akvorado-kafka" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect akvoado_akvorado-kafka || podman volume create akvoado_akvorado-kafka
'';
partOf = [ "podman-compose-akvoado-root.target" ];
wantedBy = [ "podman-compose-akvoado-root.target" ];
};
systemd.services."podman-volume-akvoado_akvorado-run" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
podman volume inspect akvoado_akvorado-run || podman volume create akvoado_akvorado-run
'';
partOf = [ "podman-compose-akvoado-root.target" ];
wantedBy = [ "podman-compose-akvoado-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-akvoado-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}