From a624526c5b834c70616d0060be5e8e9779555764 Mon Sep 17 00:00:00 2001 From: chayleaf Date: Fri, 15 Dec 2023 06:03:46 +0700 Subject: [PATCH] add prometheus-ping-exporter; misc changes --- flake.nix | 3 +- home/common/general.nix | 1 + pkgs/default.nix | 3 +- pkgs/ping-exporter/default.nix | 24 ++++ system/devices/bpi-r3-router.nix | 6 + system/devices/radxa-rock5a-server.nix | 6 + system/hosts/router/metrics.nix | 12 ++ system/hosts/server/default.nix | 5 +- system/hosts/server/home.nix | 1 + system/modules/ping-exporter.nix | 151 +++++++++++++++++++++++++ 10 files changed, 207 insertions(+), 5 deletions(-) create mode 100644 pkgs/ping-exporter/default.nix create mode 100644 system/modules/ping-exporter.nix diff --git a/flake.nix b/flake.nix index f686f88..6882367 100644 --- a/flake.nix +++ b/flake.nix @@ -112,7 +112,7 @@ pkgs = super; nurpkgs = super; }; - nix-gaming = nix-gaming.packages.${super.system}; + inherit nix-gaming; } // args); overlay = overlay' { }; # I override some settings down the line, but overlays always stay the same @@ -133,6 +133,7 @@ _module.args.notnft = if devNft then (import /${devPath}/notnft { inherit (nixpkgs) lib; }).config.notnft else notnft.lib.${system}; } (if devNixRt then import /${devPath}/nixos-router else nixos-router.nixosModules.default) + ./system/modules/ping-exporter.nix ]; }; crossConfig' = from: config: config // { diff --git a/home/common/general.nix b/home/common/general.nix index 4744e49..cdfc6c3 100644 --- a/home/common/general.nix +++ b/home/common/general.nix @@ -147,6 +147,7 @@ readline = { enable = true; variables.editing-mode = "vi"; + variables.show-mode-in-prompt = true; }; nix-index = { enable = true; diff --git a/pkgs/default.nix b/pkgs/default.nix index 007d892..6ca8974 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -14,7 +14,7 @@ let in { - inherit (nix-gaming) faf-client osu-lazer-bin; + inherit (nix-gaming.packages.${pkgs.system}) faf-client osu-lazer-bin; inherit nixForNixPlugins; nix = nixForNixPlugins; nixVersions = pkgs.nixVersions.extend (self: super: { @@ -108,6 +108,7 @@ in kvmfrOverlay = kvmfr: kvmfr.overrideAttrs (old: { inherit (pkgs'.looking-glass-client) version src; }); + ping-exporter = callPackage ./ping-exporter { }; proton-ge = pkgs.stdenvNoCC.mkDerivation { inherit (sources.proton-ge) pname version src; installPhase = '' diff --git a/pkgs/ping-exporter/default.nix b/pkgs/ping-exporter/default.nix new file mode 100644 index 0000000..d5cda66 --- /dev/null +++ b/pkgs/ping-exporter/default.nix @@ -0,0 +1,24 @@ +{ lib +, fetchFromGitHub +, rustPlatform +}: + +rustPlatform.buildRustPackage rec { + pname = "ping-exporter"; + version = "0.1"; + + src = fetchFromGitHub { + owner = "chayleaf"; + repo = "ping-exporter"; + rev = "cf5e5f7e96fb477e015d44cd462fb996b944c896"; + hash = "sha256-eZncfKTegLp+KBnAds8YR7ZMN8i7jDIIN8qt7832+0Y="; + }; + + cargoLock.lockFile = "${src}/Cargo.lock"; + + meta = with lib; { + description = "A ping exporter for Prometheus"; + license = with lib.licenses; [ mit asl20 ]; + maintainers = with lib.maintainers; [ chayleaf ]; + }; +} diff --git a/system/devices/bpi-r3-router.nix b/system/devices/bpi-r3-router.nix index 9a94b98..1a23919 100644 --- a/system/devices/bpi-r3-router.nix +++ b/system/devices/bpi-r3-router.nix @@ -14,6 +14,12 @@ in ]; networking.hostName = "nixos-router"; + systemd.enableEmergencyMode = false; + boot.kernel.sysctl = { + "net.core.default_qdisc" = "fq"; + "net.ipv4.tcp_congestion_control" = "bbr"; + }; + fileSystems = { # mount root on tmpfs "/" = { device = "none"; fsType = "tmpfs"; neededForBoot = true; diff --git a/system/devices/radxa-rock5a-server.nix b/system/devices/radxa-rock5a-server.nix index feb19ab..0012429 100644 --- a/system/devices/radxa-rock5a-server.nix +++ b/system/devices/radxa-rock5a-server.nix @@ -29,6 +29,12 @@ in "dm_mod" "dm_crypt" "encrypted_keys" ]; + systemd.enableEmergencyMode = false; + boot.kernel.sysctl = { + "net.core.default_qdisc" = "fq"; + "net.ipv4.tcp_congestion_control" = "bbr"; + }; + networking.useDHCP = true; /* # as expected, systemd initrd and networking didn't work well, and i really cba to debug it diff --git a/system/hosts/router/metrics.nix b/system/hosts/router/metrics.nix index e55d414..f1a316e 100644 --- a/system/hosts/router/metrics.nix +++ b/system/hosts/router/metrics.nix @@ -31,6 +31,18 @@ in { ]; listenAddress = netAddresses.lan4; }; + ping = { + enable = true; + listenAddress = netAddresses.lan4; + port = 9380; + config = { + type = "raw"; + targets = [ + "8.8.8.8" + { target = "8.8.8.8"; netns = "wan"; } + ]; + }; + }; }; router.interfaces.br0 = let # all of this just to avoid logging commands... diff --git a/system/hosts/server/default.nix b/system/hosts/server/default.nix index 1809914..2c16199 100644 --- a/system/hosts/server/default.nix +++ b/system/hosts/server/default.nix @@ -134,13 +134,12 @@ in { })}'')} real_ip_header CF-Connecting-IP; ''; - # brotli and zstd requires recompilation so I don't enable it - # services.nginx.recommendedBrotliSettings = true; - # services.nginx.recommendedZstdSettings = true; + services.nginx.recommendedBrotliSettings = true; services.nginx.recommendedGzipSettings = true; services.nginx.recommendedOptimisation = true; services.nginx.recommendedProxySettings = true; services.nginx.recommendedTlsSettings = true; + services.nginx.recommendedZstdSettings = true; # BLOG services.nginx.virtualHosts.${cfg.domainName} = { diff --git a/system/hosts/server/home.nix b/system/hosts/server/home.nix index cca260e..6347c0f 100644 --- a/system/hosts/server/home.nix +++ b/system/hosts/server/home.nix @@ -315,6 +315,7 @@ in { "retracker.local:9101" "retracker.local:9256" "retracker.local:9167" + "retracker.local:9380" ]; labels.machine = "router"; } ]; diff --git a/system/modules/ping-exporter.nix b/system/modules/ping-exporter.nix new file mode 100644 index 0000000..bb14d31 --- /dev/null +++ b/system/modules/ping-exporter.nix @@ -0,0 +1,151 @@ +{ config +, lib +, pkgs +, ... +}: + +let + cfg = config.services.prometheus.exporters.ping; + inherit (lib) concatStrings literalExpression mkMerge mkDefault mkEnableOption mkIf mkOption types; + # copied from nixpkgs/nixos/modules/services/monitoring/prometheus/exporters + mkExporterOpts = { name, port }: { + enable = mkEnableOption (lib.mdDoc "the prometheus ${name} exporter"); + port = mkOption { + type = types.port; + default = port; + description = lib.mdDoc '' + Port to listen on. + ''; + }; + listenAddress = mkOption { + type = types.str; + default = "0.0.0.0"; + description = lib.mdDoc '' + Address to listen on. + ''; + }; + extraFlags = mkOption { + type = types.listOf types.str; + default = []; + description = lib.mdDoc '' + Extra commandline options to pass to the ${name} exporter. + ''; + }; + openFirewall = mkOption { + type = types.bool; + default = false; + description = lib.mdDoc '' + Open port in firewall for incoming connections. + ''; + }; + firewallFilter = mkOption { + type = types.nullOr types.str; + default = null; + example = literalExpression '' + "-i eth0 -p tcp -m tcp --dport ${toString port}" + ''; + description = lib.mdDoc '' + Specify a filter for iptables to use when + {option}`services.prometheus.exporters.${name}.openFirewall` + is true. It is used as `ip46tables -I nixos-fw firewallFilter -j nixos-fw-accept`. + ''; + }; + user = mkOption { + type = types.str; + default = "${name}-exporter"; + description = lib.mdDoc '' + User name under which the ${name} exporter shall be run. + ''; + }; + group = mkOption { + type = types.str; + default = "${name}-exporter"; + description = lib.mdDoc '' + Group under which the ${name} exporter shall be run. + ''; + }; + }; + mkExporterConf = { name, conf, serviceOpts }: + let + enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true; + in + mkIf conf.enable { + warnings = conf.warnings or []; + users.users."${name}-exporter" = (mkIf (conf.user == "${name}-exporter" && !enableDynamicUser) { + description = "Prometheus ${name} exporter service user"; + isSystemUser = true; + inherit (conf) group; + }); + users.groups = (mkIf (conf.group == "${name}-exporter" && !enableDynamicUser) { + "${name}-exporter" = {}; + }); + networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [ + "ip46tables -A nixos-fw ${conf.firewallFilter} " + "-m comment --comment ${name}-exporter -j nixos-fw-accept" + ]); + systemd.services."prometheus-${name}-exporter" = mkMerge ([{ + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + serviceConfig.Restart = mkDefault "always"; + serviceConfig.PrivateTmp = mkDefault true; + serviceConfig.WorkingDirectory = mkDefault /tmp; + serviceConfig.DynamicUser = mkDefault enableDynamicUser; + serviceConfig.User = mkDefault conf.user; + serviceConfig.Group = conf.group; + # Hardening + serviceConfig.CapabilityBoundingSet = mkDefault [ "" ]; + serviceConfig.DeviceAllow = [ "" ]; + serviceConfig.LockPersonality = true; + serviceConfig.MemoryDenyWriteExecute = true; + serviceConfig.NoNewPrivileges = true; + serviceConfig.PrivateDevices = mkDefault true; + serviceConfig.ProtectClock = mkDefault true; + serviceConfig.ProtectControlGroups = true; + serviceConfig.ProtectHome = true; + serviceConfig.ProtectHostname = true; + serviceConfig.ProtectKernelLogs = true; + serviceConfig.ProtectKernelModules = true; + serviceConfig.ProtectKernelTunables = true; + serviceConfig.ProtectSystem = mkDefault "strict"; + serviceConfig.RemoveIPC = true; + serviceConfig.RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + serviceConfig.RestrictNamespaces = true; + serviceConfig.RestrictRealtime = true; + serviceConfig.RestrictSUIDSGID = true; + serviceConfig.SystemCallArchitectures = "native"; + serviceConfig.UMask = "0077"; + } serviceOpts ]); + }; + format = pkgs.formats.toml { }; +in { + options.services.prometheus.exporters.ping = mkExporterOpts { name = "ping"; port = 9390; } // { + config = mkOption { + type = format.type; + default = { }; + description = "Exporter config"; + }; + }; + config = mkExporterConf { + name = "ping"; + conf = cfg; + serviceOpts = { + serviceConfig = rec { + # netns switching + AmbientCapabilities = [ + # set network namespace + "CAP_SYS_ADMIN" + # open icmp socket + "CAP_NET_RAW" + ]; + CapabilityBoundingSet = AmbientCapabilities; + RestrictNamespaces = lib.mkForce false; + ExecStart = '' + ${pkgs.ping-exporter}/bin/ping-exporter \ + --listen ${cfg.listenAddress}:${toString cfg.port} \ + --config ${format.generate "ping-exporter-config.toml" cfg.config} \ + ${lib.escapeShellArgs cfg.extraFlags} + ''; + }; + }; + }; +}