diff options
Diffstat (limited to 'nixos/modules/services/monitoring')
| -rw-r--r-- | nixos/modules/services/monitoring/certspotter.md | 48 | ||||
| -rw-r--r-- | nixos/modules/services/monitoring/goss.md | 2 | ||||
| -rw-r--r-- | nixos/modules/services/monitoring/parsedmarc.md | 124 | ||||
| -rw-r--r-- | nixos/modules/services/monitoring/prometheus/exporters.md | 14 |
4 files changed, 101 insertions, 87 deletions
diff --git a/nixos/modules/services/monitoring/certspotter.md b/nixos/modules/services/monitoring/certspotter.md index 9bf6e1d946a0..e999bfe65ec3 100644 --- a/nixos/modules/services/monitoring/certspotter.md +++ b/nixos/modules/services/monitoring/certspotter.md @@ -9,17 +9,19 @@ A basic config that notifies you of all certificate changes for your domain would look as follows: ```nix -services.certspotter = { - enable = true; - # replace example.org with your domain name - watchlist = [ ".example.org" ]; - emailRecipients = [ "webmaster@example.org" ]; -}; +{ + services.certspotter = { + enable = true; + # replace example.org with your domain name + watchlist = [ ".example.org" ]; + emailRecipients = [ "webmaster@example.org" ]; + }; -# Configure an SMTP client -programs.msmtp.enable = true; -# Or you can use any other module that provides sendmail, like -# services.nullmailer, services.opensmtpd, services.postfix + # Configure an SMTP client + programs.msmtp.enable = true; + # Or you can use any other module that provides sendmail, like + # services.nullmailer, services.opensmtpd, services.postfix +} ``` In this case, the leading dot in `".example.org"` means that Cert @@ -59,16 +61,18 @@ For example, you can remove `emailRecipients` and send email notifications manually using the following hook: ```nix -services.certspotter.hooks = [ - (pkgs.writeShellScript "certspotter-hook" '' - function print_email() { - echo "Subject: [certspotter] $SUMMARY" - echo "Mime-Version: 1.0" - echo "Content-Type: text/plain; charset=US-ASCII" - echo - cat "$TEXT_FILENAME" - } - print_email | ${config.services.certspotter.sendmailPath} -i webmaster@example.org - '') -]; +{ + services.certspotter.hooks = [ + (pkgs.writeShellScript "certspotter-hook" '' + function print_email() { + echo "Subject: [certspotter] $SUMMARY" + echo "Mime-Version: 1.0" + echo "Content-Type: text/plain; charset=US-ASCII" + echo + cat "$TEXT_FILENAME" + } + print_email | ${config.services.certspotter.sendmailPath} -i webmaster@example.org + '') + ]; +} ``` diff --git a/nixos/modules/services/monitoring/goss.md b/nixos/modules/services/monitoring/goss.md index 1e636aa3bdf3..bf91d42011fa 100644 --- a/nixos/modules/services/monitoring/goss.md +++ b/nixos/modules/services/monitoring/goss.md @@ -7,7 +7,7 @@ for validating a server's configuration. A minimal configuration looks like this: -``` +```nix { services.goss = { enable = true; diff --git a/nixos/modules/services/monitoring/parsedmarc.md b/nixos/modules/services/monitoring/parsedmarc.md index eac07e0cc9fe..765846bbbaf3 100644 --- a/nixos/modules/services/monitoring/parsedmarc.md +++ b/nixos/modules/services/monitoring/parsedmarc.md @@ -11,15 +11,17 @@ email address and saves them to a local Elasticsearch instance looks like this: ```nix -services.parsedmarc = { - enable = true; - settings.imap = { - host = "imap.example.com"; - user = "alice@example.com"; - password = "/path/to/imap_password_file"; +{ + services.parsedmarc = { + enable = true; + settings.imap = { + host = "imap.example.com"; + user = "alice@example.com"; + password = "/path/to/imap_password_file"; + }; + provision.geoIp = false; # Not recommended! }; - provision.geoIp = false; # Not recommended! -}; +} ``` Note that GeoIP provisioning is disabled in the example for @@ -37,16 +39,18 @@ configured in the domain's dmarc policy is `dmarc@monitoring.example.com`. ```nix -services.parsedmarc = { - enable = true; - provision = { - localMail = { - enable = true; - hostname = monitoring.example.com; +{ + services.parsedmarc = { + enable = true; + provision = { + localMail = { + enable = true; + hostname = monitoring.example.com; + }; + geoIp = false; # Not recommended! }; - geoIp = false; # Not recommended! }; -}; +} ``` ## Grafana and GeoIP {#module-services-parsedmarc-grafana-geoip} @@ -58,55 +62,57 @@ is automatically added as a Grafana datasource, and the dashboard is added to Grafana as well. ```nix -services.parsedmarc = { - enable = true; - provision = { - localMail = { - enable = true; - hostname = url; - }; - grafana = { - datasource = true; - dashboard = true; +{ + services.parsedmarc = { + enable = true; + provision = { + localMail = { + enable = true; + hostname = url; + }; + grafana = { + datasource = true; + dashboard = true; + }; }; }; -}; -# Not required, but recommended for full functionality -services.geoipupdate = { - settings = { - AccountID = 000000; - LicenseKey = "/path/to/license_key_file"; + # Not required, but recommended for full functionality + services.geoipupdate = { + settings = { + AccountID = 000000; + LicenseKey = "/path/to/license_key_file"; + }; }; -}; -services.grafana = { - enable = true; - addr = "0.0.0.0"; - domain = url; - rootUrl = "https://" + url; - protocol = "socket"; - security = { - adminUser = "admin"; - adminPasswordFile = "/path/to/admin_password_file"; - secretKeyFile = "/path/to/secret_key_file"; + services.grafana = { + enable = true; + addr = "0.0.0.0"; + domain = url; + rootUrl = "https://" + url; + protocol = "socket"; + security = { + adminUser = "admin"; + adminPasswordFile = "/path/to/admin_password_file"; + secretKeyFile = "/path/to/secret_key_file"; + }; }; -}; -services.nginx = { - enable = true; - recommendedTlsSettings = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - recommendedProxySettings = true; - upstreams.grafana.servers."unix:/${config.services.grafana.socket}" = {}; - virtualHosts.${url} = { - root = config.services.grafana.staticRootPath; - enableACME = true; - forceSSL = true; - locations."/".tryFiles = "$uri @grafana"; - locations."@grafana".proxyPass = "http://grafana"; + services.nginx = { + enable = true; + recommendedTlsSettings = true; + recommendedOptimisation = true; + recommendedGzipSettings = true; + recommendedProxySettings = true; + upstreams.grafana.servers."unix:/${config.services.grafana.socket}" = {}; + virtualHosts.${url} = { + root = config.services.grafana.staticRootPath; + enableACME = true; + forceSSL = true; + locations."/".tryFiles = "$uri @grafana"; + locations."@grafana".proxyPass = "http://grafana"; + }; }; -}; -users.users.nginx.extraGroups = [ "grafana" ]; + users.users.nginx.extraGroups = [ "grafana" ]; +} ``` diff --git a/nixos/modules/services/monitoring/prometheus/exporters.md b/nixos/modules/services/monitoring/prometheus/exporters.md index 34fadecadc74..b344534f6aee 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.md +++ b/nixos/modules/services/monitoring/prometheus/exporters.md @@ -9,7 +9,8 @@ One of the most common exporters is the [node exporter](https://github.com/prometheus/node_exporter), it provides hardware and OS metrics from the host it's running on. The exporter could be configured as follows: -``` +```nix +{ services.prometheus.exporters.node = { enable = true; port = 9100; @@ -23,6 +24,7 @@ running on. The exporter could be configured as follows: openFirewall = true; firewallFilter = "-i br0 -p tcp -m tcp --dport 9100"; }; +} ``` It should now serve all metrics from the collectors that are explicitly enabled and the ones that are @@ -35,7 +37,8 @@ configuration see `man configuration.nix` or search through the [available options](https://nixos.org/nixos/options.html#prometheus.exporters). Prometheus can now be configured to consume the metrics produced by the exporter: -``` +```nix +{ services.prometheus = { # ... @@ -49,7 +52,8 @@ Prometheus can now be configured to consume the metrics produced by the exporter ]; # ... - } + }; +} ``` ## Adding a new exporter {#module-services-prometheus-exporters-new-exporter} @@ -75,7 +79,7 @@ example: `nixos/modules/services/monitoring/prometheus/exporters/` directory, which will be called postfix.nix and contains all exporter specific options and configuration: - ``` + ```nix # nixpkgs/nixos/modules/services/prometheus/exporters/postfix.nix { config, lib, pkgs, options }: @@ -148,7 +152,7 @@ example: Should an exporter option change at some point, it is possible to add information about the change to the exporter definition similar to `nixpkgs/nixos/modules/rename.nix`: -``` +```nix { config, lib, pkgs, options }: with lib; |