felixalb/nixos-config
felixalb
/
nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

metrics: fix iptables rules

This commit is contained in:
Felix Albrigtsen 2023-12-26 12:21:30 +01:00
parent 8f4dfe7251
commit 6f0c449648
2 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
common/metrics-exporters.nix
View File

@ -7,13 +7,13 @@
enabledCollectors = [ "systemd" ]; enabledCollectors = [ "systemd" ];
}; };
systemd.services.prometheus-node-exporter.serviceConfig = { networking.firewall = {
# TODO: Define allowed IPs # TODO: Move this into the node-exporter systemd service
# IPAddressDeny = "any"; allowedTCPPorts = [ 9100 ];
# IPAddressAllow = [ extraCommands = ''
# values.chapel.ipv4 iptables -A INPUT -p tcp -m tcp --source 192.168.10.175/32 --dport 9100 -j ACCEPT
# values.chapel.ipv6 iptables -A INPUT -p tcp -m tcp --dport 9100 -j DROP
# ]; '';
}; };
services.promtail = { services.promtail = {

12
hosts/voyager/filesystems.nix
View File

@ -13,8 +13,16 @@
services.zfs.autoScrub.enable = true; services.zfs.autoScrub.enable = true;
services.prometheus.exporters.zfs = { services.prometheus.exporters.zfs = {
enable = true; enable = true;
openFirewall = true; # "ip46" is cursed, do it manually below
firewallFilter = "-p tcp -m tcp -s 192.168.10.175 --dport 9134"; # Only allow defiant # openFirewall = true;
# firewallFilter = "-p tcp -m tcp --source 192.168.10.175/32 --dport 9134";
};
networking.firewall = {
allowedTCPPorts = [ 9134 ];
extraCommands = ''
iptables -A INPUT -p tcp -m tcp --source 192.168.10.175/32 --dport 9134 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 9134 -j DROP
'';
}; };
# Network mounts (import) # Network mounts (import)