felixalb/pvv-nixos-config
1
0
Fork 0
mirror of https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git synced 2026-01-19 17:39:15 +01:00
Code Issues Projects Releases Wiki Activity

journald-{remote,upload}: init

Browse Source
This commit is contained in:
h7x4
2026-01-15 15:39:20 +09:00
parent 5d0b2c6e0a
commit 024dae4226
4 changed files with 79 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
base/default.nix
View File

@@ -20,6 +20,7 @@
./services/dbus.nix ./services/dbus.nix
./services/fwupd.nix ./services/fwupd.nix
./services/irqbalance.nix ./services/irqbalance.nix
./services/journald-upload.nix
./services/logrotate.nix ./services/logrotate.nix
./services/nginx.nix ./services/nginx.nix
./services/openssh.nix ./services/openssh.nix

25
base/services/journald-upload.nix Normal file
View File

@@ -0,0 +1,25 @@
{ config, lib, values, ... }:
let
cfg = config.services.journald.upload;
in
{
services.journald.upload = {
enable = lib.mkDefault true;
settings.Upload = {
URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
ServerKeyFile = "-";
ServerCertificateFile = "-";
TrustedCertificateFile = "-";
};
};
systemd.services."systemd-journal-upload".serviceConfig = lib.mkIf cfg.enable {
IPAddressDeny = "any";
IPAddressAllow = [
"127.0.0.1"
"::1"
values.ipv4-space
values.ipv6-space
];
};
}

1
hosts/ildkule/configuration.nix
View File

@@ -7,6 +7,7 @@
./services/monitoring ./services/monitoring
./services/nginx ./services/nginx
./services/journald-remote.nix
]; ];
sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml; sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;

52
hosts/ildkule/services/journald-remote.nix Normal file
View File

@@ -0,0 +1,52 @@
{ config, lib, values, ... }:
let
cfg = config.services.journald.remote;
domainName = "journald.pvv.ntnu.no";
in
{
security.acme.certs.${domainName} = {
webroot = "/var/lib/acme/acme-challenge/";
group = config.services.nginx.group;
};
services.nginx = {
enable = true;
virtualHosts.${domainName} = {
forceSSL = true;
useACMEHost = "${domainName}";
locations."/.well-known/".root = "/var/lib/acme/acme-challenge/";
};
};
services.journald.upload.enable = lib.mkForce false;
services.journald.remote = {
enable = true;
settings.Remote = let
inherit (config.security.acme.certs.${domainName}) directory;
in {
ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
TrustedCertificateFile = "-";
};
};
networking.firewall.allowedTCPPorts = [ cfg.port ];
systemd.sockets."systemd-journal-remote".socketConfig = {
IPAddressDeny = "any";
IPAddressAllow = [
"127.0.0.1"
"::1"
values.ipv4-space
values.ipv6-space
];
LoadCredential = let
inherit (config.security.acme.certs.${domainName}) directory;
in [
"key.pem:${directory}/key.pem"
"cert.pem:${directory}/cert.pem"
];
};
}