journald-{remote,upload}: init

base/default.nix

@@ -20,6 +20,7 @@
     ./services/dbus.nix
     ./services/fwupd.nix
     ./services/irqbalance.nix
+    ./services/journald-upload.nix
     ./services/logrotate.nix
     ./services/nginx.nix
     ./services/openssh.nix

base/services/journald-upload.nix

@@ -0,0 +1,25 @@
+{ config, lib, values, ... }:
+let
+  cfg = config.services.journald.upload;
+in
+{
+  services.journald.upload = {
+    enable = lib.mkDefault true;
+    settings.Upload = {
+      URL = "https://journald.pvv.ntnu.no:${toString config.services.journald.remote.port}";
+      ServerKeyFile = "-";
+      ServerCertificateFile = "-";
+      TrustedCertificateFile = "-";
+    };
+  };
+
+  systemd.services."systemd-journal-upload".serviceConfig = lib.mkIf cfg.enable {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      "127.0.0.1"
+      "::1"
+      values.ipv4-space
+      values.ipv6-space
+    ];
+  };
+}

hosts/ildkule/configuration.nix

@@ -7,6 +7,7 @@
 
       ./services/monitoring
       ./services/nginx
+      ./services/journald-remote.nix
     ];
 
   sops.defaultSopsFile = fp /secrets/ildkule/ildkule.yaml;

hosts/ildkule/services/journald-remote.nix

@@ -0,0 +1,52 @@
+{ config, lib, values, ... }:
+let
+  cfg = config.services.journald.remote;
+  domainName = "journald.pvv.ntnu.no";
+in
+{
+  security.acme.certs.${domainName} = {
+    webroot = "/var/lib/acme/acme-challenge/";
+    group = config.services.nginx.group;
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts.${domainName} = {
+      forceSSL = true;
+      useACMEHost = "${domainName}";
+      locations."/.well-known/".root = "/var/lib/acme/acme-challenge/";
+    };
+  };
+
+  services.journald.upload.enable = lib.mkForce false;
+
+  services.journald.remote = {
+    enable = true;
+    settings.Remote = let
+      inherit (config.security.acme.certs.${domainName}) directory;
+    in {
+      ServerKeyFile = "/run/credentials/systemd-journal-remote.service/key.pem";
+      ServerCertificateFile = "/run/credentials/systemd-journal-remote.service/cert.pem";
+      TrustedCertificateFile = "-";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+  systemd.sockets."systemd-journal-remote".socketConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      "127.0.0.1"
+      "::1"
+      values.ipv4-space
+      values.ipv6-space
+    ];
+
+    LoadCredential = let
+      inherit (config.security.acme.certs.${domainName}) directory;
+    in [
+      "key.pem:${directory}/key.pem"
+      "cert.pem:${directory}/cert.pem"
+    ];
+  };
+}