ildkule/gatus/minecraft-checker: init

hosts/ildkule/services/monitoring/default.nix

@@ -2,10 +2,10 @@
 
 {
   imports = [
+    ./gatus
     ./grafana.nix
     ./loki.nix
     ./prometheus
     ./scrutiny.nix
-    ./uptime-kuma.nix
   ];
 }

hosts/ildkule/services/monitoring/gatus/default.nix

@@ -0,0 +1,153 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.gatus;
+in
+{
+  imports = [
+    ./minecraft-checker.nix
+  ];
+
+  services.gatus = {
+    enable = true;
+
+    settings = {
+      web = {
+        address = "127.0.0.1";
+        port = 19283;
+      };
+
+      storage = {
+        type = "sqlite";
+        path = "/var/lib/gatus/data.db";
+      };
+
+      ui = {
+        title = "PVV Nede!?";
+        header = "😭😭😭";
+        dashboard-heading = "PVV Nede!?";
+        dashboard-subheading = "Kan noen ringe drift?";
+      };
+
+      endpoints = let
+        mkMachine = name: {
+          inherit name;
+          group = "Machines";
+          url = "icmp://${name}.pvv.ntnu.no";
+          conditions = [
+            "[CONNECTED] == true"
+          ];
+        };
+
+        mkWebsite = name: url: {
+          inherit name url;
+          group = "Websites";
+          method = "GET";
+          conditions = [
+            "[STATUS] == 200"
+          ];
+        };
+
+        mkService = name: url: {
+          inherit name url;
+          group = "Services";
+          conditions = [
+            "[CONNECTED] == true"
+          ];
+        };
+      in (lib.sortOn (m: m.name) [
+        (mkMachine "bekkalokk")
+        (mkMachine "bicep")
+        (mkMachine "bikkje")
+        (mkMachine "brzeczyszczykiewicz")
+        (mkMachine "georg")
+        (mkMachine "gluttony")
+        (mkMachine "ildkule")
+        (mkMachine "kommode")
+        (mkMachine "lupine-1")
+        (mkMachine "lupine-2")
+        (mkMachine "lupine-3")
+        (mkMachine "lupine-4")
+        (mkMachine "lupine-5")
+        (mkMachine "skrot")
+        (mkMachine "temmie")
+        (mkMachine "wenche")
+
+        (mkMachine "balduzius")
+        (mkMachine "blossom")
+        (mkMachine "bubbles")
+        (mkMachine "buskerud")
+        (mkMachine "buttercup")
+        (mkMachine "demiurgen")
+        (mkMachine "drolsum")
+        (mkMachine "hildring")
+        (mkMachine "innovation")
+        (mkMachine "isvegg")
+        (mkMachine "knutsen")
+        (mkMachine "ludvigsen" // {
+          url = "icmp://ludvigsen-tap.pvv.ntnu.no";
+        })
+        (mkMachine "microbel")
+        (mkMachine "mirage")
+        (mkMachine "orchid")
+        (mkMachine "principal")
+        (mkMachine "sleipner")
+        (mkMachine "smask")
+        (mkMachine "tom")
+        (mkMachine "wegonke")
+      ]) ++ [
+        (mkWebsite "Bluemap" "https://minecraft.pvv.ntnu.no")
+        (mkWebsite "Element Web" "https://chat.pvv.ntnu.no")
+        (mkWebsite "Gitea" "https://git.pvv.ntnu.no/api/healthz" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].status == pass"
+          ];
+        })
+        (mkWebsite "Grafana" "https://grafana.pvv.ntnu.no/api/health" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].database == ok"
+          ];
+        })
+        (mkWebsite "Grzegorz - Brzeczyszczykiewicz" "https://brzeczyszczykiewicz.pvv.ntnu.no")
+        (mkWebsite "Grzegorz - Georg" "https://georg.pvv.ntnu.no")
+        (mkWebsite "IDP" "https://idp.pvv.ntnu.no")
+        (mkWebsite "Mailing Lists" "http://list.pvv.ntnu.no")
+        (mkWebsite "Mapcrafter" "http://isvegg.pvv.ntnu.no/kart")
+        (mkWebsite "PVV-Nettsiden" "https://www.pvv.ntnu.no")
+        (mkWebsite "Roundcube" "https://webmail.pvv.ntnu.no/roundcube")
+        (mkWebsite "Scrutiny" "https://scrutiny.pvv.ntnu.no")
+        (mkWebsite "Snappymail" "http://snappymail.pvv.ntnu.no")
+        (mkWebsite "Userweb - Temmie" "https://temmie.pvv.ntnu.no/~oysteikt")
+        (mkWebsite "Userweb - Tom" "https://www.pvv.ntnu.no/~oysteikt")
+        (mkWebsite "Vaultwarden" "https://pw.pvv.ntnu.no/alive")
+        (mkWebsite "Wiki" "https://wiki.pvv.ntnu.no/w/api.php?action=query&format=json")
+
+        (mkService "Gitea SSH" "ssh://git.pvv.ntnu.no:2222")
+        (mkService "QoTD" "tcp://bekkalokk.pvv.ntnu.no:17")
+        (mkService "Minecraft" "http://localhost:25565" // {
+          conditions = [
+            "[STATUS] == 200"
+            "[BODY].ok == true"
+          ];
+        })
+        (mkService "Email (SMTP)" "tcp://mail.pvv.ntnu.no:587")
+        (mkService "Email (POP3)" "tcp://mail.pvv.ntnu.no:995")
+        (mkService "Email (IMAP)" "tcp://mail.pvv.ntnu.no:993")
+        (mkService "Matrix Synapse" "https://matrix.pvv.ntnu.no/_matrix/client/versions" // {
+          method = "GET";
+          conditions = [
+            "[STATUS] == 200"
+          ];
+        })
+      ];
+    };
+  };
+
+  services.nginx.virtualHosts."status.pvv.ntnu.no" = lib.mkIf cfg.enable {
+    enableACME = true;
+    forceSSL = true;
+    kTLS = true;
+    locations."/".proxyPass = "http://localhost:${toString cfg.settings.web.port}";
+  };
+}

hosts/ildkule/services/monitoring/gatus/minecraft-checker.nix

@@ -0,0 +1,79 @@
+{ lib, pkgs, ... }:
+{
+  systemd.sockets."gatus-minecraft-checker" = {
+    wantedBy = [ "sockets.target" ];
+    listenStreams = [ "25565" ];
+    socketConfig = {
+      SocketMode = "0666";
+      Accept = false;
+    };
+  };
+
+  systemd.services."gatus-minecraft-checker" = {
+    serviceConfig = {
+      ExecStart = lib.getExe (pkgs.writers.writePython3Bin "gatus-minecraft-checker" {
+        libraries = with pkgs.python3Packages; [
+          # sdnotify
+          mcstatus
+        ];
+        flakeIgnore = [ "E501" "E704" ];
+      } ''
+        import socket
+        import json
+        from http.server import HTTPServer, BaseHTTPRequestHandler
+
+        from mcstatus import JavaServer
+
+
+        class Handler(BaseHTTPRequestHandler):
+            def do_GET(self):
+                try:
+                    mcserver = JavaServer.lookup("minecraft.pvv.ntnu.no")
+                    status = mcserver.status()
+
+                    body = {
+                        "ok": True,
+                        "players": status.players.online,
+                        "version": status.version.name,
+                        "latency": status.latency,
+                    }
+
+                    data = json.dumps(body).encode()
+
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.send_header("Content-Length", str(len(data)))
+                    self.end_headers()
+                    self.wfile.write(data)
+
+                except Exception as e:
+                    data = json.dumps({"ok": False, "error": str(e)}).encode()
+                    self.send_response(500)
+                    self.end_headers()
+                    self.wfile.write(data)
+
+
+        class NoBindHTTPServer(HTTPServer):
+            def server_bind(): pass
+            def server_activate(): pass
+
+
+        def main():
+            httpd = NoBindHTTPServer(
+                ("", 0),
+                Handler,
+                bind_and_activate=False,
+            )
+            httpd.socket = socket.fromfd(3, socket.AF_INET, socket.SOCK_STREAM)
+            httpd.serve_forever()
+
+
+        if __name__ == '__main__':
+            main()
+      '');
+
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+    };
+  };
+}

hosts/ildkule/services/monitoring/uptime-kuma.nix

@@ -1,44 +0,0 @@
-{ config, pkgs, lib, values, ... }:
-let
-  cfg = config.services.uptime-kuma;
-  domain = "status.pvv.ntnu.no";
-  stateDir = "/data/monitoring/uptime-kuma";
-in {
-  services.uptime-kuma = {
-    enable = true;
-    settings = {
-      PORT = "5059";
-      HOST = "127.0.1.2";
-    };
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    enableACME = true;
-    forceSSL = true;
-    kTLS = true;
-    locations."/".proxyPass = "http://${cfg.settings.HOST}:${cfg.settings.PORT}";
-  };
-
-  fileSystems."/var/lib/private/uptime-kuma" = {
-    device = stateDir;
-    fsType = "bind";
-    options = [ "bind" ];
-  };
-
-  services.rsync-pull-targets = {
-    enable = true;
-    locations.${stateDir} = {
-      user = "root";
-      rrsyncArgs.ro = true;
-      authorizedKeysAttrs = [
-        "restrict"
-        "from=\"principal.pvv.ntnu.no,${values.hosts.principal.ipv6},${values.hosts.principal.ipv4}\""
-        "no-agent-forwarding"
-        "no-port-forwarding"
-        "no-pty"
-        "no-X11-forwarding"
-      ];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXzcDm6cVr4NmWzUSroy33FlielKqaG83wY0RCMC0p/ uptime_kuma rsync backup";
-    };
-  };
-}

hosts/lupine/configuration.nix

@@ -48,7 +48,11 @@
       networks."20-br0" = {
         matchConfig.Name = "br0";
 
-        address = with values.hosts.${lupineName}; [ (ipv4 + "/25") (ipv6 + "/64") ];
+        address = with values.hosts.${lupineName}; [
+          (ipv4 + "/25")
+          (ipv6 + "/64")
+          values.services.knutsen-vpn
+        ];
         networkConfig.LLDP = false;
 
         dns = ["129.241.0.200" "129.241.0.201" "2001:700:300:1900::200" "2001:700:300:1900::201"];

hosts/lupine/services/openvpn.nix

@@ -1,4 +1,4 @@
-{ pkgs, lib, values, ... }:
+{ config, pkgs, lib, values, ... }:
 let
   renderConfig = attrs: lib.pipe attrs [
     (lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
@@ -20,10 +20,18 @@ let
   ];
 in
 {
+  sops.secrets = {
+    "openvpn/ca/crt" = { };
+    "openvpn/server/crt" = { };
+    "openvpn/server/key" = { };
+  };
+
   services.openvpn.servers."ov-tunnel" = {
     config = renderConfig {
+      mode = "server";
+
       # TODO: use aliases
-      local = values.services.knutsen-vpn;
+      local = "0.0.0.0";
       port = 1194;
       proto = "udp";
 
@@ -32,11 +40,10 @@ in
 
       script-security = 0;
 
-      # TODO: set up
+      ca = config.sops.secrets."openvpn/ca/crt".path;
-      # ca = "";
+      cert = config.sops.secrets."openvpn/server/crt".path;
-      # cert = "";
+      key = config.sops.secrets."openvpn/server/key".path;
-      # key = "";
+      dh = "none";
-      # dh = "";
 
       # Maintain a record of client <-> virtual IP address
       # associations in this file.  If OpenVPN goes down or
@@ -58,7 +65,6 @@ in
       ];
 
       keepalive = "10 120";
-      data-ciphers = "none";
 
       user = "nobody";
       group = "nobody";
@@ -67,7 +73,7 @@ in
 
       client-config-dir = pkgs.writeTextDir "ludvigsen" ''
         # Sett IP-adr. for tap0 til ludvigsens PVV-addresse.
-        ifconfig-push ${values.services.ludvigsen-vpn} 255.255.255.128
+        ifconfig-push ${values.services.ludvigsen-tap} 255.255.255.128
 
         # Hvordan skal man faa dette til aa funke, tro?
         # ifconfig-ipv6-push 2001:700:300:1900::xxx/64
@@ -79,9 +85,17 @@ in
       persist-key = true;
       persist-tun = true;
 
+      tls-version-min = "1.2";
+      tls-version-max = "1.2";
+
       verb = 5;
 
       explicit-exit-notify = 1;
     };
   };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 1194 ];
+    allowedUDPPorts = [ 1194 ];
+  };
 }