goaccess: Add goaccess.nix module
All checks were successful
checks / test (pull_request) Successful in 26s

This commit is contained in:
Luis Hebendanz 2024-04-13 15:38:30 +02:00
parent 05fd484279
commit cf36395017
2 changed files with 26 additions and 17 deletions

View File

@ -1,5 +1,13 @@
{ pkgs, lib, publog, self, ... }: { config, pkgs, lib, publog, self, ... }:
let
# make the logs for this host "public" so that they show up in e.g. metrics
publog = vhost: lib.attrsets.unionOfDisjoint vhost {
extraConfig = (vhost.extraConfig or "") + ''
access_log /var/log/nginx/public.log vcombined;
'';
};
in
{ {
imports = [ imports = [
@ -37,7 +45,7 @@
settings.session.COOKIE_SECURE = true; settings.session.COOKIE_SECURE = true;
}; };
services.nginx.virtualHosts."git.clan.lol" = publog.publog { services.nginx.virtualHosts."git.clan.lol" = publog {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
# The add_header directive is used to set the Content-Security-Policy header to allow embedding the Gitea instance in an iframe on the pad.lassul.us instance. # The add_header directive is used to set the Content-Security-Policy header to allow embedding the Gitea instance in an iframe on the pad.lassul.us instance.

View File

@ -1,15 +1,16 @@
{ stdenv, lib, pkgs, ... }: { stdenv, lib, pkgs, ... }:
let let
# make the logs for this host "public" so that they show up in e.g. metrics domain = "metrics.gchq.icu";
publog = vhost: lib.attrsets.unionOfDisjoint vhost {
extraConfig = (vhost.extraConfig or "") + ''
access_log /var/log/nginx/public.log vcombined;
'';
};
in in
{ {
users.users.goaccess = {
publog.publog = publog; isSystemUser = true;
group = "nginx";
createHome = true;
home = "/var/www/goaccess";
homeMode = "0774";
};
services.nginx.commonHttpConfig = '' services.nginx.commonHttpConfig = ''
log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referrer" "$http_user_agent"'; log_format vcombined '$host:$server_port $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referrer" "$http_user_agent"';
@ -19,6 +20,8 @@ in
systemd.services.goaccess = { systemd.services.goaccess = {
description = "GoAccess server monitoring"; description = "GoAccess server monitoring";
serviceConfig = { serviceConfig = {
User = "goaccess";
Group = "nginx";
ExecStart = '' ExecStart = ''
${pkgs.goaccess}/bin/goaccess \ ${pkgs.goaccess}/bin/goaccess \
-f /var/log/nginx/public.log \ -f /var/log/nginx/public.log \
@ -28,9 +31,9 @@ in
--no-query-string \ --no-query-string \
--anonymize-ip \ --anonymize-ip \
--ignore-panel=HOSTS \ --ignore-panel=HOSTS \
--ws-url=wss://metrics.clan.lol:443/ws \ --ws-url=wss://${domain}:443/ws \
--port=7890 \ --port=7890 \
-o /var/www/goaccess/index.html -o index.html
''; '';
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID"; ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Type = "simple"; Type = "simple";
@ -38,7 +41,7 @@ in
RestartSec = "10s"; RestartSec = "10s";
# hardening # hardening
WorkingDirectory = "/tmp"; WorkingDirectory = "/var/www/goaccess";
NoNewPrivileges = true; NoNewPrivileges = true;
PrivateTmp = true; PrivateTmp = true;
ProtectHome = "read-only"; ProtectHome = "read-only";
@ -54,16 +57,14 @@ in
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
}; };
# server statistics
services.nginx.virtualHosts."metrics.clan.lol" = { services.nginx.virtualHosts."${domain}" = {
addSSL = true; addSSL = true;
enableACME = true; enableACME = true;
# inherit kTLS;
root = "/var/www/goaccess"; root = "/var/www/goaccess";
locations."/ws" = { locations."/ws" = {
proxyPass = "http://127.0.0.1:7890"; proxyPass = "http://127.0.0.1:7890";
# XXX not sure how much of this is necessary
extraConfig = '' extraConfig = ''
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;