2022-08-13

12 files changed, 59 insertions, 90 deletions

diff --git a/modules/nixfiles/alertmanager.nix b/modules/nixfiles/alertmanager.nix
index e067cd1..d903ee3 100644
--- a/modules/nixfiles/alertmanager.nix
+++ b/modules/nixfiles/alertmanager.nix
@@ -18,21 +18,15 @@ in {
     domain = mkOption {
       description = "Domain name sans protocol scheme.";
       type = with types; nullOr str;
-      default = config.nixfiles.modules.monitoring.domain;
-    };
-
-    path = mkOption {
-      description = "Path.";
-      type = with types; str;
-      default = "/alertmanager";
+      default = "alertmanager.${config.networking.domain}";
     };
   };
 
   config = mkIf cfg.enable {
     nixfiles.modules.nginx = with cfg; {
       enable = true;
-      virtualHosts.${cfg.domain}.locations.${path} = {
-        proxyPass = "http://127.0.0.1:${toString port}${path}";
+      virtualHosts.${cfg.domain}.locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString port}";
         extraConfig = ''
           if ($internal != 1) {
             return 403;
@@ -50,13 +44,8 @@ in {
         listenAddress = "127.0.0.1";
         inherit (cfg) port;
 
-        extraFlags = [
-          "--web.external-url=http${
-            optionalString acme "s"
-          }://${cfg.domain}${cfg.path}"
-        ];
+        extraFlags = ["--web.external-url=https://${cfg.domain}"];
 
-        # TODO Make an option.
         configuration = {
           global = {
             smtp_from = "alertmanager@${my.domain.shire}";
diff --git a/modules/nixfiles/common/users.nix b/modules/nixfiles/common/users.nix
index 0878db6..c761f55 100644
--- a/modules/nixfiles/common/users.nix
+++ b/modules/nixfiles/common/users.nix
@@ -6,12 +6,16 @@ with lib; {
     mutableUsers = false;
 
     users = {
+      # This will unset the root password so that it would be impossible to
+      # login as it directory. The root user will still be accessable via
+      # `sudo`.
       root.hashedPassword = "[REDACTED]";
 
       ${my.username} = {
         isNormalUser = true;
         uid = 1000;
         description = my.fullname;
+        # TODO Consider switching to passwordFile
         inherit (my) hashedPassword;
         openssh.authorizedKeys.keys = [my.ssh.key];
         extraGroups = ["wheel"];
diff --git a/modules/nixfiles/grafana.nix b/modules/nixfiles/grafana.nix
index 4340f04..c2954bd 100644
--- a/modules/nixfiles/grafana.nix
+++ b/modules/nixfiles/grafana.nix
@@ -19,7 +19,7 @@ in {
     domain = mkOption {
       description = "Domain name sans protocol scheme.";
       type = with types; nullOr str;
-      default = null;
+      default = "grafana.${config.networking.domain}";
     };
   };
 
@@ -40,7 +40,10 @@ in {
     nixfiles.modules = {
       nginx = {
         enable = true;
-        virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}";
+        virtualHosts.${cfg.domain}.locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString cfg.port}";
+          proxyWebsockets = true;
+        };
       };
       postgresql.enable = true;
     };
@@ -68,6 +71,8 @@ in {
           secretKeyFile = grafana-key.path;
           adminPasswordFile = grafana-admin-password.path;
         };
+
+        extraOptions.LOG_LEVEL = "warn";
       };
 
       postgresql = {
diff --git a/modules/nixfiles/loki.nix b/modules/nixfiles/loki.nix
index 27217bd..c1dc136 100644
--- a/modules/nixfiles/loki.nix
+++ b/modules/nixfiles/loki.nix
@@ -8,7 +8,6 @@ with lib; let
   cfg = config.nixfiles.modules.loki;
 in {
   options.nixfiles.modules.loki = {
-    # TODO Figure out why this shit refuses to work with my configuraiton.
     enable = mkEnableOption "Whether to enable Loki.";
 
     port = mkOption {
@@ -20,20 +19,14 @@ in {
     domain = mkOption {
       description = "Domain name sans protocol scheme.";
       type = with types; str;
-      default = config.nixfiles.modules.monitoring.domain;
-    };
-
-    path = mkOption {
-      description = "Path.";
-      type = with types; str;
-      default = "/loki";
+      default = "loki.${config.networking.domain}";
     };
   };
 
   config = mkIf cfg.enable {
     nixfiles.modules.nginx = with cfg; {
       enable = true;
-      virtualHosts.${domain}.locations.${path} = {
+      virtualHosts.${domain}.locations."/" = {
         proxyPass = "http://127.0.0.1:${toString port}";
         extraConfig = ''
           if ($internal != 1) {
@@ -52,7 +45,6 @@ in {
         server = rec {
           http_listen_address = "127.0.0.1";
           http_listen_port = cfg.port;
-          http_path_prefix = cfg.path;
 
           grpc_listen_address = "127.0.0.1";
           grpc_listen_port = http_listen_port + 1;
diff --git a/modules/nixfiles/monitoring.nix b/modules/nixfiles/monitoring.nix
index 6db74d4..ceb40d0 100644
--- a/modules/nixfiles/monitoring.nix
+++ b/modules/nixfiles/monitoring.nix
@@ -7,39 +7,19 @@
 with lib; let
   cfg = config.nixfiles.modules.monitoring;
 in {
-  options.nixfiles.modules.monitoring = {
-    enable = mkEnableOption ''
-      Whether to enable custom monitoring stack.
+  options.nixfiles.modules.monitoring.enable = mkEnableOption ''
+    Whether to enable custom monitoring stack.
 
-      Currently this configures and enables Grafana, Loki, Prometheus and
-      Alertmanager.
-    '';
-
-    domain = mkOption {
-      description = "Domain name sans protocol scheme.";
-      type = with types; nullOr str;
-      default = "monitoring.${config.networking.domain}";
-    };
-  };
+    Currently this configures and enables Grafana, Loki, Prometheus and
+    Alertmanager.
+  '';
 
   config = mkIf cfg.enable {
     nixfiles.modules = {
-      grafana = {
-        enable = true;
-        inherit (cfg) domain;
-      };
-      loki = {
-        enable = true;
-        inherit (cfg) domain;
-      };
-      prometheus = {
-        enable = true;
-        inherit (cfg) domain;
-      };
-      alertmanager = {
-        enable = true;
-        inherit (cfg) domain;
-      };
+      grafana.enable = true;
+      loki.enable = true;
+      prometheus.enable = true;
+      alertmanager.enable = true;
     };
 
     services = {
@@ -50,14 +30,14 @@ in {
             name = "Prometheus";
             type = "prometheus";
             access = "proxy";
-            url = with prometheus; "https://${domain}${path}";
+            url = "https://${prometheus.domain}";
             isDefault = true;
           }
           {
             name = "Loki";
             type = "loki";
             access = "proxy";
-            url = with loki; "https://${domain}${path}";
+            url = "https://${loki.domain}";
           }
         ];
         # TODO Move dashboards to this repository.
@@ -100,13 +80,12 @@ in {
         ];
       };
 
-      loki.configuration.ruler.alertmanager_url = with config.nixfiles.modules.alertmanager; "https://${domain}${path}";
+      loki.configuration.ruler.alertmanager_url = "https://${config.nixfiles.modules.alertmanager.domain}";
 
       prometheus.alertmanagers = [
         {
           scheme = "https";
-          path_prefix = config.nixfiles.modules.alertmanager.path;
-          static_configs = [{targets = [cfg.domain];}];
+          static_configs = [{targets = [config.nixfiles.modules.alertmanager.domain];}];
         }
       ];
     };
diff --git a/modules/nixfiles/nsd.nix b/modules/nixfiles/nsd.nix
index f328b5c..c8ed44b 100644
--- a/modules/nixfiles/nsd.nix
+++ b/modules/nixfiles/nsd.nix
@@ -99,9 +99,12 @@ in {
                       ns1 = manwe;
                       # ns2 = varda;
 
+                      alertmanager = manwe;
                       flood = yavanna;
                       gotify = manwe;
-                      monitoring = manwe;
+                      grafana = manwe;
+                      loki = manwe;
+                      prometheus = manwe;
                       radicale = varda;
                       rss-bridge = varda;
                       vaultwarden = varda;
diff --git a/modules/nixfiles/profiles/dev/containers/default.nix b/modules/nixfiles/profiles/dev/containers/default.nix
index d0e7ed7..3196654 100644
--- a/modules/nixfiles/profiles/dev/containers/default.nix
+++ b/modules/nixfiles/profiles/dev/containers/default.nix
@@ -26,6 +26,7 @@ in {
           WERF_LOG_PRETTY = "false";
           WERF_LOG_VERBOSE = "true";
           WERF_SYNCHRONIZATION = ":local";
+          WERF_TELEMETRY = 0;
         };
 
         file.".minikube/config/config.json".text = generators.toJSON {} {
diff --git a/modules/nixfiles/prometheus.nix b/modules/nixfiles/prometheus.nix
index b67dd2e..96e74f7 100644
--- a/modules/nixfiles/prometheus.nix
+++ b/modules/nixfiles/prometheus.nix
@@ -18,20 +18,14 @@ in {
     domain = mkOption {
       description = "Domain name sans protocol scheme.";
       type = with types; str;
-      default = config.nixfiles.modules.monitoring.domain;
-    };
-
-    path = mkOption {
-      description = "Path.";
-      type = with types; str;
-      default = "/prometheus";
+      default = "prometheus.${config.networking.domain}";
     };
   };
 
   config = mkIf cfg.enable {
     nixfiles.modules.nginx = with cfg; {
       enable = true;
-      virtualHosts.${domain}.locations.${path} = {
+      virtualHosts.${domain}.locations."/" = {
         proxyPass = with cfg; "http://127.0.0.1:${toString port}";
         extraConfig = ''
           if ($internal != 1) {
@@ -48,9 +42,7 @@ in {
       inherit port;
 
       extraFlags = [
-        "--web.external-url=http${
-          optionalString config.nixfiles.modules.acme.enable "s"
-        }://${domain}${path}"
+        "--web.external-url=https://${domain}"
         "--storage.tsdb.retention.size=50GB"
         "--storage.tsdb.retention.time=1y"
         "--storage.tsdb.wal-compression"
diff --git a/modules/nixfiles/promtail.nix b/modules/nixfiles/promtail.nix
index ba4e635..e3d7428 100644
--- a/modules/nixfiles/promtail.nix
+++ b/modules/nixfiles/promtail.nix
@@ -14,7 +14,7 @@ in {
       url = mkOption {
         description = "Address of a listening Loki service.";
         type = with types; str;
-        default = with config.nixfiles.modules.loki; "https://${domain}${path}";
+        default = "https://${config.nixfiles.modules.loki.domain}";
       };
     };
   };
diff --git a/modules/nixfiles/radicale.nix b/modules/nixfiles/radicale.nix
index 8286be1..ed1fc4f 100644
--- a/modules/nixfiles/radicale.nix
+++ b/modules/nixfiles/radicale.nix
@@ -29,7 +29,14 @@ in {
 
       nixfiles.modules.nginx = {
         enable = true;
-        virtualHosts.${cfg.domain}.locations."/".proxyPass = "http://127.0.0.1:${toString port}";
+        virtualHosts.${cfg.domain}.locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+          extraConfig = ''
+            if ($internal != 1) {
+              return 403;
+            }
+          '';
+        };
       };
 
       services.radicale = {
diff --git a/modules/nixfiles/syncthing.nix b/modules/nixfiles/syncthing.nix
index 5a973cc..44465d9 100644
--- a/modules/nixfiles/syncthing.nix
+++ b/modules/nixfiles/syncthing.nix
@@ -17,14 +17,14 @@ in {
       default = "syncthing.${config.networking.fqdn}";
     };
 
-    # TODO Make this simpler.
+    # TODO Set this automatically shire on the hostname.
     cert = mkOption {
       description = "Path to the cert file.";
       type = with types; nullOr string;
       default = null;
     };
 
-    # TODO Make this simpler.
+    # TODO Set this automatically shire on the hostname.
     key = mkOption {
       description = "Path to the key file.";
       type = with types; nullOr string;
@@ -84,21 +84,14 @@ in {
           };
           trashcan = {
             type = "trashcan";
-            params.cleanoutDays = "30";
-          };
-          void = {
-            type = "external";
-            params.versionPath = with pkgs;
-              writeShellScriptBin "backup" ''
-                ${coreutils-full}/bin/rm -rf $1/$2
-              '';
+            params.cleanoutDays = "7";
           };
         in
           with config.hm.xdg.userDirs; {
             share = {
               path = publicShare;
               devices = notHeadless;
-              versioning = void;
+              versioning = trashcan;
             };
             pass = {
               path =
@@ -124,7 +117,7 @@ in {
             vidya = {
               path = "${documents}/vidya";
               devices = notOther;
-              versioning = void;
+              versioning = trashcan;
             };
           };
 
@@ -134,9 +127,13 @@ in {
             insecureSkipHostcheck = this.isHeadless;
           };
           options = {
-            # Only local discovery is used over VPN.
-            globalAnnounceEnabled = false;
+            autoUpgradeIntervalH = 0;
+            crashReportingEnabled = false;
+            globalAnnounceEnabled = false; # We don't need that with Wireguard.
             relaysEnabled = false;
+            setLowPriority = this.isHeadless;
+            stunKeepaliveMinS = 0;
+            stunKeepaliveStartS = 0;
             urAccepted = -1;
           };
         };
diff --git a/modules/nixfiles/wireguard.nix b/modules/nixfiles/wireguard.nix
index 1da3e74..e35d0ee 100644
--- a/modules/nixfiles/wireguard.nix
+++ b/modules/nixfiles/wireguard.nix
@@ -9,7 +9,7 @@ with lib; let
   cfg = config.nixfiles.modules.wireguard;
 in {
   options.nixfiles.modules.wireguard = {
-    # TODO Make this simpler.
+    # TODO Set this automatically shire on the hostname.
     privateKeyFile = mkOption {
       description = "Path to the private key file.";
       type = with types; nullOr string;