move encrypted secrets near relevant files

2025-07-06 19:00:14 +00:00 · 2025-03-09 17:09:33 +00:00
parent f59ac536a2
commit 37d1d7724a
60 changed files with 27 additions and 94 deletions
--- a/platforms/nixos/modules/nmasur/presets/services/influxdb2/influxdb2-password.age
+++ b/platforms/nixos/modules/nmasur/presets/services/influxdb2/influxdb2-password.age
@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBkaUhZ
+NHE3L2gwaU8rVjlkR0JOL0d4YVdYVHdnSkJzUERTM1NyRlNmV1FnCldOTkd1Z1Jj
+clVxNGZzZDExdDNTMWZIQ0pKbzE2UXNpb3BhbmxuZ0FNMEUKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIHZ3NXc5WDVwQXY1ODRzamQrY2JaK051WXJwYWtDYmhkOXpPWGZS
+RHY4ek0KdGQ3QjhnRVRVUHNUaHNxa0I3NVFXUFZ0WjlUZXFNTnM1MGYrTXZVSGkw
+SQotPiBzc2gtZWQyNTUxOSBuanZYNUEga3V5MmQyMkdCYjN0cUlkRWNlTXh4ZFRW
+aURLK2cySk9wbmo4MGFaUHNSOAo2NFdadi9ENmZ3a3hBeUdGeVNGRkU5Y3drWXZo
+eEFKdEVHVk9palA2cTBVCi0+IHNzaC1lZDI1NTE5IENxSU9VQSAxazl3UkNTcFI0
+MDJHQTdwZ01BdEh3czZWaWszcnZ5dmsxSjNteDluTEVRCmZidGJiT0xuWmdpQm5u
+TEpCTlF4QVVBVzFMQnRteUZ0cStZc0tRMHFMVkUKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IDhicExSMnVtNUl4L0Q3ZGlpQVF1eXlzOVZpMlR2TnVadk5XU1loK3NXQTAK
+bktxWkFqTitQaFdCdEtvRHNDZ21lMzl0ckliT0JsMkErdnVKWmVmeGF6YwotLS0g
+VStoT1QwdmF6ZGNpbjdmeXA5bFNhWUFxamx1SXRiYVkvNGQvYkVEb29kVQoNyF4F
+azoWnxojKxAIC2qBM80EdVCvcRdhKm4iSzyWYMt06cb6IrEutOzC+FCx37A6KKVU
+tNYcXpGcJX2ge805
+-----END AGE ENCRYPTED FILE-----
--- a/platforms/nixos/modules/nmasur/presets/services/influxdb2/influxdb2-token.age
+++ b/platforms/nixos/modules/nmasur/presets/services/influxdb2/influxdb2-token.age
@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyBBWHpP
+ZmxVTFpQOVhXdVRvTjZuVGlRVUpHRzk4ZTd0VTdDaUcyalJid0ZjCmtWcERqSW1k
+Q3ozaEQvT0Rja1VvT3NoRWxFeWxqbzFtMEdUVkJEcURGMGMKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIDZvWHpFRWVFVTRTSUlzcm1Ca1JNbFhNQWNISkkyTXp2SVFRVmpt
+Q0JxUXcKYThwazdBekZFdUc2aVRaSUVjUmFxWjF4NXpCSm5rME1yeUJDUUdEZXAw
+YwotPiBzc2gtZWQyNTUxOSBuanZYNUEga1ZZRVRSQTJpVnhzekpVQU00MlB0TzQ3
+QzBnSUZaVTIxS1Z3R1UzWm9RTQpEeHlyQm4zSWhYODYxalZXakdVZWJBeTFwVzEr
+S2NVODFBTm95bnI3ZjJjCi0+IHNzaC1lZDI1NTE5IENxSU9VQSBMbVVWamlEVU4w
+WHNWbVQ0OXBnY2ZSL005bUVuekNWTTgwd1pLditoZ3dNCmFtWk1PaXZ3c1g4eExX
+dndXUXJqWC9lU3dVVjRqZWFVUWxyZTFiVmxpQ3MKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IGdOZHRHMkVqeWtzYldIMTRwb2w5M2lrc0FiOUdmT25kWWJ3U3dLZFpEUWcK
+UEFWMndhaDFBUzZrMHl6eUtNMXhIQ2RBQjQwTG5pQnIxZE03L3BpcUNBSQotLS0g
+dXVZNWdJY2hMaHNqdHVEYzRXNlpzOVA3ZnRyaWV2SVNJaG5FL2FPVjN3QQrunATj
+0/HE6CeyvFHIYDazDseUaebDS+A/CaYPpOo+3OvMRXFwbZ7KzAzZCdT1iNLWOc3E
+Im2nMI/yWSLo2n5f
+-----END AGE ENCRYPTED FILE-----
--- a/platforms/nixos/modules/nmasur/presets/services/influxdb2/influxdb2.nix
+++ b/platforms/nixos/modules/nmasur/presets/services/influxdb2/influxdb2.nix
@ -0,0 +1,73 @@
+# InfluxDB is a timeseries database similar to Prometheus. While
+# VictoriaMetrics can also act as an InfluxDB, this version of it allows for
+# infinite retention separate from our other metrics, which can be nice for
+# recording health information, for example.
+
+{ config, lib, ... }:
+
+let
+  inherit (config.nmasur.settings) hostnames;
+  cfg = config.nmasur.presets.services.influxdb2;
+in
+{
+
+  options.nmasur.presets.services.influxdb2.enable =
+    lib.mkEnableOption "InfluxDB timeseries database";
+  config = lib.mkIf cfg.enable {
+
+    services.influxdb2 = {
+      enable = true;
+      provision = {
+        enable = true;
+        initialSetup = {
+          bucket = "default";
+          organization = "main";
+          passwordFile = config.secrets.influxdb2Password.dest;
+          retention = 0; # Keep data forever
+          tokenFile = config.secrets.influxdb2Token.dest;
+          username = "admin";
+        };
+      };
+      settings = { };
+    };
+
+    # Create credentials file for InfluxDB admin
+    secrets.influxdb2Password = lib.mkIf config.services.influxdb2.enable {
+      source = ./influxdb2-password.age;
+      dest = "${config.secretsDirectory}/influxdb2-password";
+      owner = "influxdb2";
+      group = "influxdb2";
+      permissions = "0440";
+    };
+    systemd.services.influxdb2Password-secret = lib.mkIf config.services.influxdb2.enable {
+      requiredBy = [ "influxdb2.service" ];
+      before = [ "influxdb2.service" ];
+    };
+    secrets.influxdb2Token = lib.mkIf config.services.influxdb2.enable {
+      source = ./influxdb2-token.age;
+      dest = "${config.secretsDirectory}/influxdb2-token";
+      owner = "influxdb2";
+      group = "influxdb2";
+      permissions = "0440";
+    };
+    systemd.services.influxdb2Token-secret = lib.mkIf config.services.influxdb2.enable {
+      requiredBy = [ "influxdb2.service" ];
+      before = [ "influxdb2.service" ];
+    };
+
+    nmasur.presets.services.caddy.routes = lib.mkIf config.services.influxdb2.enable [
+      {
+        match = [ { host = [ hostnames.influxdb ]; } ];
+        handle = [
+          {
+            handler = "reverse_proxy";
+            upstreams = [ { dial = "localhost:8086"; } ];
+          }
+        ];
+      }
+    ];
+
+    # Configure Cloudflare DNS to point to this machine
+    services.cloudflare-dyndns.domains = [ hostnames.influxdb ];
+  };
+}