sid/sid.ovh
1
0
Fork 0
Code Issues 3 Pull requests 2 Projects Releases Packages Wiki Activity Actions

Compare commits

base: sid:b9cdd8d6a5f54f6d2d9ca0c48990f642b27264f9
Branches Tags
sid:master
sid:develop
sid:feature/overleaf
sid:dns
..
compare: sid:c43269fad67ca3024f6fccbb4e103acec4b46e03
Branches Tags
sid:master
sid:develop
sid:feature/overleaf
sid:dns

4 commits
b9cdd8d6a5 ... c43269fad6

Author SHA1 Message Date
sid
c43269fad6 Merge pull request 'netdata: ui should only be reachable inside tailnet' (#95) from develop into master
Some checks failed
Deploy configs / deploy-configs (push) Failing after 39s
Details 
Reviewed-on: #95
 2026-05-22 21:28:28 +02:00
sid
6841256705 netdata: override acme host defaults
All checks were successful
Build hosts / build-hosts (pull_request) Successful in 19s
Details
Flake check / flake-check (pull_request) Successful in 19s
Details
2026-05-22 21:27:58 +02:00
sid
84d04fa1ad netdata: make ui available in tailnet
Some checks failed
Build hosts / build-hosts (pull_request) Failing after 9s
Details
Flake check / flake-check (pull_request) Failing after 7s
Details
2026-05-22 21:23:54 +02:00
sid
eac7803895 netdata: ui should only be reachable inside tailnet
All checks were successful
Build hosts / build-hosts (pull_request) Successful in 18s
Details
Flake check / flake-check (pull_request) Successful in 21s
Details
2026-05-22 21:17:28 +02:00
2 changed files with 27 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
hosts/sid/secrets/secrets.yaml
View file

@ -35,6 +35,7 @@ radicale:
step-ca: step-ca:
password: ENC[AES256_GCM,data:8/6NA3WpII0LmDOp5ISnHKeaXn5LM4gpiI47JTso23c=,iv:fi2eMGG1lOwdK5+98Hp7vZ101GKRip5Xgq9k+vnC9yI=,tag:oENvvsEbKSHFfLoXcJlPkg==,type:str] password: ENC[AES256_GCM,data:8/6NA3WpII0LmDOp5ISnHKeaXn5LM4gpiI47JTso23c=,iv:fi2eMGG1lOwdK5+98Hp7vZ101GKRip5Xgq9k+vnC9yI=,tag:oENvvsEbKSHFfLoXcJlPkg==,type:str]
intermediate-key: ENC[AES256_GCM,data:yGZLSd7ydx9wNFpWWPcyUBwZQZbyziGleCWSxurFniBCauw2h4hcPc4c4I/7cjl1vRUv41WfzWu1PtXnZ3lNHOC6tTbiikHFBgGiHk2Lhddx+NESUWmgNiejJR/UDW4T25W9OHxwLCV9pmHf4fjyT/REymGIB7kbcRryWqcWtoZWYaL7JooJornm5mMU1Be+MCfxusTGQA4gQsT5/bu20iEGPwgY3fEgZLQWzKFI2kD2lYlMC8CRxoZO32uTizzooW1+zKng1qSZ7aobFJsbSKRYpYDv9Vvfwltcczb+xo+yZL3pfoEiqAxPzeG/48lRVNf1nftM5esBRGIIPr9BV9+7fbe5DFbSRDtAWspEnp9R5ENj1rbNint/fjCcStg3OfFMdv6N8cQyIpQyHCiBLiG4z+xyFcn0iW4=,iv:BhUoeaoetI5vJk9wOHhBI2ebHWCPeXz8U2ta/xEeUxM=,tag:7xg5ilOSJP1rFlSmmZVZUg==,type:str] intermediate-key: ENC[AES256_GCM,data:yGZLSd7ydx9wNFpWWPcyUBwZQZbyziGleCWSxurFniBCauw2h4hcPc4c4I/7cjl1vRUv41WfzWu1PtXnZ3lNHOC6tTbiikHFBgGiHk2Lhddx+NESUWmgNiejJR/UDW4T25W9OHxwLCV9pmHf4fjyT/REymGIB7kbcRryWqcWtoZWYaL7JooJornm5mMU1Be+MCfxusTGQA4gQsT5/bu20iEGPwgY3fEgZLQWzKFI2kD2lYlMC8CRxoZO32uTizzooW1+zKng1qSZ7aobFJsbSKRYpYDv9Vvfwltcczb+xo+yZL3pfoEiqAxPzeG/48lRVNf1nftM5esBRGIIPr9BV9+7fbe5DFbSRDtAWspEnp9R5ENj1rbNint/fjCcStg3OfFMdv6N8cQyIpQyHCiBLiG4z+xyFcn0iW4=,iv:BhUoeaoetI5vJk9wOHhBI2ebHWCPeXz8U2ta/xEeUxM=,tag:7xg5ilOSJP1rFlSmmZVZUg==,type:str]
hetzner-api-key: ENC[AES256_GCM,data:NhgWjitvgJrcBEDSkZH0S0VmaW37NupkiEUcQDZe/6oYyrE/VgEwrGSag/s2Fgv6uHmSsdbv1vqdc0iDO8GJ8w==,iv:ChEicL0jtjQrgn8CCUnrzErRr3YVdDhMbvcIlI3t7H8=,tag:cjjbEEYqEyNa5qDZCytjxw==,type:str]
sops: sops:
age: age:
- recipient: age19yeqvv28fgrtk6jsh3xyaf0lch86kna6rcz4dwe962yyyyevu30sx474xy - recipient: age19yeqvv28fgrtk6jsh3xyaf0lch86kna6rcz4dwe962yyyyevu30sx474xy
@ -55,7 +56,7 @@ sops:
RzhnczA0S1pxcXZncGpWVHNYQW96L28K+ytH3PPyg4+wibpAQhp02RiSfZ83EDRB RzhnczA0S1pxcXZncGpWVHNYQW96L28K+ytH3PPyg4+wibpAQhp02RiSfZ83EDRB
UJ8UV1d+51D0e2A1sI95r2AzDj4jfwUnI+LYDPC/qEpsu5LFLGVyeg== UJ8UV1d+51D0e2A1sI95r2AzDj4jfwUnI+LYDPC/qEpsu5LFLGVyeg==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2026-05-02T17:10:22Z" lastmodified: "2026-05-22T19:19:21Z"
mac: ENC[AES256_GCM,data:f4KQ26/zvg2nLLeW5qVeI8uH2GmPpJUKohNu68nEiIjP5AT53zjBaGoLOTGl9+oVRomSOGZtLGkJGaExB6tLMon5HN6xkQbugqvq08UkZ7FnR1Sa8/OtTr/+eexPNzF8VSdZE2TZCboUSQODV8+0Cy5T918g5kedxnT62SyY4As=,iv:P4TnpJvHwnZPl7kRNjv9d1WLZP9J0sg6R3KbdDMJqyc=,tag:ylYOcg6825jT29lWUaFRYA==,type:str] mac: ENC[AES256_GCM,data:hOtmWizEaIcybM14UEDsXw4GNQZob5SoFn49bWeccxA3dkGlYl67kVkDJGg0cQIO1qr/vGcZ8h/OmnOxU3geP0DaflG0h1/40lDQ3+E6BTb6HP2JmhgEmlRBRBdv87cRDHnDytBzcWARTvff3SsP2J2pLpLBTDiihlaZaiQYtgU=,iv:TvFpvcTydXO3fbh5x9ZXIOtMChlE7WXl2Xx2a9ujh00=,tag:XHvsZh6r9fzbbYFWWQyI5g==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.12.1 version: 3.12.1

25
hosts/sid/services/netdata.nix
View file

@ -56,8 +56,14 @@ in
}; };
services.nginx.virtualHosts."${constants.services.netdata.fqdn}" = { services.nginx.virtualHosts."${constants.services.netdata.fqdn}" = {
enableACME = true; useACMEHost = constants.services.netdata.fqdn;
forceSSL = true; forceSSL = true;
listen = [
{
addr = "${constants.hosts.sid.ip}:443";
ssl = true;
}
];
locations."/" = { locations."/" = {
root = netdata-dashboard; root = netdata-dashboard;
@ -70,6 +76,17 @@ in
}; };
}; };
security.acme = {
acceptTerms = true;
certs."${constants.services.netdata.fqdn}" = {
domain = constants.services.netdata.fqdn;
webroot = lib.mkForce null;
dnsProvider = "hetzner";
credentialFiles.HETZNER_API_TOKEN_FILE = config.sops.secrets.hetzner-api-key.path;
group = "nginx";
};
};
services.journald.storage = "persistent"; services.journald.storage = "persistent";
users.users.netdata.extraGroups = [ "systemd-journal" ]; users.users.netdata.extraGroups = [ "systemd-journal" ];
@ -82,6 +99,12 @@ in
restartUnits = [ "netdata.service" ]; restartUnits = [ "netdata.service" ];
in in
{ {
secrets.hetzner-api-key = {
inherit mode;
owner = "acme";
group = "acme";
};
secrets."netdata/stream/rx4/uuid" = { secrets."netdata/stream/rx4/uuid" = {
inherit inherit
owner owner