mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-06-10 19:55:41 +03:00
301 lines
9.9 KiB
Nix
301 lines
9.9 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.nezha-agent;
|
|
|
|
# nezha-agent uses yaml as the configuration file format.
|
|
# Since we need to use jq to update the content, so here we generate json
|
|
settingsFormat = pkgs.formats.json { };
|
|
configFile = settingsFormat.generate "config.json" cfg.settings;
|
|
in
|
|
{
|
|
meta = {
|
|
maintainers = with lib.maintainers; [ moraxyc ];
|
|
};
|
|
options = {
|
|
services.nezha-agent = {
|
|
enable = lib.mkEnableOption "Agent of Nezha Monitoring";
|
|
|
|
package = lib.mkPackageOption pkgs "nezha-agent" { };
|
|
|
|
debug = lib.mkEnableOption "verbose log";
|
|
|
|
settings = lib.mkOption {
|
|
description = ''
|
|
Generate to {file}`config.json` as a Nix attribute set.
|
|
Check the [guide](https://nezha.wiki/en_US/guide/agent.html)
|
|
for possible options.
|
|
'';
|
|
type = lib.types.submodule {
|
|
freeformType = settingsFormat.type;
|
|
|
|
options = {
|
|
disable_command_execute = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = ''
|
|
Disable executing the command from dashboard.
|
|
'';
|
|
};
|
|
disable_nat = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Disable NAT penetration.
|
|
'';
|
|
};
|
|
disable_send_query = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Disable sending TCP/ICMP/HTTP requests.
|
|
'';
|
|
};
|
|
gpu = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Enable GPU monitoring.
|
|
'';
|
|
};
|
|
tls = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Enable SSL/TLS encryption.
|
|
'';
|
|
};
|
|
temperature = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = ''
|
|
Enable temperature monitoring.
|
|
'';
|
|
};
|
|
use_ipv6_country_code = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = ''
|
|
Use ipv6 countrycode to report location.
|
|
'';
|
|
};
|
|
skip_connection_count = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Do not monitor the number of connections.
|
|
'';
|
|
};
|
|
skip_procs_count = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Do not monitor the number of processes.
|
|
'';
|
|
};
|
|
report_delay = lib.mkOption {
|
|
type = lib.types.enum [
|
|
1
|
|
2
|
|
3
|
|
4
|
|
];
|
|
default = 3;
|
|
description = ''
|
|
The interval between system status reportings.
|
|
The value must be an integer from 1 to 4.
|
|
'';
|
|
};
|
|
server = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "127.0.0.1:8008";
|
|
description = ''
|
|
Address to the dashboard.
|
|
'';
|
|
};
|
|
uuid = lib.mkOption {
|
|
type = with lib.types; nullOr str;
|
|
# pre-defined uuid of Dns in RFC 4122
|
|
example = "6ba7b810-9dad-11d1-80b4-00c04fd430c8";
|
|
default = null;
|
|
description = ''
|
|
Must be set to a unique identifier, preferably a UUID according to
|
|
RFC 4122. UUIDs can be generated with `uuidgen` command, found in
|
|
the `util-linux` package.
|
|
|
|
Set {option}`services.nezha-agent.genUuid` to true to generate uuid
|
|
from {option}`networking.fqdn` automatically.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
genUuid = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Whether to generate uuid from fqdn automatically.
|
|
Please note that changes in hostname/domain will result in different uuid.
|
|
'';
|
|
};
|
|
|
|
clientSecretFile = lib.mkOption {
|
|
type = with lib.types; nullOr path;
|
|
default = null;
|
|
description = ''
|
|
Path to the file contained the client_secret of the dashboard.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
imports = with lib; [
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "disableCommandExecute" ]
|
|
[ "services" "nezha-agent" "settings" "disable_command_execute" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "disableNat" ]
|
|
[ "services" "nezha-agent" "settings" "disable_nat" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "disableSendQuery" ]
|
|
[ "services" "nezha-agent" "settings" "disable_send_query" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "gpu" ]
|
|
[ "services" "nezha-agent" "settings" "gpu" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "tls" ]
|
|
[ "services" "nezha-agent" "settings" "tls" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "temperature" ]
|
|
[ "services" "nezha-agent" "settings" "temperature" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "useIPv6CountryCode" ]
|
|
[ "services" "nezha-agent" "settings" "use_ipv6_country_code" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "skipConnection" ]
|
|
[ "services" "nezha-agent" "settings" "skip_connection_count" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "skipProcess" ]
|
|
[ "services" "nezha-agent" "settings" "skip_procs_count" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "reportDelay" ]
|
|
[ "services" "nezha-agent" "settings" "report_delay" ]
|
|
)
|
|
(mkRenamedOptionModule
|
|
[ "services" "nezha-agent" "server" ]
|
|
[ "services" "nezha-agent" "settings" "server" ]
|
|
)
|
|
(lib.mkRemovedOptionModule [ "services" "nezha-agent" "extraFlags" ] ''
|
|
Use `services.nezha-agent.settings` instead.
|
|
|
|
Nezha-agent v1 is no longer configured via command line flags.
|
|
'')
|
|
(lib.mkRemovedOptionModule [ "services" "nezha-agent" "passwordFile" ] ''
|
|
Use `services.nezha-agent.clientSecretFile` instead.
|
|
|
|
Nezha-agent v1 uses the client secret from the dashboard to connect.
|
|
'')
|
|
];
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
assertions = [
|
|
{
|
|
assertion = cfg.settings.uuid == null -> cfg.genUuid;
|
|
message = "Please set `service.nezha-agent.settings.uuid` while `genUuid` is false.";
|
|
}
|
|
{
|
|
assertion = cfg.settings.uuid != null -> !cfg.genUuid;
|
|
message = "When `service.nezha-agent.genUuid = true`, `settings.uuid` cannot be set.";
|
|
}
|
|
];
|
|
|
|
services.nezha-agent.settings = {
|
|
debug = cfg.debug;
|
|
# Automatic updates should never be enabled in NixOS.
|
|
disable_auto_update = true;
|
|
disable_force_update = true;
|
|
};
|
|
|
|
systemd.services.nezha-agent = {
|
|
serviceConfig = {
|
|
Restart = "on-failure";
|
|
StateDirectory = "nezha-agent";
|
|
RuntimeDirectory = "nezha-agent";
|
|
WorkingDirectory = "/var/lib/nezha-agent";
|
|
ReadWritePaths = "/var/lib/nezha-agent";
|
|
|
|
LoadCredential = lib.optionalString (
|
|
cfg.clientSecretFile != null
|
|
) "client-secret:${cfg.clientSecretFile}";
|
|
|
|
# Hardening
|
|
ProcSubset = "all"; # Needed to get host information
|
|
DynamicUser = true;
|
|
RemoveIPC = true;
|
|
LockPersonality = true;
|
|
ProtectClock = true;
|
|
MemoryDenyWriteExecute = true;
|
|
PrivateUsers = true;
|
|
ProtectHostname = true;
|
|
RestrictSUIDSGID = true;
|
|
AmbientCapabilities = [ ];
|
|
CapabilityBoundingSet = "";
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectProc = "invisible";
|
|
ProtectSystem = "strict";
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
SystemCallArchitectures = "native";
|
|
UMask = "0066";
|
|
SystemCallFilter = [
|
|
"@system-service"
|
|
"~@privileged"
|
|
];
|
|
RestrictAddressFamilies = [
|
|
"AF_INET"
|
|
"AF_INET6"
|
|
];
|
|
PrivateDevices = "yes";
|
|
};
|
|
environment.HOME = "/var/lib/nezha-agent";
|
|
enableStrictShellChecks = true;
|
|
startLimitIntervalSec = 10;
|
|
startLimitBurst = 3;
|
|
script = ''
|
|
cp "${configFile}" "''${RUNTIME_DIRECTORY}"/config.json
|
|
${lib.optionalString (cfg.clientSecretFile != null) ''
|
|
${lib.getExe pkgs.jq} --arg client_secret "$(<"''${CREDENTIALS_DIRECTORY}"/client-secret)" \
|
|
'. + { client_secret: $client_secret }' < "''${RUNTIME_DIRECTORY}"/config.json > "''${RUNTIME_DIRECTORY}"/config.json.tmp
|
|
mv "''${RUNTIME_DIRECTORY}"/config.json.tmp "''${RUNTIME_DIRECTORY}"/config.json
|
|
''}
|
|
${lib.optionalString cfg.genUuid ''
|
|
${lib.getExe pkgs.jq} --arg uuid "$(${lib.getExe' pkgs.util-linux "uuidgen"} --md5 -n @dns -N "${config.networking.fqdn}")" \
|
|
'. + { uuid: $uuid }' < "''${RUNTIME_DIRECTORY}"/config.json > "''${RUNTIME_DIRECTORY}"/config.json.tmp
|
|
mv "''${RUNTIME_DIRECTORY}"/config.json.tmp "''${RUNTIME_DIRECTORY}"/config.json
|
|
''}
|
|
${lib.getExe cfg.package} --config "''${RUNTIME_DIRECTORY}"/config.json
|
|
'';
|
|
wantedBy = [ "multi-user.target" ];
|
|
};
|
|
};
|
|
}
|