robin/wifi-prometheus-exporter
1
0
Fork 0
mirror of https://codeberg.org/icewind/wifi-prometheus-exporter.git synced 2026-06-03 16:44:11 +02:00
Code Issues Projects Releases Packages Wiki Activity

flake

Browse source
This commit is contained in:
Robin Appelman 2022-07-25 23:00:43 +02:00
commit 379d6a4cf9
4 changed files with 201 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.envrc Normal file
View file

@ -0,0 +1 @@
use flake

2
.gitignore vendored
View file

@ -2,3 +2,5 @@
**/*.rs.bk
.env
key*
.direnv
result

70
flake.lock generated Normal file
View file

@ -0,0 +1,70 @@
{
"nodes": {
"flake-utils": {
"locked": {
"lastModified": 1656928814,
"narHash": "sha256-RIFfgBuKz6Hp89yRr7+NR5tzIAbn52h8vT6vXkYjZoM=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "7e2a3b3dfd9af950a856d66b0a7d01e3c18aa249",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"naersk": {
"inputs": {
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1655042882,
"narHash": "sha256-9BX8Fuez5YJlN7cdPO63InoyBy7dm3VlJkkmTt6fS1A=",
"owner": "nix-community",
"repo": "naersk",
"rev": "cddffb5aa211f50c4b8750adbec0bbbdfb26bb9f",
"type": "github"
},
"original": {
"owner": "nix-community",
"repo": "naersk",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 0,
"narHash": "sha256-XZ1fKlEkAQvgocuBYq9lXEP3eNW6gF9JHsPVsvkWMhU=",
"path": "/nix/store/2xbq6yjs2lf2j0438h162mf66jvg0wyg-source",
"type": "path"
},
"original": {
"id": "nixpkgs",
"type": "indirect"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 0,
"narHash": "sha256-XZ1fKlEkAQvgocuBYq9lXEP3eNW6gF9JHsPVsvkWMhU=",
"path": "/nix/store/2xbq6yjs2lf2j0438h162mf66jvg0wyg-source",
"type": "path"
},
"original": {
"id": "nixpkgs",
"type": "indirect"
}
},
"root": {
"inputs": {
"flake-utils": "flake-utils",
"naersk": "naersk",
"nixpkgs": "nixpkgs_2"
}
}
},
"root": "root",
"version": 7
}

127
flake.nix Normal file
View file

@ -0,0 +1,127 @@
{
inputs = {
flake-utils.url = "github:numtide/flake-utils";
naersk.url = "github:nix-community/naersk";
};
outputs = {
self,
nixpkgs,
flake-utils,
naersk,
}:
flake-utils.lib.eachDefaultSystem (
system: let
pkgs = nixpkgs.legacyPackages."${system}";
naersk-lib = naersk.lib."${system}";
in rec {
# `nix build`
packages.wifi-prometheus-exporter = naersk-lib.buildPackage {
pname = "wifi-prometheus-exporter";
root = ./.;
nativeBuildInputs = [pkgs.pkg-config];
buildInputs = [pkgs.openssl];
};
defaultPackage = packages.wifi-prometheus-exporter;
defaultApp = packages.wifi-prometheus-exporter;
# `nix develop`
devShell = pkgs.mkShell {
nativeBuildInputs = with pkgs; [rustc cargo bacon cargo-edit cargo-outdated pkgs.openssl pkgs.pkg-config];
};
}
)
// {
nixosModule = {
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.services.wifi-prometheus-exporter;
in {
options.services.wifi-prometheus-exporter = {
enable = mkEnableOption "WiFi prometheus exporter";
sshAddress = mkOption {
type = types.str;
description = "ssh address of the wifi access point";
};
sshKeyFile = mkOption {
type = types.str;
description = "path containing the ssh private key";
};
sshPubKeyFile = mkOption {
type = types.str;
description = "path containing the ssh public key";
};
interfaces = mkOption {
type = types.listOf types.str;
description = "access point interface to expose";
};
port = mkOption {
type = types.int;
default = 9010;
description = "port to listen to";
};
mqttSecretFile = mkOption {
type = types.str;
description = "path containing MQTT_HOSTNAME, MQTT_USERNAME and MQTT_PASSWORD environment variables";
};
};
config = mkIf cfg.enable {
systemd.services."wifi-prometheus-exporter" = let
pkg = self.defaultPackage.${pkgs.system};
in {
wantedBy = ["multi-user.target"];
script = "${pkg}/bin/wifi-prometheus-exporter";
environment = {
PORT = toString cfg.port;
ADDR = cfg.sshAddress;
KEYFILE = cfg.sshKeyFile;
PUBFILE = cfg.sshPubKeyFile;
INTERFACES = concatStringsSep " " cfg.interfaces;
};
serviceConfig = {
EnvironmentFile = cfg.mqttSecretFile;
Restart = "on-failure";
DynamicUser = true;
PrivateTmp = true;
ProtectSystem = "strict";
ProtectHome = true;
NoNewPrivileges = true;
PrivateDevices = true;
ProtectClock = true;
CapabilityBoundingSet = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
SystemCallArchitectures = "native";
ProtectKernelModules = true;
RestrictNamespaces = true;
MemoryDenyWriteExecute = true;
ProtectHostname = true;
LockPersonality = true;
ProtectKernelTunables = true;
RestrictAddressFamilies = "AF_INET AF_INET6";
RestrictRealtime = true;
ProtectProc = "noaccess";
SystemCallFilter = ["@system-service" "~@resources" "~@privileged"];
IPAddressDeny = "any";
IPAddressAllow = "192.168.0.0/16";
PrivateUsers = true;
ProcSubset = "pid";
};
};
};
};
};
}