{ config, lib, pkgs, inputs, evalConfig, ... }: let tracktrain-config = '' dbstring: "dbname=tracktrain" gtfs: ./gtfs.zip warp: port: 4000 login: enable: true url: https://login.infra4future.de clientname: tracktrain # clientsecret defined in env file ''; in { services.nginx.virtualHosts."tracktrain.ilztalbahn.eu" = { enableACME = true; forceSSL = true; locations."/" = { proxyPass = "http://192.168.42.41:4000"; proxyWebsockets = true; extraConfig = '' add_header 'Access-Control-Allow-Origin' '*' always; ''; }; # note: this shadows the /metrics endpoint of tracktrain # in case you remove this, please consider putting something # else here to keep it from being publicly scrapable locations."/metrics/" = { proxyPass = "http://192.168.42.41:2342"; proxyWebsockets = true; extraConfig = '' rewrite ^/metrics/(.*) /$1 break; ''; }; }; networking.firewall.allowedTCPPorts = [ 443 ]; containers.tracktrain = { privateNetwork = true; hostAddress = "192.168.42.40"; localAddress = "192.168.42.41"; autoStart = true; bindMounts = { "/persist" = { hostPath = "/persist/containers/tracktrain"; isReadOnly = false; }; }; path = (evalConfig { hosts = { }; groups = { }; } ({ config, lib, pkgs, profiles, modules, sources, ... }: { boot.isContainer = true; networking.useDHCP = false; users.users.root.hashedPassword = ""; system.stateVersion = "21.11"; imports = [ sources.nix-hexchen.nixosModules.profiles.nopersist ]; networking.firewall.enable = false; networking.defaultGateway = { address = "192.168.100.1"; interface = "eth0"; }; users.users.tracktrain = { group = "tracktrain"; isSystemUser = true; }; users.groups.tracktrain = {}; systemd.services.tracktrain = { enable = true; description = "tracks trains, hopefully"; wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; serviceConfig = { Type = "simple"; EnvironmentFile = "/persist/secrets.env"; User = "tracktrain"; Group = "tracktrain"; }; path = [ pkgs.wget ]; script = '' mkdir -p /persist/tracktrain cd /persist/tracktrain ln -sf ${pkgs.writeText "tracktrain-config.yaml" tracktrain-config} config.yaml wget "https://ilztalbahn.eu/wp-content/uploads/2020/07/gtfs.zip" ${pkgs.tracktrain}/bin/tracktrain +RTS -T ''; }; services.postgresql = { enable = true; ensureDatabases = [ "tracktrain" ]; ensureUsers = [ { name = "tracktrain"; ensurePermissions = { "DATABASE tracktrain" = "ALL PRIVILEGES"; }; } ]; authentication = '' local all all trust host all all 127.0.0.1/32 trust ''; }; services.prometheus = { enable = true; port = 9001; scrapeConfigs = [ { job_name = "tracktrain"; static_configs = [{ targets = [ "0.0.0.0:4000" ]; }]; } ]; }; services.grafana = { enable = true; settings.server = { serve_from_sub_path = true; domain = "tracktrain.ilztalbahn.eu"; root_url = "https://%(domain)s/metrics/"; http_port = 2342; http_addr = "0.0.0.0"; }; settings."auth.generic_oauth" = { name = "uffd"; enabled = true; allow_sign_up = true; empty_scopes = true; client_id = "ilztalbahn-grafana"; client_secret = "\${GRAFANA_CLIENT_SECRET}"; auth_url = "https://login.infra4future.de/oauth2/authorize"; token_url = "https://login.infra4future.de/oauth2/token"; api_url = "https://login.infra4future.de/oauth2/userinfo"; }; # disables the default login screen. comment out if for some # reason you do need it settings.auth.oauth_auto_login = true; settings.users.auto_assign_org_role = "Admin"; provision = { enable = true; datasources.settings.datasources = [ { url = "http://localhost:9001"; type = "prometheus"; name = "prometheus"; } ]; }; }; systemd.services.grafana.serviceConfig.EnvironmentFile = "/persist/secrets.env"; services.coredns = { enable = true; config = '' .:53 { forward . 1.1.1.1 } ''; }; })).config.system.build.toplevel; }; }