From 14ae5eac1a4d7ff09191b76a4cd459092d633cb4 Mon Sep 17 00:00:00 2001 From: Ryan Horiguchi Date: Mon, 25 Nov 2024 19:18:32 +0100 Subject: [PATCH] WIP --- .../devices/headless/router/default.nix | 13 +++ .../devices/headless/router/librenms.nix | 95 ++++++++++++++++++ modules/default/librenms.nix | 19 ++++ secrets.nix | Bin 4808 -> 4857 bytes 4 files changed, 127 insertions(+) create mode 100644 configuration/devices/headless/router/librenms.nix create mode 100644 modules/default/librenms.nix diff --git a/configuration/devices/headless/router/default.nix b/configuration/devices/headless/router/default.nix index 1ff4649d..7632be1c 100644 --- a/configuration/devices/headless/router/default.nix +++ b/configuration/devices/headless/router/default.nix @@ -6,6 +6,7 @@ in { ./adguardhome.nix ./firewall.nix + ./librenms.nix ./routing.nix ./web-proxy.nix @@ -35,5 +36,17 @@ in { username = secrets.infomaniak.username; password = secrets.infomaniak.password; }; + + snmpd = { + enable = true; + + listenAddress = "127.0.0.1"; + configText = '' + rocommunity public + + sysLocation Cabinet + sysContact ${config.security.acme.defaults.email} + ''; + }; }; } diff --git a/configuration/devices/headless/router/librenms.nix b/configuration/devices/headless/router/librenms.nix new file mode 100644 index 00000000..1c99c5ee --- /dev/null +++ b/configuration/devices/headless/router/librenms.nix @@ -0,0 +1,95 @@ +{ pkgs, config, lib, secrets, ... }: +let defaultUser = "admin"; +in { + services = { + infomaniak = { + enable = true; + + username = secrets.infomaniak.username; + password = secrets.infomaniak.password; + hostnames = [ "librenms.00a.ch" ]; + }; + + # workaround for the nginx attributes since lib.mkMerge fails + nginx.virtualHosts."${config.services.librenms.hostname}".locations."/" = { + basicAuth = secrets.nginx.basicAuth."librenms.00a.ch"; + + extraConfig = '' + fastcgi_param REMOTE_USER ${defaultUser}; + + satisfy any; + + allow 192.168.1.0/24; + deny all; + ''; + }; + + # TODO vlan are not shown for router + # TODO ip table is empty for router + # TODO arp table is empty for router + librenms = { + enable = true; + + hostname = "librenms.00a.ch"; + + settings = { + auth_mechanism = "http-auth"; + + autodiscovery.nets-exclude = [ ]; + nets = [ "127.0.0.1" "192.168.1.0/24" ]; + + discovery_modules.discovery-arp = true; + }; + + database = { + createLocally = true; + socket = "/run/mysqld/mysqld.sock"; + }; + + nginx = { + enableACME = true; + forceSSL = true; + }; + }; + }; + + systemd.services.librenms-add-admin-user = { + after = [ "librenms-setup.service" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + User = config.services.librenms.user; + Group = config.services.librenms.group; + }; + + script = let + pkg = builtins.head (builtins.filter (pkg: pkg.name == "lnms") config.environment.systemPackages); + lnms = "${pkg}/bin/lnms"; + in '' + ${lnms} db:seed --force + + ${lnms} user:add ${ + lib.concatStringsSep " " [ + ''--email "${config.security.acme.defaults.email}"'' + ''--password "$(${pkgs.openssl}/bin/openssl rand --hex 16)"'' + "--role admin" + "--no-interaction" + ] + } ${defaultUser} || true + + echo "${ + lib.concatStringsSep " " [ + "UPDATE ${config.services.librenms.database.database}.users" + "SET auth_type = '${config.services.librenms.settings.auth_mechanism}'" + "WHERE username = '${defaultUser}'" + ] + };" | ${pkgs.mariadb}/bin/mysql --socket='${config.services.librenms.database.socket}' || true + ''; + }; + + services.cron.systemCronJobs = [ + "27 * * * * ${config.services.librenms.user} ${pkgs.python3}/bin/python /${config.services.librenms.package}/snmp-scan.py >> /dev/null 2>&1" + ]; +} diff --git a/modules/default/librenms.nix b/modules/default/librenms.nix new file mode 100644 index 00000000..6d722ac3 --- /dev/null +++ b/modules/default/librenms.nix @@ -0,0 +1,19 @@ +# TODO remove when merged https://nixpk.gs/pr-tracker.html?pr=359182 + +{ modulesPath, ... }: +let + src = let + owner = "NixOS"; + repo = "nixpkgs"; + rev = "cf4d89e473867d68587cfe098e0725194eddf149"; + sha256 = "sha256:0an0xa61wpgympk391kyn6pdmx4jnbiyapcr193kc9qk9r3x3iaz"; + in builtins.fetchTarball { + name = "nixpkgs"; + url = "https://github.com/${owner}/${repo}/archive/${rev}.tar.gz"; + inherit sha256; + }; +in { + disabledModules = [ "${modulesPath}/services/monitoring/librenms.nix" ]; + + imports = [ "${src}/nixos/modules/services/monitoring/librenms.nix" ]; +} diff --git a/secrets.nix b/secrets.nix index 20939d6ccb4d105fd12f101a8b5a315ecf6249f8..c12327c767c159b88300967ceaa914e03ee4553a 100755 GIT binary patch literal 4857 zcmVGxaDz=@QfI*LwzGC`*uIDLBORdlBNuv4S^ z1SP0B4;13H(Vfb(w4hBMmFI!r6Gd`L+={w3D55!?lqtutaXkM9o|_>vN4!Fe_bTR0 z%&IO4KbboRxWFwip`56~kw}Kw72K+Pn^hg-Fjq4WT$g_Vx21?sbX-;wE0KgaD~b z_vOUNhiBLwOkc~|f=vGJzu|(8gN`u(9;p|V7F_i4v9%aZAtr{iV8jGR&kl&)Xb^({ zF7h zkP^fJ8Q3-unEqd1XE$+}hSSK@Y^uPyO~y29wXoJ#Rms%FE+R1ABSrRV(sQNqOtJQA zP>eD>Pk5}5h#{DwVH0^DjMU_rvuVH?kM!I&R>$ssA=7Bnugq(|1{a346 z!DUMrSD~JO6jNfXEr5@s4!dypT#LjPk(520QbD>82qx<+k94Q>sPN2c1r4&d33Wo^ zF_R9jmn2ux0$(+Y#cTYr(zSo2rBi&1&efmYPq=pVB!w44<=&MrcfGEi*4$QTs zYai)?p-kJ^)&ugF2T^FsZqLR#i%-$Kwp7XV+A@N|+vr=4+0_NX%H(~IN1OM*K2LEI zcyHW73w))|QCyfNe`#kY3zYFSmho{TI05+e91XU@FM#n05sa&6ZCoiyAdX_jFMY53H2;^-&;l ze;~cqy>zqp#obgdf6PH-W2#iU@S zSv^L)={bLnzeV*V~I!fv1pfh(->-(@yicb&cra6_rN0nW{Ms_cjOn z40X;m_Dt)z@@N(0PF4{aWOh(Xo1=7y51eG)lgBz5X4|B}jp;e~sV>x&Jm=ydfTozQ z7p=*QZQbY0(yL;Odnyw5UXq1C;{S{R<{sCiBmC0 zWL=#Uk;@lph&IXvhH8d5e(o7yw9>xSH~oi@<8NoYSDD4L#_NVOhE2*vp-bLIE-xd$o=;Cv@cbj;aHW4uO|DQ|UsvaCyRVlV?kY%R0-%YkK0fIK35bt;Yoh3Y$heEml*(R@-7RLORrF%K7oW z&t``gB1~!4>b585_BAsk!lgyeEo+bM{jibu!P$L!DBUy0%|BTFImr9C7bHW5_L+!( z#-olBTzoA1noA;YX~auO5Ns?fdt8=s)iS2GV3kSO)olH4kzb149fEhxJg}sC9B(Z- zp`DlB2(F(5_KfH|$jTzXC)sl^4zCnQ`@4}!w%Keil>S8mrwyOyV_ar5;C|3+=*SS- zUcNT;@?GdEC{_)N##J;nNndhvd}lrYJcKk}Uq~mw$4B#AcM50>#%JE5lcPMmG!Wvt zze?>>Ku_An#yw}_L4Sq0Oc&UYnB5D{BUa3LAN;2k1K`P!;J`R}RR>{MAg(mlC;Oa1 zk2`KQhA701?7P&Crw^YsytuS!?o4@0S|W1jJh*Xpfc(dH=cnL<7qBgBTHBFUUTgdb z%v>9FLzXZ?iQd8_F2-$9AEk*n42rV0re2ndD`y_ULtpPc8d$ZD-5m#Bb)9oXH7Pv? zfX`F*r%P}ZYu*MQ@xnsD0FI*^lF8iu8x;(dg|_n)Aap|DP*d>RQ^4rlEKIzLZ9KXOUCEc-b{euT*0B9dAk61h;R)l6OqMlo*BL}GGUtIFqLakK zUQUDYy4&J^{Z)S*ub}HHyH;(MFJevYs+ik{~Bgm(S)x+o{r^ympQdSVMBH0 zt$R|`zh?(6r^=@h$W#s_PPke@DKAijSCh|E${ieCSdqfhW-c9A4`JXWO0y4xQl0ku zNkw}A%BV|GjNiiyp1A8x;NhHr1tpo}oCN}#vKNXCTPyyyCv zUdJh`ghLTw5Ck)W2J~wg=-YkuNTN95xrEf`R>N_xk*{6&uXrwJy8bESSa|!ukqqdEuUl3W zM{0S|#aIkC->iqrZ*6Vu+r&;u%cb`tW9DYH&{MghRZwceYKBrX#51Ir5ia)edxWTo zwY&vVIGz7VO~HuE03mm!v%5T*wE=X$R618RbrQ^(O~QKd47y1Pii%X`5znWq`O^@* zj4f4UFiGcP=&+W0)ovgdTuVEgFSBPqqKF!6YC_HDz75rm(Gw<6r4u}ydX`JUYNcB~ z|2_Duyn*hZ`vh>-OVD@Q1d!_==?M$VMCBtYZL<0v*ij@3l$>B=K+X-P^d@yK+{4{F z6q!aMU!1V~4;czRn)XoKFOGGxXprmY78*!O=Lu0S5n8l)OYo^^B3!QJ5dgTG@4d(o zyP~vF(d(Lw(B6H|r3kU9Yvodji^wSLpaNg$0M4FX>P<>)`$1xBJ)D-!bq=lMlcSv&F36Yqf_eymN-iNa+k;qH7O z|8`A5oSpT70G0U~&3{_)ez*cH@l+NkCXC)p7>@VGqEGbG@l8&(g&46&n{^Z;Hj-}* zR}1al0Oj3ob+A$4{2pM`kL8Us9(o_)#kBa?)}orTH}33x9EPC z{|8Ki84M+9K3-KwkjI;?hlcP1-CZF+=^~aE;~_3smJGLtvrGKAO>xFr5?N zB|H$^(1!EfBRpk2VxD%GqaX0s6j6u`NNuNObb5{yvqikwhs3&xHZ0k2Y1-H=??nz0 zq2@3If8n)ZJ9%PDj6p3K!2!bXiagc#(J5gl>dJ7a#O6p5t-$*||7RRdVng#37M)@p zL9N`w69zn82@Bk+*5^snUSZ+JFf8S>c1rg*|CU8-!u$DENg@r?j-%2t%1}1e?P(}_ zT0NW+tOYoGIROu+1hZL|)@&_~B9Zw})1=93^+5mGFow}55I`duRRZ_L8`qKnkY)^7 zRqVOLgF+@DM0P*Lhjw96t)tk?anbe?n4_RILZc_VXCPlp5wK#93TGpyMqT%Ots_bPr^M~oCexl3oP=`oGybGQP*He89`Ujf>cyN;G zd-LW=335KFz2H7B@xX6rpZEpzbLj?Or(YsObU9YFsksGj_=7d#P25r9+Fa!pSg5M0kniFWVt;P3O*rBT6v@DU3{@YK zCx_CoE8l{EqP7>=%N8W;l&SlsUT)Jo2JiWE3NK4x>oSfMb4s(%4dPth6*l zZ1A+yrtquC%=i$J&`d9Peuc4(tXUe_qT`4)f2aVv79o1wn&^|z)-VMf$)p2MDcguoD8rY~P|L_IHzOxWck#&^j6e8zSS-Ut{SASX| zf!p0a-!CqNB4IcJOMUyn6!#?taOrrFNvFBt^B=qV&pTD3JaIS7ws=En_a&32u-P># zy34;^gu!I@h+>%Xf1?4un|7A_BwCP2Qho!w&P#DO5@!bBF3Nw1HE0%e-cuFN?%g{% zyGyO!Ns%b#SjS{9S#Su9r2|Unn4jiZ-EoS8OnANCeQ3CI+|H6^ zHTBr-8%dD2Eu%_j@I8vAy#-=$1i7&z#_jJ4B99j#W(BD|3)Aw#3MIyIp+i@A#=rU&j4McC$!xuC8HRubnzd5yt#VA_= zC1k;<`!iTNEVhw;_EBAULAf7!fbgYCvuC{)u=*Egt1Sk}M1lC-%$-1gLgd&y1zFz~ zGV6iHGn=bny5)4YuyYQQ#MlcEZrE(hNJ=ch`1lIeidXKefnz?8{cEB38~~ zC!G8_sW?D>oM=l%VGg0|!o)cmn87lD48w2=)}tJ>Emf)bCqQ!kk(1$*uQSkgCcvCwBlfw3@d(E=Zc0PXo^XrK^9tSY>D5)5@gTTJ}%ORHw z3Btdsw|Mk0AVu8LzA9*UAzuio$Vl|Q1vatT?a@At7BlMPYE(bp-FpIKrC`6@iEA@Y z2)R70(ci&Kox`a3`?G}LPKU1eEMImj>D-FHwy7xSq2*RQT<)f3@V!M5tu}^-bmP8z z$#Ru_Wf+V^=*o$KSH5=AeoaxQW*8D!pApwFDaAaf5J|Zd2m!W8=HgxoWyw1D?_^*b zi&ZY^`9>-udE?2$aiQ(5n5Y!4KUbd-1DfIk0B%Xeq9+(tY9iR>l$VW+Sma*N$qcEo-?bS2nxD+Mcss6ltZoeP0M9&l zFhlBN`n`)TRDdEJL0ZI{2Yvr{=;t5;45w0_;iIHt!k;4hjUj%T$?lUGeb z6eN9Tyo6SHh3mo7O6a4AuWaGN=X`IEdgHNV7xfZX3c)aS5}h^Z0)c2YvHa(qr zPt86hUzWN(myp`bzdhZD{oyMEaLv#Ycas$lPZx|rf-D+q@8#4aLQsQ$1Ogm=$9RU! z-w7~rssJ?cOcU}7*napo;HB_DG-R9qI7?~Jq1?eXnUpgCRPXH!S0_^K%zil=^cn>$ zw{lLiYJ+fKGr>D4J|y?_V94dB+m=>Zq&P;2l~J#pHiyWrRX6GB%O& zryJ407>Q3))p4^rO9;x&`_;cM65Q|^S^sn?-nE9E-9Gx~{ zf-|OdgN+<6T?-7-JS~xMIjmZMuU^7qZ6H(ycjoGLOSwGt4N6~{#R)JPO)g&6nI8ed zJ0Wg-1)c@I;O`>szxONQO`DTi4Lj9v?)$pFmhH==J*2Jw)Y!k``>HWKap!ud4gM!N z0}dwwxk52O1CF}h!Z}NHq_!5!_iGO>ovBqWr)(va7j0GCW@r0hK2*wpQ>bim2`t%M znbB(n@jR4z5ZyxFv*FTN#~$z3(`_mNr(d|WtQ9*tvA!Ik^x$T?;etk2KiJ za4*7+TP9vsQ|+?AI_?8cL7bA{{$D7Rr&a(Fp8WlK?@-!fBEG&2seXE`reNxyI5i_! z06s4yU5|F#*!K(R{ojIBVLZs%7v4OqD@=TB=Vk!;QQa2~A52m#j!_umEl;jv;=Sy3 zn_?Rxn*JxrnE3~?3CD{Mh&>$=BE#{FJ*_*ofXeKD)OLiK`#* zWYqkiEwX(h=gFj=NB%=Z^V=Xl2bo~@Jpb;RJxEL5rvHbtxcyBeDI*&-MTHgw(da>V zqCD^E-V}&r(#;goXB0BxhCaQ z;u`%g8wu8`UxhLm-A-cPmAo=7V$MXM2UDo&IWWW{p8sGxh6E6mOE4@@teGZe;a?t4 z_m@eQmL=4yby-9>?8LMh%J?}9jlVbfaeW?;X=4&?+@cxR|4f|D;YPdCaIAt#n@kI> z5JCw{Kf8cQ_6qFD6<8{* z02p1yE7d&*W)818DO5T@STUhs?qrg*wTk^6Z{=NkyRRw%=Tn!f`C>X-SiPHVtgv$B z`hyJ4y8{HjuL9`isFss$*lRS&Cp)-EGjjaU%R%MpR&-D|@%0X1Ay*e3WmvwGRDiJi z$l64-{6ocQiBj0{W1q~5DBO5P>{E^WG}kS}`?i2DyGZFxs4aSD)pwwxjK*3Z8onKs z^bae3Uh>fc ziHD(uCi%J4G9T>G z)Bz1&fA!&GH4Axy8>K{b!8JocKS?rd3g)_Sr@uXamkMufn)sTpPDK1RWyo;c zUC5H(r|ZN0m=dj}L&HBq_ZUE8MsJwQ#eg|k)^Jv3 z#~u4bpc={|2cA?SdCuWlZ?^6~*nWe25VzdXKA2&aXoWVUL@tETg5; z-?}ZG2z(L-H=Gr0xZiReLA9+gQ=tlDVYJjS2cl`e=wRHS*y+npoU?-SC9ZO_OMu5q za=}0+2V6n|aZhShZJQ|0q{x8hU(cqKc;E<=ExN7FDr2K|=i+=$QkW+^B+!5 z=L;5BgQG=WiU6B+2sbRV9n?+i{If%-5B?>lA)lJCZOT!y`i0i+ap-CkO+UZr*P91( z8E{KTv0M?8EC~No!XUtUG}LZWiW2x2I~i4i6Z|OO(Jt}tJy2u7e2j|qmS+Q_z*od< z$7jNC3aV2(k=NI|-p=5tP7S<_iSX-rxtn(i1^0GwJ)xDgVvsj2vy>)8Hv}?(AeM1+ zfh&cCDWzf?%!B~AV33B*dw95u%;Ea7Jf5!rt@KeKzm2+`!1|JOrO@s;Ld*a_rAMNg zF1l-<%fXr`^$Pm&xEYqH(Ozdx`P z|Nkh9p)&Ftlr~pR-l#1mhC(#gS3A%>gdrV>z+?>jN9Hp2brp^IXXNZ@9|(ZQh1vHo z!3pI$+qL<__$CuCdoB95GqPXzT7!t`gx!!(GfOK_`Hn~+@pj0#S?)?v&G~>n&;xj| zT}sG%FWt0P@x(Cot=Y+#VQavEmv`yf=)|&vCf2EkcQ=h+w`l(nFIj;6ArT{Y2Ltv8 z4+wI05)%|=Bo2V>@E`+TL8+e@>&c~ZUJke)c|N!&1Gd9gjw4nFaTM8S4q1KV1MfEv z!m{TcX$f)w&F`%X`gMx=#-b@GCBq`j=vWJx^zG=s+EK-@z z^hO>&2hk*6Ld?0otR21bc*7rxRFckk8Vwep46TceXJ$;QTHYo5wQdbh%wFXvh>gNT z-{<*?WV_#n){ER0+Qq`GZ`v?Pzo6O@hdT8fOm^*Skx92j>LZCQ*=nm-CYLzQM@`=m-D;(;x5L~W!`Z{o8ssFE>C&eY&eO_~K!?34@*Zinr*I6sQ z!P0xWBdIHimKOBJvi>1+5mNdQI3P2H7GGf81>hi~)5oX~7MrczN8fs#wlNt~%Yb5_ z_C*awQD{v54A`0XK9@$t=O1?w6rWaTtAPJ6JZ&MOWx;4+(M8_Cna+6gA{HjKpV{0S zC#l_ymaB+j$p1_vEj~3~8<5D96Yr+|OKAA^NL4K;|B>ef?TceUfmJ>Z?)?{QLI1Rr zp)yW$Ala1T<+K{iw_Oh+>lH#U=UG_amBV(qoAM!uiB{|e5H+U^M_fXJv5igJSbTpZ z;?jmE=CjGGBuGspbAQdNbXIzBb^-ctfiOEmfV1E(JWT_peZ$2`^tStS%@WrAb9i5@} zksV^d&cNEkq9~N!=@@AYCAQv8M^EwfNB5<&U2_47`3?zQg$8j?=(}yrjxWUjU10sT z$A$MZ_S9n~Dm+?h-?^3THD9vW|7U5GNB0Nkz*>2b=C3l(g3)5R#oDGY?C9Z5{T=f=w>UoLl-w$ixp>1bA%x#Hle$Ry^~c33w_EY^FaB4p5^$p#ej< z4=qvjPi-hkCf>=fRxlAH&#IM=qH+=$?3T*LS3efx5Hf1d*$B5jB(~M-P1?a7&b(oS z(RmZ3JgAK4dkDg1`$g^AM-+H9+jcShRiHFzT$uYR+-x42J02jeDPC#V8!AHwHJiG_ z5Grz5xdXS_iv|R2wC-}p{9Ql`ww1gQqr;L8u%C^3*bj%rtrkvt=Mhisde%Sj(Gdx5 zk0QS?V1D2Yb&V7;F>zud(C-i;asNvPF1ck84?teEXqV`l#H7s-aw@7y3AKOtGlt*2 zOxrH14Stb!^0n%hmY@gwj#pE^zz*?L+WSYnEl1JY6~vS_8b?;NTZNgT7@E1BfdVS1 z%j7k5(*Em5F`-Xgq&)>|<^xjBT=$*~vz)Ky>G8pP1eSA72rqM2FltTgb{_jO($}}% z2s+V~%zWNXphE(AHG_u7ukCGc$ae^`&XqcOypbXjU;fHPVj$dErKQ#xR`o|`WI)6L zf;^DnoL(vx!xJ|Cu}Cp@&kAa%5>XxFs9kY(xCC8HDl~6121WX^>SKAg`ge3S=+;V# z102Gvkbw9ittM)C7Wk;Ic!2Sbf;4z!R1GQ|Hk6I{*<9+0*%}}nbqb#y$)j%;o>k+b zzEwi_`sB?oG-jh(do?^YRqeb7GddM$!mM?GtvPn@6NLBXwhZb=fb|`e*z>ReRoL@= zy=TTAAdOEBzL>mZ{--fI;hcueG{{G1$?k?5SMHpph1)KwK?1=g`$R73Qse)$>lF{V z>Vh%>^v1WE3GND5%lrAbN&PRh)&ybjrJsl6BAB#Il&ZBXJhvRU$+~E-GmPnvM!Jp7M?^ irbqXf3ppH^>WwUGP#sI64Beoln8!XJbEwI^)X6ed$X$m3