From 2df2bddaeec1bff9900f64ac7b4b9da5e6a8a051 Mon Sep 17 00:00:00 2001 From: coolneng Date: Wed, 24 May 2023 14:15:15 +0200 Subject: [PATCH] Set up CGM repository --- configuration.nix | 5 +++++ modules/containers.nix | 22 ++++++++++++++++++++++ modules/periodic.nix | 2 ++ modules/webstack.nix | 10 ++++++++++ scripts/motd.sh | 1 + secrets/nightscout.age | 7 +++++++ secrets/secrets.nix | 1 + 7 files changed, 48 insertions(+) create mode 100644 secrets/nightscout.age diff --git a/configuration.nix b/configuration.nix index c05351e..6d63fec 100644 --- a/configuration.nix +++ b/configuration.nix @@ -161,6 +161,11 @@ with pkgs; owner = "mosquitto"; group = "mosquitto"; }; + secrets.nightscout = { + file = secrets/nightscout.age; + owner = "coolneng"; + group = "podman"; + }; identityPaths = [ "/etc/ssh/id_ed25519" ]; }; diff --git a/modules/containers.nix b/modules/containers.nix index 431cc70..e8e36e9 100644 --- a/modules/containers.nix +++ b/modules/containers.nix @@ -27,7 +27,29 @@ ports = [ "127.0.0.1:9641:9641" ]; volumes = [ "/vault/mqtt2prometheus/config.yaml:/config.yaml" ]; }; + # CGM repository + nightscout = { + image = "nightscout/cgm-remote-monitor@sha256:ce522a9fe9b1373f576329e48349a622c8a9b6177c93dc2771152df36dd90876"; + environmentFiles = [ config.age.secrets.nightscout.path ]; + extraOptions = ["--pod=cgm-repo"]; + dependsOn = [ "mongodb" ]; + }; + # CGM repository database + mongodb = { + image = "mongo:4.4.9@sha256:0837a92d01bcc8c750a8d692ed4df33f0befd07ef261b23e7d9feda04bacd3eb"; + volumes = ["/vault/mongodb:/data/db"]; + extraOptions = ["--pod=cgm-repo"]; + }; }; }; }; + + # Allow networking between Cgm-Repo and MongoDB + systemd.services.create-cgm-repo-pod = { + serviceConfig.Type = "oneshot"; + wantedBy = [ "podman-mongodb.service" ]; + script = with pkgs; '' + ${podman}/bin/podman pod exists cgm-repo || ${podman}/bin/podman pod create -n cgm-repo -p '127.0.0.1:1337:1337' + ''; + }; } diff --git a/modules/periodic.nix b/modules/periodic.nix index 04fc06e..a5aadd8 100644 --- a/modules/periodic.nix +++ b/modules/periodic.nix @@ -63,6 +63,8 @@ in { systemctl restart gitea systemctl restart podman-openbooks systemctl restart podman-mqtt2prometheus + systemctl restart podman-mongodb + systemctl restart podman-nightscout ''; serviceConfig.Type = "oneshot"; requires = [ "sata-hat.service" ]; diff --git a/modules/webstack.nix b/modules/webstack.nix index 9e9e835..ddc4a98 100644 --- a/modules/webstack.nix +++ b/modules/webstack.nix @@ -170,6 +170,16 @@ deny all; ''; }; + "nightscout.coolneng.duckdns.org" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://localhost:1337"; + extraConfig = '' + proxy_set_header X-Forwarded-For $remote_addr; + ''; + }; + }; }; }; diff --git a/scripts/motd.sh b/scripts/motd.sh index 22e7311..bb2a38b 100755 --- a/scripts/motd.sh +++ b/scripts/motd.sh @@ -37,6 +37,7 @@ services=( "podman-mqtt2prometheus.service" "prometheus.service" "grafana.service" + "podman-nightscout.service" ) for var in "${services[@]}"; do diff --git a/secrets/nightscout.age b/secrets/nightscout.age new file mode 100644 index 0000000..ebf62fd --- /dev/null +++ b/secrets/nightscout.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 iUaRGg NZSMxPHyuZano1tMkjZzhPEfnBwWwOtDTooV867g3Qw +Ssp5a60zPbHr77RfbvQdKFNzLaq/fBZin1Rct8Zw2jQ +-> #~O6EL*-grease I?m(Z\ aUDPI+ +QcXMNHYJv2PQRY77oASq/8x3L9hv5m6a+Hd36ok +--- tAdv5iia1ggSTOAF3Wnt+GKK1ulw1FO1FqVSU+cT5MQ +}/ITiU.-npo$E8۬jpEoP ❚ej<66g:W,bծ8ofG I ΢Z}B[F|SמХPw]ǽfZd'nv͇P12μ$_?*9y'n \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 3136522..63fee05 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -14,4 +14,5 @@ in { "telegram.age".publicKeys = [ zion ]; "mqtt-sender.age".publicKeys = [ zion ]; "mqtt-receiver.age".publicKeys = [ zion ]; + "nightscout.age".publicKeys = [ zion ]; }