modules/monitoring.nix

@@ -53,20 +53,38 @@ with pkgs;
         enabledCollectors = [ "systemd" ];
         port = 9002;
       };
+      zfs.enable = true;
+      wireguard.enable = true;
       postgres.enable = true;
       smartctl.enable = true;
+      dnsmasq.enable = true;
+      nginx = {
+        enable = true;
+        scrapeUri = "http://localhost:8282/nginx_status";
+      };
     };
     scrapeConfigs = [{
       job_name = "zion";
       static_configs = [{
         targets = [
           "localhost:${toString config.services.prometheus.exporters.node.port}"
+          "localhost:${toString config.services.prometheus.exporters.zfs.port}"
+          "localhost:${
+            toString config.services.prometheus.exporters.wireguard.port
+          }"
           "localhost:${
             toString config.services.prometheus.exporters.postgres.port
           }"
           "localhost:${
             toString config.services.prometheus.exporters.smartctl.port
           }"
+          "localhost:${
+            toString config.services.prometheus.exporters.dnsmasq.port
+          }"
+          "localhost:${
+            toString config.services.prometheus.exporters.nginx.port
+          }"
+          "localhost:9641"
         ];
       }];
     }];

modules/networking.nix

@@ -108,7 +108,7 @@ in {
       local-ttl = 300;
 
       conf-file = "${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf";
-      dnssec = false;
+      dnssec = true;
 
       address = "/coolneng.duckdns.org/192.168.13.2";
     };
@@ -129,8 +129,6 @@ in {
         minisign_key =
           "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
       };
-      blocked_names.blocked_names_file =
-        "/var/lib/dnscrypt-proxy/blocklist.txt";
     };
   };
 

modules/periodic.nix

@@ -1,8 +1,8 @@
 { config, lib, pkgs, ... }:
 
 let
-  stateDir = "/var/lib/dnscrypt-proxy";
-  blocklist = "${stateDir}/blocklist.txt";
+  stateDir = "/var/lib/dnsmasq";
+  blocklist = "${stateDir}/dnsmasq.blacklist.txt";
 
 in {
   # PostgreSQL daily backups
@@ -20,9 +20,13 @@ in {
     wantedBy = [ "default.target" ];
     path = with pkgs; [ curl coreutils ];
     script = ''
-      curl -L https://download.dnscrypt.info/blacklists/domains/mybase.txt -o ${blocklist}
+      curl -L https://github.com/notracking/hosts-blocklists/raw/master/dnsmasq/dnsmasq.blacklist.txt -o ${blocklist}
+      sed "/cainiao/d" -i ${blocklist}
     '';
     serviceConfig.Type = "oneshot";
+    postStop = ''
+      chown -R dnsmasq ${stateDir}
+    '';
     startAt = "02:00:00";
   };
 

modules/webstack.nix

@@ -159,6 +159,18 @@
           proxyWebsockets = true;
         };
       };
+      "/nginx_status/" = {
+        listen = [{
+          addr = "127.0.0.1";
+          port = 8282;
+        }];
+        extraConfig = ''
+          stub_status on;
+          access_log   off;
+          allow 127.0.0.1;
+          deny all;
+        '';
+      };
       "nightscout.coolneng.duckdns.org" = {
         enableACME = true;
         forceSSL = true;