googlebot
f2f5761c83
All checks were successful
Check Flake / check-flake (push) Successful in 3m15s
Replace the single VPN container (veth pair, host-side auth scripts) with a multi-container setup on a shared bridge network: - Dedicated VPN container handles all PIA auth, WireGuard config, NAT, and optional port forwarding DNAT - Service containers default-route through VPN container (leak-proof by topology) - Host runs tinyproxy on bridge for PIA API bootstrap before WG is up - WG interface is still created in host netns and moved into VPN container namespace - Monthly renewal to ensure that connection stays up (PIA allows connections to last up to 2 months) - Drop OpenVPN support entirely
65 lines
1.9 KiB
Nix
65 lines
1.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
cfg = config.ntfy-alerts;
|
|
in
|
|
{
|
|
options.ntfy-alerts = {
|
|
serverUrl = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "https://ntfy.neet.dev";
|
|
description = "Base URL of the ntfy server.";
|
|
};
|
|
|
|
topic = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "service-failures";
|
|
description = "ntfy topic to publish alerts to.";
|
|
};
|
|
|
|
curlExtraArgs = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "";
|
|
description = "Extra arguments to pass to curl (e.g. --proxy http://host:port).";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf config.thisMachine.hasRole."ntfy" {
|
|
age.secrets.ntfy-token.file = ../secrets/ntfy-token.age;
|
|
|
|
systemd.services."ntfy-failure@" = {
|
|
description = "Send ntfy alert for failed unit %i";
|
|
wants = [ "network-online.target" ];
|
|
after = [ "network-online.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
EnvironmentFile = "/run/agenix/ntfy-token";
|
|
ExecStart = "${pkgs.writeShellScript "ntfy-failure-notify" ''
|
|
unit="$1"
|
|
${lib.getExe pkgs.curl} \
|
|
--fail --silent --show-error \
|
|
--max-time 30 --retry 3 \
|
|
${cfg.curlExtraArgs} \
|
|
-H "Authorization: Bearer $NTFY_TOKEN" \
|
|
-H "Title: Service failure on ${config.networking.hostName}" \
|
|
-H "Priority: high" \
|
|
-H "Tags: rotating_light" \
|
|
-d "Unit $unit failed at $(date +%c)" \
|
|
"${cfg.serverUrl}/${cfg.topic}"
|
|
''} %i";
|
|
};
|
|
};
|
|
|
|
# Apply OnFailure to all services via a systemd drop-in
|
|
systemd.packages = [
|
|
(pkgs.runCommand "ntfy-on-failure-dropin" { } ''
|
|
mkdir -p $out/lib/systemd/system/service.d
|
|
cat > $out/lib/systemd/system/service.d/ntfy-on-failure.conf <<'EOF'
|
|
[Unit]
|
|
OnFailure=ntfy-failure@%p.service
|
|
EOF
|
|
'')
|
|
];
|
|
};
|
|
}
|