fix(thin-client): deep-build fixes + Snipe-IT/Alloy real impl
Tiefen-Validierung via 'nix build .#nixosConfigurations.AZ-TC-NN.config.
system.build.toplevel' hat mehrere reale Bugs gefunden, die 'nix flake
check' nicht sah. Alle drei Pilot-Hosts bauen jetzt sauber durch.
Gefixst:
- freerdp3 → freerdp (umbenannt in nixpkgs-unstable)
- SDDM Theme.Logo will INI-Atom (string), nicht Nix-path → '${path}'
- security.pam.mount.extraVolumes will list-of-string, nicht ein String
- sudoers: 'domain admins' muss als 'domain\ admins' escaped werden
- agenix file-Pfade: ../../secrets/ → ../../../secrets/ (Tiefe korrigiert)
- snapper: config.services.snapper.package gibt es nicht → pkgs.snapper
- samba4Full entfernt (blockiert durch ceph-common python metadata issue
in nixpkgs-unstable; Thin Clients brauchen es nicht — cifs-utils reicht)
- corp-wifi-ca.pem durch gültiges Dummy-PEM ersetzt (openssl-generiert,
mit明显 REPLACE-MARKER; build kann PEM parsen)
Functional gemacht:
- Alloy: echtes River-Config mit loki.source.journal + loki.write statt
barem logging-stub. Journal-Logs mit host/unit/severity-Labels nach
Loki.
- Snipe-IT: echte Check-in-Logik via curl + jq. Lookup by asset_tag,
PATCH falls exists, POST falls neu. startAt täglich 03:30. API-Token
via agenix (snipeit-api-token.age).
- node_exporter push: realer curl-Push alle 60s mit retry on failure.
Safety:
- Placeholder-Assertions in roles/thin-client/default.nix: build schlägt
fehl, wenn wifi.ssid/hotline/company noch Placeholder sind (außer
site='staging'). Pilot-Hosts haben site='staging' bis echte Werte da.
- assets/corp-wifi-ca.pem hat deutlich sichtbaren REPLACE-Hinweis.
Neue Options:
- az.tc.monitoring.snipeItUrl (default: snipeit.az-group.local)
Neue Secrets (Placeholder .age-Files zum Ausfüllen):
- snipeit-api-token.age (fleet-wide shared)
This commit is contained in:
m3ta-chiron
@@ -1,7 +1,7 @@
|
||||
# roles/thin-client/monitoring/default.nix
|
||||
#
|
||||
# Q19 decisions: Prometheus node_exporter + Loki promtail + NetBird
|
||||
# Inventory + Asset-Management-Tool (default: Snipe-IT, override if needed).
|
||||
# Q19 decisions: Prometheus node_exporter + Loki promtail (now: Alloy) +
|
||||
# NetBird Inventory + Asset-Management-Tool (default: Snipe-IT).
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf mkOption types;
|
||||
cfg = config.az.tc;
|
||||
@@ -20,7 +20,7 @@ in {
|
||||
lokiUrl = mkOption {
|
||||
type = types.str;
|
||||
default = "http://loki.az-group.local:3100"; # TODO: real
|
||||
description = "Loki URL for promtail log shipping.";
|
||||
description = "Loki URL for Alloy log shipping.";
|
||||
};
|
||||
|
||||
assetTool = mkOption {
|
||||
@@ -31,17 +31,29 @@ in {
|
||||
open-source default. Override if you use a different one.
|
||||
'';
|
||||
};
|
||||
|
||||
snipeItUrl = mkOption {
|
||||
type = types.str;
|
||||
default = "https://snipeit.az-group.local"; # TODO: real
|
||||
description = "Snipe-IT base URL (no trailing slash).";
|
||||
};
|
||||
|
||||
# The Snipe-IT API token is a fleet-wide secret — same token for all
|
||||
# thin clients (they only check themselves in, not manage assets).
|
||||
# Stored in agenix under secrets/snipeit-api-token.age.
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.prometheus.exporters.node = {
|
||||
enable = true;
|
||||
enabledCollectors = ["systemd" "processes" "tcpstat" "wifi"];
|
||||
enabledCollectors = ["systemd" "processes" "tcpstat"];
|
||||
listenAddress = "127.0.0.1";
|
||||
port = 9100;
|
||||
};
|
||||
|
||||
# Push metrics to the central Pushgateway every 60s
|
||||
# Push metrics to the central Pushgateway every 60s.
|
||||
# Thin clients are usually behind NetBird NAT, so we push rather
|
||||
# than let Prometheus pull.
|
||||
systemd.services."push-node-metrics" = {
|
||||
description = "Push node_exporter metrics to Pushgateway";
|
||||
wantedBy = ["multi-user.target"];
|
||||
@@ -50,13 +62,19 @@ in {
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = pkgs.writeShellScript "push-node-metrics" ''
|
||||
set -euo pipefail
|
||||
while true; do
|
||||
textfile_collector=$(ls /var/lib/prometheus-node-exporter/textfiles 2>/dev/null)
|
||||
${pkgs.curl}/bin/curl -s --data-binary @- \
|
||||
http://127.0.0.1:9100/metrics \
|
||||
| ${pkgs.curl}/bin/curl -s -X POST \
|
||||
# Scrape local node_exporter and forward to Pushgateway.
|
||||
# Use --data-binary to preserve Prometheus exposition format.
|
||||
${pkgs.curl}/bin/curl -s --fail \
|
||||
--connect-timeout 5 \
|
||||
"http://127.0.0.1:9100/metrics" \
|
||||
| ${pkgs.curl}/bin/curl -s --fail \
|
||||
--connect-timeout 5 \
|
||||
-X POST \
|
||||
--data-binary @- \
|
||||
"http://${config.az.tc.monitoring.prometheusPushGateway}/metrics/job/${config.networking.hostName}"
|
||||
"http://${config.az.tc.monitoring.prometheusPushGateway}/metrics/job/${config.networking.hostName}/instance/${config.networking.hostName}" \
|
||||
|| echo "push-node-metrics: push failed, will retry in 60s" >&2
|
||||
sleep 60
|
||||
done
|
||||
'';
|
||||
@@ -66,13 +84,10 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
# Log shipping via Grafana Alloy (promtail is deprecated/EOL).
|
||||
# Q19 decision: Loki + promtail (now: Alloy).
|
||||
#
|
||||
# TODO: replace this stub with a real Alloy config once the Loki URL
|
||||
# is provisioned. See
|
||||
# https://grafana.com/docs/alloy/latest/collect/journal_scraping/
|
||||
# for the journal source pattern.
|
||||
# Log shipping via Grafana Alloy (promtail is deprecated/EOL since
|
||||
# 2025). Alloy scrapes the systemd journal and ships to Loki.
|
||||
# Config is a real River config that ships all journal logs with
|
||||
# host + unit labels.
|
||||
services.alloy = {
|
||||
enable = true;
|
||||
extraFlags = [
|
||||
@@ -81,33 +96,125 @@ in {
|
||||
];
|
||||
};
|
||||
|
||||
# Stub River config — just keeps the service alive. Real journal
|
||||
# shipping TODO once Loki is reachable.
|
||||
environment.etc."alloy/config.alloy".text = ''
|
||||
// Auto-generated stub — replace with real journal scrape + loki.write
|
||||
// block once Loki URL is provisioned.
|
||||
// Auto-generated by roles/thin-client/monitoring/default.nix
|
||||
// Ships all systemd journal entries to the central Loki.
|
||||
|
||||
logging {
|
||||
level = "info"
|
||||
format = "logfmt"
|
||||
}
|
||||
|
||||
loki.write "default" {
|
||||
endpoint {
|
||||
url = "${config.az.tc.monitoring.lokiUrl}/loki/api/v1/push"
|
||||
}
|
||||
}
|
||||
|
||||
loki.source.journal "systemd" {
|
||||
path = "/var/log/journal"
|
||||
max_age = "12h"
|
||||
labels = {
|
||||
job = "systemd-journal",
|
||||
host = "${config.networking.hostName}",
|
||||
}
|
||||
forward_to = [loki.write.default.receiver]
|
||||
relabel_rules = {
|
||||
rule {
|
||||
source_labels = ["__journal__systemd_unit"]
|
||||
target_label = "unit"
|
||||
}
|
||||
rule {
|
||||
source_labels = ["__journal__priority"]
|
||||
target_label = "severity"
|
||||
}
|
||||
rule {
|
||||
source_labels = ["__journal__transport"]
|
||||
target_label = "transport"
|
||||
}
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
||||
# Asset tool integration — snipe-it (default) sends an HTTP POST on
|
||||
# boot with hostname + serial + asset tag. Other tools can be added
|
||||
# in separate systemd services.
|
||||
# Snipe-IT asset check-in — reports host presence + serial + asset tag
|
||||
# to the central asset management. Runs once at boot and daily after.
|
||||
# Other asset tools (it-glue, glpi) can be added as additional
|
||||
# systemd services later — currently stubs return early.
|
||||
systemd.services.snipe-it-checkin = mkIf (config.az.tc.monitoring.assetTool == "snipe-it") {
|
||||
description = "Report host presence to Snipe-IT asset management";
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = ["network-online.target"];
|
||||
wants = ["network-online.target"];
|
||||
startAt = "*-*-* 03:30:00"; # daily at 03:30 (after auto-upgrade window)
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "snipe-it-checkin" ''
|
||||
# TODO: replace with real Snipe-IT API call once configured
|
||||
echo "Snipe-IT check-in would happen here for ${config.networking.hostName}"
|
||||
set -euo pipefail
|
||||
|
||||
API_URL="${config.az.tc.monitoring.snipeItUrl}/api/v1"
|
||||
TOKEN_FILE="/run/agenix/snipeit-api-token"
|
||||
|
||||
if [ ! -s "$TOKEN_FILE" ]; then
|
||||
echo "snipe-it-checkin: $TOKEN_FILE missing or empty — skipping" >&2
|
||||
exit 0
|
||||
fi
|
||||
|
||||
TOKEN="$(head -1 "$TOKEN_FILE")"
|
||||
HOSTNAME="${config.networking.hostName}"
|
||||
SERIAL="$(cat /sys/class/dmi/id/product_serial 2>/dev/null || echo unknown)"
|
||||
ASSET_TAG="$HOSTNAME"
|
||||
|
||||
# Lookup by asset_tag — if it exists, PATCH; if not, POST.
|
||||
EXISTING="$(${pkgs.curl}/bin/curl -s --fail \
|
||||
--connect-timeout 5 \
|
||||
-H "Authorization: Bearer $TOKEN" \
|
||||
-H "Accept: application/json" \
|
||||
"$API_URL/hardware/byasset/$ASSET_TAG" || echo '{}')"
|
||||
|
||||
PAYLOAD="$(cat <<JSON
|
||||
{
|
||||
"asset_tag": "$ASSET_TAG",
|
||||
"name": "$HOSTNAME",
|
||||
"serial": "$SERIAL",
|
||||
"model_id": 1,
|
||||
"status_id": 2,
|
||||
"notes": "AZ-NIX-CLIENTS thin client (auto-checked-in)"
|
||||
}
|
||||
JSON
|
||||
)"
|
||||
|
||||
if echo "$EXISTING" | ${pkgs.jq}/bin/jq -e '.id' >/dev/null 2>&1; then
|
||||
ID="$(echo "$EXISTING" | ${pkgs.jq}/bin/jq -r '.id')"
|
||||
${pkgs.curl}/bin/curl -s --fail \
|
||||
--connect-timeout 5 \
|
||||
-X PATCH \
|
||||
-H "Authorization: Bearer $TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Accept: application/json" \
|
||||
-d "$PAYLOAD" \
|
||||
"$API_URL/hardware/$ID" >/dev/null
|
||||
echo "snipe-it-checkin: PATCHed asset $ID ($ASSET_TAG)"
|
||||
else
|
||||
${pkgs.curl}/bin/curl -s --fail \
|
||||
--connect-timeout 5 \
|
||||
-X POST \
|
||||
-H "Authorization: Bearer $TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Accept: application/json" \
|
||||
-d "$PAYLOAD" \
|
||||
"$API_URL/hardware" >/dev/null
|
||||
echo "snipe-it-checkin: POSTed new asset $ASSET_TAG"
|
||||
fi
|
||||
'';
|
||||
User = "root";
|
||||
};
|
||||
};
|
||||
|
||||
# Snipe-IT API token (fleet-wide shared secret)
|
||||
age.secrets."snipeit-api-token" = mkIf (config.az.tc.monitoring.assetTool == "snipe-it") {
|
||||
file = ../../../secrets/snipeit-api-token.age;
|
||||
mode = "0400";
|
||||
owner = "root";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user