feat: add HAProxy log ingestion server

- Introduced a new Rust-based service for ingesting HAProxy logs, including the necessary database schema and API endpoints.
- Implemented database interactions for managing source status, inserting events, and handling ingestion batches.
- Added validation for incoming log batches to ensure data integrity.
- Configured systemd service for the HAProxy ingestion server with appropriate security settings.
- Updated firewall rules to allow traffic on the ingestion server's port (8444).
- Created necessary PostgreSQL database and user configurations for the ingestion service.

systems/jeeves/networking/firewall.nix

@@ -6,6 +6,7 @@ let
     gitea_http = 6443;
     gitea_ssh = 2223;
     grafana = 3000;
+    haproxy_ingest = 8444;
     jellyfin_http = 8096;
     jellyswarrm = 3100;
     nix_binary_cache = 5000;
@@ -26,6 +27,7 @@ in
     interfaces.tailscale0.allowedTCPPorts = [
       ports.audiobookshelf
       ports.gems
+      ports.haproxy_ingest
       ports.jellyfin_http
       ports.jellyswarrm
       ports.nix_binary_cache

systems/jeeves/services/haproxy_ingest.nix

@@ -0,0 +1,82 @@
+{
+  pkgs,
+  ...
+}:
+let
+  vars = import ../vars.nix;
+  haproxy_ingest_server = pkgs.callPackage ../../../rust/haproxy_ingest_server/package.nix { };
+in
+{
+  users = {
+    groups.haproxy-ingest = { };
+    users.haproxy-ingest = {
+      isSystemUser = true;
+      group = "haproxy-ingest";
+    };
+  };
+
+  systemd = {
+    services = {
+      haproxy-ingest-server = {
+        description = "HAProxy log ingestion API";
+        documentation = [ "file://${../../../rust/haproxy_ingest_proto/README.md}" ];
+        wantedBy = [ "multi-user.target" ];
+        after = [
+          "network-online.target"
+          "postgresql.service"
+          "tailscaled-autoconnect.service"
+        ];
+        wants = [
+          "network-online.target"
+          "postgresql.service"
+          "tailscaled-autoconnect.service"
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = "haproxy-ingest";
+          Group = "haproxy-ingest";
+          ExecStart = "${haproxy_ingest_server}/bin/haproxy-ingest-server";
+          Environment = [
+            "HAPROXY_INGEST_DATABASE_URL=postgres://haproxy_ingest@localhost/haproxy_ingest?host=/run/postgresql&sslmode=disable"
+            "HAPROXY_INGEST_LISTEN=0.0.0.0:8444"
+            "RUST_LOG=info,tower_http=warn"
+          ];
+          EnvironmentFile = "${vars.secrets}/services/haproxy-ingest-server";
+          Restart = "on-failure";
+          RestartSec = "5s";
+
+          CapabilityBoundingSet = [ "" ];
+          DeviceAllow = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+      };
+    };
+  };
+}

systems/jeeves/services/postgress.nix

@@ -36,6 +36,9 @@ in
       # signalbot
       local signalbot  signalbot   trust
 
+      # HAProxy cloud log ingestion API
+      local haproxy_ingest haproxy_ingest trust
+
       # math
       local postgres  math   trust
       host  postgres  math   127.0.0.1/32    trust
@@ -97,6 +100,13 @@ in
           replication = true;
         };
       }
+      {
+        name = "haproxy_ingest";
+        ensureDBOwnership = true;
+        ensureClauses = {
+          login = true;
+        };
+      }
       {
         name = "signalbot";
         ensureDBOwnership = true;
@@ -108,6 +118,7 @@ in
     ensureDatabases = [
       "data_science_dev"
       "gitea"
+      "haproxy_ingest"
       "math"
       "n8n"
       "richie"