feat: add HAProxy log ingestion server

- Introduced a new Rust-based service for ingesting HAProxy logs, including the necessary database schema and API endpoints.
- Implemented database interactions for managing source status, inserting events, and handling ingestion batches.
- Added validation for incoming log batches to ensure data integrity.
- Configured systemd service for the HAProxy ingestion server with appropriate security settings.
- Updated firewall rules to allow traffic on the ingestion server's port (8444).
- Created necessary PostgreSQL database and user configurations for the ingestion service.

systems/jeeves/services/haproxy_ingest.nix

@@ -0,0 +1,82 @@
+{
+  pkgs,
+  ...
+}:
+let
+  vars = import ../vars.nix;
+  haproxy_ingest_server = pkgs.callPackage ../../../rust/haproxy_ingest_server/package.nix { };
+in
+{
+  users = {
+    groups.haproxy-ingest = { };
+    users.haproxy-ingest = {
+      isSystemUser = true;
+      group = "haproxy-ingest";
+    };
+  };
+
+  systemd = {
+    services = {
+      haproxy-ingest-server = {
+        description = "HAProxy log ingestion API";
+        documentation = [ "file://${../../../rust/haproxy_ingest_proto/README.md}" ];
+        wantedBy = [ "multi-user.target" ];
+        after = [
+          "network-online.target"
+          "postgresql.service"
+          "tailscaled-autoconnect.service"
+        ];
+        wants = [
+          "network-online.target"
+          "postgresql.service"
+          "tailscaled-autoconnect.service"
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = "haproxy-ingest";
+          Group = "haproxy-ingest";
+          ExecStart = "${haproxy_ingest_server}/bin/haproxy-ingest-server";
+          Environment = [
+            "HAPROXY_INGEST_DATABASE_URL=postgres://haproxy_ingest@localhost/haproxy_ingest?host=/run/postgresql&sslmode=disable"
+            "HAPROXY_INGEST_LISTEN=0.0.0.0:8444"
+            "RUST_LOG=info,tower_http=warn"
+          ];
+          EnvironmentFile = "${vars.secrets}/services/haproxy-ingest-server";
+          Restart = "on-failure";
+          RestartSec = "5s";
+
+          CapabilityBoundingSet = [ "" ];
+          DeviceAllow = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+      };
+    };
+  };
+}