104 lines
2.9 KiB
Nix
104 lines
2.9 KiB
Nix
{ pkgs, ... }:
|
|
let
|
|
haproxy_log_shipper = pkgs.callPackage ../../../rust/haproxy_log_shipper/package.nix { };
|
|
endpoint = "http://jeeves.taile39c31.ts.net:8444";
|
|
environment_file = "/var/lib/haproxy-log-shipper/environment";
|
|
in
|
|
{
|
|
services.journald.settings.Journal = {
|
|
Storage = "persistent";
|
|
SystemMaxUse = "512M";
|
|
MaxRetentionSec = "14day";
|
|
};
|
|
|
|
users = {
|
|
groups.haproxy-log-shipper = { };
|
|
users.haproxy-log-shipper = {
|
|
isSystemUser = true;
|
|
group = "haproxy-log-shipper";
|
|
extraGroups = [ "systemd-journal" ];
|
|
};
|
|
};
|
|
|
|
systemd = {
|
|
services = {
|
|
haproxy = {
|
|
serviceConfig = {
|
|
StandardOutput = "journal";
|
|
StandardError = "journal";
|
|
};
|
|
};
|
|
|
|
haproxy-log-shipper = {
|
|
description = "Ship ordered HAProxy journal logs to Jeeves";
|
|
documentation = [ "file://${../../../rust/haproxy_ingest_proto/README.md}" ];
|
|
after = [
|
|
"network-online.target"
|
|
"tailscaled-autoconnect.service"
|
|
];
|
|
wants = [
|
|
"network-online.target"
|
|
"tailscaled-autoconnect.service"
|
|
];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "haproxy-log-shipper";
|
|
Group = "haproxy-log-shipper";
|
|
SupplementaryGroups = [ "systemd-journal" ];
|
|
ExecStart = "${haproxy_log_shipper}/bin/haproxy-log-shipper";
|
|
Environment = [
|
|
"HAPROXY_INGEST_ENDPOINT=${endpoint}"
|
|
"RUST_LOG=info"
|
|
];
|
|
EnvironmentFile = environment_file;
|
|
|
|
CapabilityBoundingSet = [ "" ];
|
|
DeviceAllow = [ "" ];
|
|
LockPersonality = true;
|
|
MemoryDenyWriteExecute = true;
|
|
NoNewPrivileges = true;
|
|
PrivateDevices = true;
|
|
PrivateTmp = true;
|
|
ProtectClock = true;
|
|
ProtectControlGroups = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectSystem = "strict";
|
|
RemoveIPC = true;
|
|
RestrictAddressFamilies = [
|
|
"AF_INET"
|
|
"AF_UNIX"
|
|
];
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
SystemCallFilter = [
|
|
"@system-service"
|
|
"~@privileged"
|
|
];
|
|
UMask = "0077";
|
|
};
|
|
};
|
|
};
|
|
|
|
timers.haproxy-log-shipper = {
|
|
description = "Run the HAProxy log shipper after each completed catch-up cycle";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "30s";
|
|
OnUnitInactiveSec = "60s";
|
|
Unit = "haproxy-log-shipper.service";
|
|
};
|
|
};
|
|
|
|
tmpfiles.rules = [
|
|
"d /var/lib/haproxy-log-shipper 0755 root root - -"
|
|
];
|
|
};
|
|
}
|