flake.nix

@@ -133,6 +133,7 @@
                 usersPath = ./users;
                 hostsPath = ./hosts;
                 packagesPath = ./packages;
+                sharedPath = ./shared;
               } // specialArgs;
 
               modules =

hosts/istal/services/prometheus.nix

@@ -1,17 +1,5 @@
-{ config, ... }:
+{ sharedPath, ... }:
 
 {
-  services.prometheus.exporters.node = {
-    enable = true;
-    port = 40000;
-    # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/monitoring/prometheus/exporters.nix
-    enabledCollectors = [ "systemd" ];
-    # /nix/store/zgsw0yx18v10xa58psanfabmg95nl2bb-node_exporter-1.8.1/bin/node_exporter  --help
-    extraFlags = [ "--collector.ethtool" "--collector.softirqs" "--collector.tcpstat" "--collector.wifi" ];
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    config.services.prometheus.exporters.node.port
-  ];
-
+  imports = [ (sharedPath + "/prometheus/node.nix") ];
 }

hosts/tatos/services/default.nix

@@ -8,5 +8,7 @@
     ./dns.nix
     ./grafana.nix
     ./prometheus.nix
+    ./loki.nix
+    ./promtail.nix
   ];
 }

hosts/tatos/services/grafana.nix

@@ -17,6 +17,26 @@ in
         inherit domain;
       };
     };
+    provision = {
+      enable = true;
+      datasources.settings = {
+        datasources =
+          [
+            {
+              name = "Prometheus";
+              type = "prometheus";
+              access = "proxy";
+              url = "http://127.0.0.1:${toString config.services.prometheus.port}";
+            }
+            {
+              name = "Loki";
+              type = "loki";
+              access = "proxy";
+              url = "http://127.0.0.1:${toString config.services.loki.configuration.server.http_listen_port}";
+            }
+          ];
+      };
+    };
   };
 
   services.nginx.virtualHosts."${domain}" = {

hosts/tatos/services/loki.nix

@@ -0,0 +1,85 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.services.loki;
+  nginxCfg = config.services.nginx;
+  basePath = "/var/lib/loki";
+in
+{
+  age.secrets.loki-basicauth = {
+    file = ./loki-basicauth.age;
+    owner = nginxCfg.user;
+    inherit (nginxCfg) group;
+  };
+
+  services.loki = {
+    enable = true;
+    configuration = {
+      auth_enabled = false;
+      server = {
+        http_listen_address = "127.0.0.1";
+        http_listen_port = 3100;
+      };
+      common = {
+        path_prefix = basePath;
+      };
+      ingester = {
+        lifecycler = {
+          address = "127.0.0.1";
+          ring = {
+            kvstore = {
+              store = "inmemory";
+            };
+            replication_factor = 1;
+          };
+        };
+      };
+      compactor = {
+        working_directory = "${basePath}/compactor";
+      };
+      schema_config = {
+        configs = [
+          {
+            from = "2025-02-04";
+            store = "tsdb";
+            object_store = "filesystem";
+            schema = "v13";
+            index = {
+              prefix = "index_";
+              period = "24h";
+            };
+          }
+        ];
+      };
+      storage_config = {
+        filesystem = {
+          directory = "${basePath}/chunks";
+        };
+        tsdb_shipper = {
+          active_index_directory = "${basePath}/tsdb-index";
+          cache_location = "${basePath}/tsdb-cache";
+        };
+      };
+
+      # Лимиты
+      limits_config = {
+        reject_old_samples = true;
+        reject_old_samples_max_age = "168h"; # Максимальный возраст логов (7 дней)
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = lib.mkIf cfg.enable [
+    "d ${basePath} 0755 ${cfg.user} ${cfg.group} -"
+  ];
+
+  services.nginx.virtualHosts."loki.pleshevski.ru" = lib.mkIf cfg.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = let inherit (cfg.configuration.server) http_listen_port http_listen_address; in {
+      proxyPass = "http://${http_listen_address}:${toString http_listen_port}";
+      proxyWebsockets = true;
+      basicAuthFile = config.age.secrets.loki-basicauth.path;
+    };
+  };
+}

hosts/tatos/services/prometheus.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, sharedPath, ... }:
 
 let
   nodeExporterPort = 40000;
@@ -10,26 +10,14 @@ let
   };
 in
 {
+  imports = [ (sharedPath + "/prometheus/node.nix") ];
+
   age.secrets.prometheus-basicauth-password = {
     file = ./prometheus-basicauth-password.age;
     owner = "prometheus";
     group = "prometheus";
   };
 
-  services.prometheus.exporters.node = {
-    enable = true;
-    port = nodeExporterPort;
-    # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/monitoring/prometheus/exporters.nix
-    enabledCollectors = [ "systemd" ];
-    # /nix/store/zgsw0yx18v10xa58psanfabmg95nl2bb-node_exporter-1.8.1/bin/node_exporter  --help
-    extraFlags = [
-      "--collector.ethtool"
-      "--collector.softirqs"
-      "--collector.tcpstat"
-      "--collector.wifi"
-    ];
-  };
-
   # https://wiki.nixos.org/wiki/Prometheus
   # https://nixos.org/manual/nixos/stable/#module-services-prometheus-exporters-configuration
   # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/monitoring/prometheus/default.nix
@@ -41,6 +29,7 @@ in
     scrapeConfigs = [
       {
         job_name = "node_dev";
+        inherit basic_auth;
         static_configs = [
           {
             targets = [

hosts/tatos/services/promtail.nix

@@ -0,0 +1,33 @@
+{ config, ... }:
+
+{
+  services.promtail = {
+    enable = true;
+    configuration = {
+      server = {
+        http_listen_port = 9080;
+        grpc_listen_port = 0;
+      };
+      clients = [
+        { url = "http://127.0.0.1:3100/loki/api/v1/push"; }
+      ];
+      scrape_configs = [
+        {
+          job_name = "journal";
+          journal = {
+            labels = {
+              job = "systemd-journal";
+              host = "${config.networking.hostName}"; # Имя хоста как метка
+            };
+          };
+          relabel_configs = [
+            {
+              source_labels = [ "__journal__systemd_unit" ];
+              target_label = "unit";
+            }
+          ];
+        }
+      ];
+    };
+  };
+}

shared/prometheus/nginx.nix

@@ -0,0 +1,15 @@
+{ ... }:
+
+{
+  imports = [ ./web-config.nix ];
+
+  services.prometheus.exporters.nginx = {
+    enable = true;
+    port = 40001;
+    sslVerify = true;
+    openFirewall = true;
+  };
+
+  services.nginx.statusPage = true;
+
+}

shared/prometheus/node.nix

@@ -0,0 +1,18 @@
+{ ... }:
+
+{
+  imports = [ ./web-config.nix ];
+
+  services.prometheus.exporters.node = {
+    enable = true;
+    port = 40000;
+    openFirewall = true;
+    enabledCollectors = [ "systemd" ];
+    extraFlags = [
+      "--collector.ethtool"
+      "--collector.softirqs"
+      "--collector.tcpstat"
+      "--collector.wifi"
+    ];
+  };
+}

shared/prometheus/web-config.nix

@@ -0,0 +1,17 @@
+{ config, lib, ... }:
+
+let
+  webConfigFileFlag = "--web.config.file=${config.age.secrets.prometheus-web-config.path}";
+  extraFlags = lib.mkAfter [webConfigFileFlag];
+in
+{
+  age.secrets.prometheus-web-config = {
+    file = ./web-config.yml.age;
+    mode = "444";
+  };
+
+  services.prometheus.exporters = {
+    node = { inherit extraFlags; };
+    nginx = { inherit extraFlags; };
+  };
+}