kyle/imladris
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

orion: read-only vmui via nginx allowlist + serve :8429

Browse Source 
VictoriaMetrics stays loopback :8428. nginx :8429 allows GET/POST
to /vmui and query APIs only; import/admin/export/flags 403.
tailscale serve HTTPS 8429. Review, no switch.
This commit is contained in:
kyle
2026-09-24 01:47:25 -07:00
parent 1cbde84601
commit f5ef78baca
1 changed files with 52 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hw/orion/metrics.nix
+52 -1
View File
@@ -1,7 +1,15 @@
# Phase 1 metrics store + alerting. VictoriaMetrics on loopback; scrape # Phase 1 metrics store + alerting. VictoriaMetrics on loopback; scrape
# orion locally and dixie over the tailnet. Do not switch until reviewed. # orion locally and dixie over the tailnet. Do not switch until reviewed.
{ ... }: { pkgs, ... }:
let let
vm = "http://127.0.0.1:8428";
vmuiProxy = {
proxyPass = vm;
extraConfig = ''
limit_except GET POST { deny all; }
'';
};
honchoKeep = "up|deriver_queue_items_pending|deriver_queue_oldest_pending_age_seconds|deriver_queue_work_units_claimed|deriver_queue_work_units_eligible|dialectic_calls.*|db_connections_open|db_queries_in_flight"; honchoKeep = "up|deriver_queue_items_pending|deriver_queue_oldest_pending_age_seconds|deriver_queue_work_units_claimed|deriver_queue_work_units_eligible|dialectic_calls.*|db_connections_open|db_queries_in_flight";
honchoRelabel = [ honchoRelabel = [
{ source_labels = [ "__name__" ]; regex = honchoKeep; action = "keep"; } { source_labels = [ "__name__" ]; regex = honchoKeep; action = "keep"; }
@@ -262,4 +270,47 @@ in
]; ];
}; };
}; };
# Read-only vmui: path-allowlist on loopback, then tailscale serve HTTPS 8429.
# VictoriaMetrics stays 127.0.0.1:8428. Writes/admin/export are 403.
services.nginx = {
enable = true;
recommendedProxySettings = true;
virtualHosts.vmui = {
listen = [
{
addr = "127.0.0.1";
port = 8429;
extraParameters = [ "default_server" ];
}
];
locations = {
"/" = {
extraConfig = "return 403;";
};
"/vmui" = vmuiProxy;
"= /api/v1/query" = vmuiProxy;
"= /api/v1/query_range" = vmuiProxy;
"= /api/v1/series" = vmuiProxy;
"= /api/v1/labels" = vmuiProxy;
"~ ^/api/v1/label/[^/]+/values$" = vmuiProxy;
"= /api/v1/metadata" = vmuiProxy;
"/api/v1/status" = vmuiProxy;
};
};
};
systemd.services.tailscale-serve-vmui = {
description = "Advertise read-only vmui on Tailscale Serve :8429";
after = [ "tailscaled.service" "network-online.target" "nginx.service" ];
wants = [ "tailscaled.service" "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
Restart = "on-failure";
RestartSec = "5s";
ExecStart = "${pkgs.tailscale}/bin/tailscale serve --bg --yes --https=8429 http://127.0.0.1:8429";
};
};
} }