Configure NetBox

This commit is contained in:
June 2023-09-14 23:52:20 +02:00
parent e0c7180ecf
commit 2e3e8c7031
6 changed files with 121 additions and 1 deletions

View file

@ -0,0 +1,7 @@
{ config, pkgs, ... }:
{
networking.hostName = "netbox";
system.stateVersion = "23.05";
}

View file

@ -0,0 +1,9 @@
{ config, pkgs, ... }:
{
imports = [
./configuration.nix
./netbox.nix
./nginx.nix
];
}

View file

@ -0,0 +1,29 @@
# Sources for this configuration:
# - https://docs.netbox.dev/en/stable/configuration/
# - https://colmena.cli.rs/unstable/features/keys.html
# - https://colmena.cli.rs/unstable/reference/deployment.html
# - https://git.grzb.de/yuri/nix-infra/-/blob/33f2d9e324c2e3a8b1b41c20bce239001bcce9fc/hosts/netbox/secrets.nix
{ config, pkgs, ... }:
{
services.netbox = {
enable = true;
secretKeyFile = "/secrets/netbox-secret-key.secret";
settings = {
ALLOWED_HOSTS = [ "netbox.ccchh.net" "10.31.208.29" ];
SESSION_COOKIE_SECURE = true;
};
};
deployment.keys."netbox-secret-key.secret" = {
keyCommand = [ "env" "pass" "noc/vm-secrets/z9/netbox/netbox_secret_key" ];
destDir = "/secrets";
user = "netbox";
group = "netbox";
permissions = "0440";
uploadAt = "pre-activation";
};
}

View file

@ -0,0 +1,61 @@
# Sources for this configuration:
# - https://nixos.org/manual/nixos/stable/#module-security-acme
# - https://git.grzb.de/yuri/nix-infra/-/blob/33f2d9e324c2e3a8b1b41c20bce239001bcce9fc/hosts/netbox/nginx.nix
# - https://docs.netbox.dev/en/stable/installation/5-http-server/
# - https://github.com/netbox-community/netbox/blob/v3.5.9/contrib/nginx.conf
{ config, pkgs, ... }:
{
services.nginx = {
enable = true;
# So nginx can access the Netbox static files.
user = "netbox";
virtualHosts."acme-netbox.ccchh.net" = {
default = true;
enableACME = true;
serverName = "netbox.ccchh.net";
listen = [
{
addr = "0.0.0.0";
port = 31820;
}
];
};
virtualHosts."netbox.ccchh.net" = {
default = true;
forceSSL = true;
useACMEHost = "netbox.ccchh.net";
listen = [
{
addr = "0.0.0.0";
port = 80;
}
{
addr = "0.0.0.0";
port = 443;
ssl = true;
}
];
locations."/static/" = {
alias = "${config.services.netbox.dataDir}/static/";
};
locations."/" = {
proxyPass = "http://${config.services.netbox.listenAddress}:${builtins.toString config.services.netbox.port}";
};
extraConfig = ''
client_max_body_size 25m;
'';
};
};
networking.firewall.allowedTCPPorts = [ 80 443 31820 ];
networking.firewall.allowedUDPPorts = [ 443 ];
}

View file

@ -24,7 +24,7 @@
services.nginx.appendHttpConfig = '' services.nginx.appendHttpConfig = ''
map $host $upstream_acme_challenge_host { map $host $upstream_acme_challenge_host {
club-assistant.ccchh.net 10.31.208.10; club-assistant.ccchh.net 10.31.208.10;
netbox.ccchh.net 10.31.208.29; netbox.ccchh.net 10.31.208.29:31820;
light.ccchh.net 10.31.208.23; light.ccchh.net 10.31.208.23;
thinkcccore0.ccchh.net 10.31.242.3; thinkcccore0.ccchh.net 10.31.242.3;
thinkcccore1.ccchh.net 10.31.242.4; thinkcccore1.ccchh.net 10.31.242.4;

View file

@ -62,6 +62,20 @@
./config/hosts/public-reverse-proxy ./config/hosts/public-reverse-proxy
]; ];
}; };
netbox = {
deployment = {
targetHost = "netbox.z9.ccchh.net";
targetPort = 22;
targetUser = "colmena-deploy";
tags = [ "thinkcccluster" ];
};
imports = [
./config/common
./config/proxmox-vm
./config/hosts/netbox
];
};
}; };
packages.x86_64-linux = { packages.x86_64-linux = {