Skip to content
This repository was archived by the owner on Sep 14, 2025. It is now read-only.

Commit 145eae9

Browse files
felbingerfelbinger
committed
netbox+monitoring: add descriptions to nixos options
1 parent 9539aaf commit 145eae9

File tree

3 files changed

+166
-80
lines changed

3 files changed

+166
-80
lines changed

‎modules/monitoring/grafana.nix‎

Lines changed: 47 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,71 @@
11
{ config, lib, ... }:
22
{
33
options.secshell.monitoring.grafana = {
4-
internal_port = lib.mkOption { type = lib.types.port; };
4+
internal_port = lib.mkOption {
5+
type = lib.types.port;
6+
description = ''
7+
The local port the service listens on.
8+
'';
9+
};
510
oidc = {
611
domain = lib.mkOption {
712
type = lib.types.str;
813
default = "";
14+
description = ''
15+
The open id connect server used for authentication.
16+
Leave null to disable oidc authentication.
17+
'';
918
};
1019
realm = lib.mkOption {
1120
type = lib.types.str;
1221
default = "main";
22+
description = ''
23+
The realm to use for the open id connect authentication.
24+
'';
1325
};
1426
clientId = lib.mkOption {
1527
type = lib.types.str;
1628
default = config.secshell.monitoring.domains.grafana;
1729
defaultText = "config.secshell.monitoring.domains.grafana";
30+
description = ''
31+
The client id for the open id connect authentication.
32+
'';
1833
};
1934
};
2035
useLocalDatabase = lib.mkOption {
2136
type = lib.types.bool;
2237
default = true;
38+
description = ''
39+
Whether to use a local database instance for this service.
40+
When enabled (default), the service will deploy and manage
41+
its own postgres database. When disabled, you must configure external
42+
database connection parameters separately.
43+
'';
2344
};
2445
database = {
2546
hostname = lib.mkOption {
2647
type = lib.types.str;
2748
default = "";
49+
description = ''
50+
Database server hostname. Not required if local database is being used.
51+
'';
2852
};
2953
username = lib.mkOption {
3054
type = lib.types.str;
3155
default = "grafana";
56+
description = ''
57+
Database user account with read/write privileges.
58+
For PostgreSQL, ensure the user has CREATEDB permission
59+
for initial setup if creating databases automatically.
60+
'';
3261
};
3362
name = lib.mkOption {
3463
type = lib.types.str;
3564
default = "grafana";
65+
description = ''
66+
Name of the database to use.
67+
Will be created automatically if the user has permissions.
68+
'';
3669
};
3770
};
3871
};
@@ -74,20 +107,19 @@
74107
api_url = "https://${config.secshell.monitoring.grafana.oidc.domain}/realms/${config.secshell.monitoring.grafana.oidc.realm}/protocol/openid-connect/userinfo";
75108
role_attribute_path = "contains(roles[*], 'admin') && 'Admin' || contains(roles[*], 'editor') && 'Editor' || 'Viewer'";
76109
};
77-
database =
78-
{
79-
type = "postgres";
80-
}
81-
// (lib.optionalAttrs (config.secshell.monitoring.grafana.useLocalDatabase) {
82-
host = "/run/postgresql";
83-
user = "grafana";
84-
})
85-
// (lib.optionalAttrs (!config.secshell.monitoring.grafana.useLocalDatabase) {
86-
host = config.secshell.monitoring.grafana.database.hostname;
87-
user = config.secshell.monitoring.grafana.database.username;
88-
name = config.secshell.monitoring.grafana.database.name;
89-
password = "$__file{${config.sops.secrets."monitoring/grafana/databasePassword".path}}";
90-
});
110+
database = {
111+
type = "postgres";
112+
}
113+
// (lib.optionalAttrs (config.secshell.monitoring.grafana.useLocalDatabase) {
114+
host = "/run/postgresql";
115+
user = "grafana";
116+
})
117+
// (lib.optionalAttrs (!config.secshell.monitoring.grafana.useLocalDatabase) {
118+
host = config.secshell.monitoring.grafana.database.hostname;
119+
user = config.secshell.monitoring.grafana.database.username;
120+
name = config.secshell.monitoring.grafana.database.name;
121+
password = "$__file{${config.sops.secrets."monitoring/grafana/databasePassword".path}}";
122+
});
91123
};
92124
provision = {
93125
enable = true;

‎modules/monitoring/nginx.nix‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,26 +5,46 @@
55
type = lib.types.str;
66
default = "prom.${toString config.networking.fqdn}";
77
defaultText = "prom.\${toString config.networking.fqdn}";
8+
description = ''
9+
The primary domain name for prometheus.
10+
Used for virtual host configuration, TLS certificates, and service URLs.
11+
'';
812
};
913
alertmanager = lib.mkOption {
1014
type = lib.types.str;
1115
default = "alerts.${toString config.networking.fqdn}";
1216
defaultText = "alerts.\${toString config.networking.fqdn}";
17+
description = ''
18+
The primary domain name for the prometheus alertmanager.
19+
Used for virtual host configuration, TLS certificates, and service URLs.
20+
'';
1321
};
1422
pushgateway = lib.mkOption {
1523
type = lib.types.str;
1624
default = "pushgateway.${toString config.networking.fqdn}";
1725
defaultText = "pushgateway.\${toString config.networking.fqdn}";
26+
description = ''
27+
The primary domain name for the prometheus pushgateway.
28+
Used for virtual host configuration, TLS certificates, and service URLs.
29+
'';
1830
};
1931
grafana = lib.mkOption {
2032
type = lib.types.str;
2133
default = "grafana.${toString config.networking.fqdn}";
2234
defaultText = "grafana.\${toString config.networking.fqdn}";
35+
description = ''
36+
The primary domain name for grafana.
37+
Used for virtual host configuration, TLS certificates, and service URLs.
38+
'';
2339
};
2440
loki = lib.mkOption {
2541
type = lib.types.str;
2642
default = "loki.${toString config.networking.fqdn}";
2743
defaultText = "loki.\${toString config.networking.fqdn}";
44+
description = ''
45+
The primary domain name for loki.
46+
Used for virtual host configuration, TLS certificates, and service URLs.
47+
'';
2848
};
2949
};
3050
config = lib.mkIf config.secshell.monitoring.enable {
@@ -63,14 +83,13 @@
6383
};
6484

6585
security.acme.certs."${toString config.networking.fqdn}" = {
66-
extraDomainNames =
67-
[
68-
config.secshell.monitoring.domains.prometheus
69-
config.secshell.monitoring.domains.alertmanager
70-
config.secshell.monitoring.domains.pushgateway
71-
]
72-
++ (lib.optionals config.services.grafana.enable [ config.secshell.monitoring.domains.grafana ])
73-
++ (lib.optionals config.services.loki.enable [ config.secshell.monitoring.domains.loki ]);
86+
extraDomainNames = [
87+
config.secshell.monitoring.domains.prometheus
88+
config.secshell.monitoring.domains.alertmanager
89+
config.secshell.monitoring.domains.pushgateway
90+
]
91+
++ (lib.optionals config.services.grafana.enable [ config.secshell.monitoring.domains.grafana ])
92+
++ (lib.optionals config.services.loki.enable [ config.secshell.monitoring.domains.loki ]);
7493
};
7594
};
7695
}

‎modules/netbox/default.nix‎

Lines changed: 92 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -16,48 +16,85 @@
1616
pkg:
1717
if config.secshell.netbox.oidc.endpoint != "" then
1818
pkg.overrideAttrs (old: {
19-
installPhase =
20-
old.installPhase
21-
+ ''
22-
ln -s ${./pipeline.py} $out/opt/netbox/netbox/netbox/secshell_pipeline.py
23-
'';
19+
installPhase = old.installPhase + ''
20+
ln -s ${./pipeline.py} $out/opt/netbox/netbox/netbox/secshell_pipeline.py
21+
'';
2422
})
2523
else
2624
pkg;
25+
description = ''
26+
The netbox package to use.
27+
If oidc is configured the secshell oidc pipeline for social auth
28+
will be automaticlly added to the package.
29+
'';
2730
};
2831
domain = lib.mkOption {
2932
type = lib.types.str;
3033
default = "netbox.${toString config.networking.fqdn}";
3134
defaultText = "netbox.\${toString config.networking.fqdn}";
35+
description = ''
36+
The primary domain name for this service.
37+
Used for virtual host configuration, TLS certificates, and service URLs.
38+
'';
39+
};
40+
internal_port = lib.mkOption {
41+
type = lib.types.port;
42+
description = ''
43+
The local port the service listens on.
44+
'';
3245
};
33-
internal_port = lib.mkOption { type = lib.types.port; };
3446
oidc = {
3547
endpoint = lib.mkOption {
3648
type = lib.types.str;
3749
default = "";
50+
description = ''
51+
The open id connect server used for authentication.
52+
Leave null to disable oidc authentication.
53+
'';
3854
};
3955
clientId = lib.mkOption {
4056
type = lib.types.str;
4157
default = config.secshell.netbox.domain;
4258
defaultText = "config.secshell.netbox.domain";
59+
description = ''
60+
The client id for the open id connect authentication.
61+
'';
4362
};
4463
};
4564
useLocalDatabase = lib.mkOption {
4665
type = lib.types.bool;
4766
default = true;
67+
description = ''
68+
Whether to use a local database instance for this service.
69+
When enabled (default), the service will deploy and manage
70+
its own postgres database. When disabled, you must configure external
71+
database connection parameters separately.
72+
'';
4873
};
4974
database = {
5075
hostname = lib.mkOption {
5176
type = lib.types.str;
5277
default = "";
78+
description = ''
79+
Database server hostname. Not required if local database is being used.
80+
'';
5381
};
5482
username = lib.mkOption {
5583
type = lib.types.str;
5684
default = "netbox";
85+
description = ''
86+
Database user account with read/write privileges.
87+
For PostgreSQL, ensure the user has CREATEDB permission
88+
for initial setup if creating databases automatically.
89+
'';
5790
};
5891
name = lib.mkOption {
5992
type = lib.types.str;
6093
default = "netbox";
94+
description = ''
95+
Name of the database to use.
96+
Will be created automatically if the user has permissions.
97+
'';
6198
};
6299
};
63100
plugin = {
@@ -78,16 +115,15 @@
78115
};
79116
};
80117
config = lib.mkIf config.secshell.netbox.enable {
81-
sops.secrets =
82-
{
83-
"netbox/secretKey".owner = "netbox";
84-
}
85-
// (lib.optionalAttrs (config.secshell.netbox.oidc.endpoint != "") {
86-
"netbox/socialAuthSecret".owner = "netbox";
87-
})
88-
// (lib.optionalAttrs (!config.secshell.netbox.useLocalDatabase) {
89-
"netbox/databasePassword".owner = "netbox";
90-
});
118+
sops.secrets = {
119+
"netbox/secretKey".owner = "netbox";
120+
}
121+
// (lib.optionalAttrs (config.secshell.netbox.oidc.endpoint != "") {
122+
"netbox/socialAuthSecret".owner = "netbox";
123+
})
124+
// (lib.optionalAttrs (!config.secshell.netbox.useLocalDatabase) {
125+
"netbox/databasePassword".owner = "netbox";
126+
});
91127

92128
services = {
93129
postgresql = {
@@ -101,48 +137,47 @@
101137
secretKeyFile = config.sops.secrets."netbox/secretKey".path;
102138
port = config.secshell.netbox.internal_port;
103139
listenAddress = "127.0.0.1";
104-
settings =
105-
{
106-
LOGIN_REQUIRED = true;
107-
TIME_ZONE = "Europe/Berlin";
108-
METRICS_ENABLED = true;
109-
}
110-
// (lib.optionalAttrs (config.secshell.netbox.oidc.endpoint != "") {
111-
# https://stackoverflow.com/questions/53550321/keycloak-gatekeeper-aud-claim-and-client-id-do-not-match
112-
REMOTE_AUTH_ENABLED = true;
113-
REMOTE_AUTH_AUTO_CREATE_USER = true;
114-
REMOTE_AUTH_GROUP_SYNC_ENABLED = true;
115-
SOCIAL_AUTH_JSONFIELD_ENABLED = true;
116-
SOCIAL_AUTH_VERIFY_SSL = true;
117-
#SOCIAL_AUTH_OIDC_SCOPE = ["groups" "roles"];
118-
REMOTE_AUTH_BACKEND = "social_core.backends.open_id_connect.OpenIdConnectAuth";
140+
settings = {
141+
LOGIN_REQUIRED = true;
142+
TIME_ZONE = "Europe/Berlin";
143+
METRICS_ENABLED = true;
144+
}
145+
// (lib.optionalAttrs (config.secshell.netbox.oidc.endpoint != "") {
146+
# https://stackoverflow.com/questions/53550321/keycloak-gatekeeper-aud-claim-and-client-id-do-not-match
147+
REMOTE_AUTH_ENABLED = true;
148+
REMOTE_AUTH_AUTO_CREATE_USER = true;
149+
REMOTE_AUTH_GROUP_SYNC_ENABLED = true;
150+
SOCIAL_AUTH_JSONFIELD_ENABLED = true;
151+
SOCIAL_AUTH_VERIFY_SSL = true;
152+
#SOCIAL_AUTH_OIDC_SCOPE = ["groups" "roles"];
153+
REMOTE_AUTH_BACKEND = "social_core.backends.open_id_connect.OpenIdConnectAuth";
119154

120-
#REMOTE_AUTH_GROUP_SEPARATOR=",";
121-
REMOTE_AUTH_SUPERUSER_GROUPS = [ "superuser" ];
122-
REMOTE_AUTH_STAFF_GROUPS = [ "staff" ];
123-
REMOTE_AUTH_DEFAULT_GROUPS = [ "staff" ];
124-
SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = config.secshell.netbox.oidc.endpoint;
125-
SOCIAL_AUTH_OIDC_KEY = config.secshell.netbox.oidc.clientId;
126-
LOGOUT_REDIRECT_URL = "${config.secshell.netbox.oidc.endpoint}end-session/";
127-
})
128-
// {
129-
PLUGINS = [
130-
(lib.mkIf config.secshell.netbox.plugin.bgp "netbox_bgp")
131-
(lib.mkIf config.secshell.netbox.plugin.documents "netbox_documents")
132-
(lib.mkIf config.secshell.netbox.plugin.floorplan "netbox_floorplan")
133-
(lib.mkIf config.secshell.netbox.plugin.qrcode "netbox_qrcode")
134-
(lib.mkIf config.secshell.netbox.plugin.topologyViews "netbox_topology_views")
135-
#(lib.mkIf config.secshell.netbox.plugin.proxbox "netbox_proxbox")
136-
(lib.mkIf config.secshell.netbox.plugin.contract "netbox_contract")
137-
(lib.mkIf config.secshell.netbox.plugin.interface-synchronization "netbox_interface_synchronization")
138-
(lib.mkIf config.secshell.netbox.plugin.dns "netbox_dns")
139-
(lib.mkIf config.secshell.netbox.plugin.napalm "netbox_napalm_plugin")
140-
(lib.mkIf config.secshell.netbox.plugin.reorder-rack "netbox_reorder_rack")
141-
(lib.mkIf config.secshell.netbox.plugin.prometheus-sd "netbox_prometheus_sd")
142-
#(lib.mkIf config.secshell.netbox.plugin.kea "netbox_kea")
143-
(lib.mkIf config.secshell.netbox.plugin.attachments "netbox_attachments")
144-
];
145-
};
155+
#REMOTE_AUTH_GROUP_SEPARATOR=",";
156+
REMOTE_AUTH_SUPERUSER_GROUPS = [ "superuser" ];
157+
REMOTE_AUTH_STAFF_GROUPS = [ "staff" ];
158+
REMOTE_AUTH_DEFAULT_GROUPS = [ "staff" ];
159+
SOCIAL_AUTH_OIDC_OIDC_ENDPOINT = config.secshell.netbox.oidc.endpoint;
160+
SOCIAL_AUTH_OIDC_KEY = config.secshell.netbox.oidc.clientId;
161+
LOGOUT_REDIRECT_URL = "${config.secshell.netbox.oidc.endpoint}end-session/";
162+
})
163+
// {
164+
PLUGINS = [
165+
(lib.mkIf config.secshell.netbox.plugin.bgp "netbox_bgp")
166+
(lib.mkIf config.secshell.netbox.plugin.documents "netbox_documents")
167+
(lib.mkIf config.secshell.netbox.plugin.floorplan "netbox_floorplan")
168+
(lib.mkIf config.secshell.netbox.plugin.qrcode "netbox_qrcode")
169+
(lib.mkIf config.secshell.netbox.plugin.topologyViews "netbox_topology_views")
170+
#(lib.mkIf config.secshell.netbox.plugin.proxbox "netbox_proxbox")
171+
(lib.mkIf config.secshell.netbox.plugin.contract "netbox_contract")
172+
(lib.mkIf config.secshell.netbox.plugin.interface-synchronization "netbox_interface_synchronization")
173+
(lib.mkIf config.secshell.netbox.plugin.dns "netbox_dns")
174+
(lib.mkIf config.secshell.netbox.plugin.napalm "netbox_napalm_plugin")
175+
(lib.mkIf config.secshell.netbox.plugin.reorder-rack "netbox_reorder_rack")
176+
(lib.mkIf config.secshell.netbox.plugin.prometheus-sd "netbox_prometheus_sd")
177+
#(lib.mkIf config.secshell.netbox.plugin.kea "netbox_kea")
178+
(lib.mkIf config.secshell.netbox.plugin.attachments "netbox_attachments")
179+
];
180+
};
146181

147182
plugins =
148183
ps:

0 commit comments

Comments
 (0)