alertmanager: expose at alerts.nixos.org behind oauth2 flow
Martin Weinelt committed
Jan 8, 2025 at 21:39 UTC
128750a746f9c8c37aa29f7497c139d0f389fd55
4 files changed
+40
-1
build/pluto/prometheus/alertmanager.nix
+34
-1
@@ -20,7 +20,7 @@
20
# the machine's network interfaces.
21
extraFlags = [ "--cluster.listen-address=''" ];
22
23
- webExternalUrl = "http://10.254.1.4:9093/";
23
+ webExternalUrl = "http://alerts.nixos.org";
24
configuration = {
25
global = { };
26
route = {
@@ -57,6 +57,39 @@
57
};
58
};
59
60
+ services.nginx.virtualHosts."alerts.nixos.org" = {
61
+ enableACME = true;
62
+ forceSSL = true;
63
+
64
+ locations."/" = {
65
+ proxyPass = "http://localhost:9093";
66
+ };
67
+ };
68
+
69
+ age.secrets."alertmanager-oauth2-proxy-env".file = ../../secrets/alertmanager-oauth2-proxy-env.age;
70
+
71
+ services.oauth2-proxy = {
72
+ enable = true;
73
+
74
+ # oidc provider
75
+ provider = "github";
76
+ clientID = "Ov23liDt1q76okEJpVVE";
77
+ keyFile = config.age.secrets."alertmanager-oauth2-proxy-env".path;
78
+
79
+ # filter criteria
80
+ email.domains = [ "*" ];
81
+ github = {
82
+ org = "NixOS";
83
+ team = "infra";
84
+ };
85
+
86
+ # protected domains
87
+ nginx = {
88
+ domain = "alerts.nixos.org";
89
+ virtualHosts."alerts.nixos.org" = { };
90
+ };
91
+ };
92
+
93
age.secrets.alertmanager-matrix-forwarder = {
94
file = ../../secrets/alertmanager-matrix-forwarder.age;
95
owner = config.systemd.services.go-neb.serviceConfig.User;
build/secrets.nix
+1
@@ -3,6 +3,7 @@ let
3
4
secrets = with keys; {
5
alertmanager-matrix-forwarder = [ machines.pluto ];
6
+ alertmanager-oauth2-proxy-env = [ machines.pluto ];
7
fastly-exporter-env = [ machines.pluto ];
8
hydra-aws-credentials = [ machines.mimas ];
9
hydra-github-client-secret = [ machines.mimas ];
build/secrets/alertmanager-oauth2-proxy-env.age
Binary files /dev/null and b/build/secrets/alertmanager-oauth2-proxy-env.age differ
terraform/dns.tf
+5
@@ -61,6 +61,11 @@ locals {
61
type = "AAAA"
62
value = "2a01:4f9:3070:15e0::1"
63
},
64
+ {
65
+ hostname = "alerts.nixos.org"
66
+ type = "CNAME"
67
+ value = "pluto.nixos.org"
68
+ },
69
{
70
hostname = "prometheus.nixos.org"
71
type = "CNAME"