From 719df0add2cf9c2118cda737ec535d83f2b1e24e Mon Sep 17 00:00:00 2001 From: Franck Cuny Date: Wed, 6 Apr 2022 12:27:49 -0700 Subject: refactor unifi to a module --- hosts/common/server/unifi.nix | 81 ----------------------------------- hosts/profiles/nas.nix | 2 +- modules/services/default.nix | 12 +++++- modules/services/unifi/default.nix | 87 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 98 insertions(+), 84 deletions(-) delete mode 100644 hosts/common/server/unifi.nix create mode 100644 modules/services/unifi/default.nix diff --git a/hosts/common/server/unifi.nix b/hosts/common/server/unifi.nix deleted file mode 100644 index ab32cec..0000000 --- a/hosts/common/server/unifi.nix +++ /dev/null @@ -1,81 +0,0 @@ -{ config, lib, pkgs, ... }: - -let - allowedRules = { - # https://help.ubnt.com/hc/en-us/articles/218506997 - allowedTCPPorts = [ - 8080 # Port for UAP to inform controller. - 8880 # Port for HTTP portal redirect, if guest portal is enabled. - 8843 # Port for HTTPS portal redirect, ditto. - 6789 # Port for UniFi mobile speed test. - ]; - allowedUDPPorts = [ - 3478 # UDP port used for STUN. - 10001 # UDP port used for device discovery. - ]; - }; -in { - config = { - networking.firewall = allowedRules; - users.users.unifi.group = "unifi"; - users.users.unifi.isSystemUser = true; - users.groups.unifi = { }; - - services.unifi = { - enable = true; - openPorts = true; - unifiPackage = pkgs.unifiStable; - }; - - age.secrets.unifi-read-only = { - file = ../../../secrets/unifi/unifi-poller.age; - mode = "0400"; - owner = "unifi-poller"; - }; - - services.unifi-poller = { - enable = true; - - unifi.defaults = { - url = "https://127.0.0.1:8443"; - user = "unifipoller"; - pass = config.age.secrets.unifi-read-only.path; - - verify_ssl = false; - }; - - influxdb.disable = true; - - prometheus = { http_listen = ":9130"; }; - }; - - systemd.services.unifi-available = { - description = "Wait for Unifi to be available"; - after = [ "unifi.service" ]; - before = [ "unifi-poller.service" ]; - wantedBy = [ "unifi-poller.service" ]; - serviceConfig = { - ExecStart = - "${pkgs.curl}/bin/curl --insecure 'https://localhost:8443/'"; - Restart = "on-failure"; - RestartSec = "10"; - Type = "oneshot"; - }; - }; - - age.secrets.restic-repo-systems.file = - ../../../secrets/restic/repo-systems.age; - - services.restic.backups = { - unifi = { - paths = [ "/var/lib/unifi" ]; - repository = "/data/slow/backups/systems"; - passwordFile = config.age.secrets.restic-repo-systems.path; - initialize = true; - timerConfig = { OnCalendar = "00:45"; }; - extraBackupArgs = [ "--tag unifi" ]; - pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" ]; - }; - }; - }; -} diff --git a/hosts/profiles/nas.nix b/hosts/profiles/nas.nix index aaeee75..33fd6b5 100644 --- a/hosts/profiles/nas.nix +++ b/hosts/profiles/nas.nix @@ -6,7 +6,6 @@ ../common/server/grafana.nix ../common/server/traefik.nix ../common/server/transmission.nix - ../common/server/unifi.nix ../common/server/gitea.nix ../common/server/rclone.nix ]; @@ -27,6 +26,7 @@ enable = true; musicFolder = "/data/fast/music"; }; + unifi = { enable = true; }; }; services.restic.backups = { diff --git a/modules/services/default.nix b/modules/services/default.nix index 637e60f..8da870e 100644 --- a/modules/services/default.nix +++ b/modules/services/default.nix @@ -1,6 +1,14 @@ { ... }: { - imports = - [ ./navidrome ./samba ./ssh-server ./tailscale ./thermald ./tlp ./fwupd ]; + imports = [ + ./fwupd + ./navidrome + ./samba + ./ssh-server + ./tailscale + ./thermald + ./tlp + ./unifi + ]; } diff --git a/modules/services/unifi/default.nix b/modules/services/unifi/default.nix new file mode 100644 index 0000000..af7b059 --- /dev/null +++ b/modules/services/unifi/default.nix @@ -0,0 +1,87 @@ +{ config, lib, pkgs, ... }: + +let + cfg = config.my.services.unifi; + allowedRules = { + # https://help.ubnt.com/hc/en-us/articles/218506997 + allowedTCPPorts = [ + 8080 # Port for UAP to inform controller. + 8880 # Port for HTTP portal redirect, if guest portal is enabled. + 8843 # Port for HTTPS portal redirect, ditto. + 6789 # Port for UniFi mobile speed test. + 9130 # Port for the prometheus exporter + ]; + allowedUDPPorts = [ + 3478 # UDP port used for STUN. + 10001 # UDP port used for device discovery. + ]; + }; +in { + options.my.services.unifi = with lib; { + enable = mkEnableOption "Unifi controller"; + }; + + config = lib.mkIf cfg.enable { + networking.firewall = allowedRules; + users.users.unifi.group = "unifi"; + users.users.unifi.isSystemUser = true; + users.groups.unifi = { }; + + services.unifi = { + enable = true; + openPorts = true; + unifiPackage = pkgs.unifiStable; + }; + + age.secrets.unifi-read-only = { + file = ../../../secrets/unifi/unifi-poller.age; + mode = "0400"; + owner = "unifi-poller"; + }; + + services.unifi-poller = { + enable = true; + + unifi.defaults = { + url = "https://127.0.0.1:8443"; + user = "unifipoller"; + pass = config.age.secrets.unifi-read-only.path; + + verify_ssl = false; + }; + + influxdb.disable = true; + + prometheus = { http_listen = ":9130"; }; + }; + + systemd.services.unifi-available = { + description = "Wait for Unifi to be available"; + after = [ "unifi.service" ]; + before = [ "unifi-poller.service" ]; + wantedBy = [ "unifi-poller.service" ]; + serviceConfig = { + ExecStart = + "${pkgs.curl}/bin/curl --insecure 'https://localhost:8443/'"; + Restart = "on-failure"; + RestartSec = "10"; + Type = "oneshot"; + }; + }; + + age.secrets.restic-repo-systems.file = + ../../../secrets/restic/repo-systems.age; + + services.restic.backups = { + unifi = { + paths = [ "/var/lib/unifi" ]; + repository = "/data/slow/backups/systems"; + passwordFile = config.age.secrets.restic-repo-systems.path; + initialize = true; + timerConfig = { OnCalendar = "00:45"; }; + extraBackupArgs = [ "--tag unifi" ]; + pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" ]; + }; + }; + }; +} -- cgit 1.4.1