Lots of updates

2022-07-10 20:46:03 -07:00
parent a4ba216d71
commit d46a301f68
17 changed files with 698 additions and 226 deletions
@@ -236,6 +236,9 @@ in {
          in "${alias}.${domain-name}";
          state-directory = prometheus-cfg.state-directory;
          private-network = is-private-network;
+          # TODO: prometheus 22.05 breaks dns_sd_configs
+          # Revert when fixed.
+          package = pkgs.pkgs2111.prometheus;
        };

        grafana = mkIf metricsMonitor {
@@ -0,0 +1,92 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.fudo.services.wallfly-presence;
+  hostname = config.instance.hostname;
+  domain-name = config.instance.local-domain;
+  site-name = config.instance.local-site;
+  mqtt-broker = cfg.mqtt.broker-host;
+  is-mqtt-broker = hostname == mqtt-broker;
+  site-users = config.fudo.sites."${config.instance.local-site}".local-users;
+  domain-users = config.fudo.domains."${domain-name}".local-users;
+  user-cfg = genAttrs (unique (site-users ++ domain-users)) (username: {
+    password-file =
+      pkgs.lib.passwd.stablerandom-passwd-file "wallfly-${username}"
+      config.instance.build-seed;
+  });
+  local-user-cfg =
+    filterAttrs (username: opts: hasAttr username config.instance.local-users)
+    user-cfg;
+
+in {
+  options.fudo.services.wallfly-presence = with types; {
+    enable = mkEnableOption "Enable WallFly presence for the local site.";
+
+    mqtt = {
+      broker-host = mkOption {
+        type = str;
+        description = "Host to serve as local MQTT broker.";
+      };
+
+      port = mkOption {
+        type = port;
+        description = "Port on which to listen for MQTT connections.";
+        default = 1884;
+      };
+
+      listen-address = mkOption {
+        type = str;
+        description = "Address on which to listen for MQTT connections.";
+        default = "0.0.0.0";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    fudo = {
+      secrets.host-secrets."${hostname}" = (mapAttrs' (username: userOpts:
+        nameValuePair "wallfly-user-${username}-passwd" {
+          source-file = userOpts.password-file;
+          target-file = "/run/wallfly-${username}/passwd";
+          user = username;
+        }) local-user-cfg) // (optionalAttrs is-mqtt-broker (mapAttrs'
+          (username: userOpts:
+            nameValuePair "wallfly-server-${username}-passwd" {
+              source-file = userOpts.password-file;
+              target-file = "/run/wallfly-mqtt/${username}.passwd";
+              user = config.systemd.services.mosquitto.serviceConfig.User;
+            }) user-cfg));
+
+      zones."${domain-name}" = {
+        aliases.mqtt = "${mqtt-broker}.${domain-name}";
+      };
+
+      wallfly = {
+        enable = true;
+        mqtt = {
+          broker-uri =
+            "tcp://${mqtt-broker}.${domain-name}:${toString cfg.mqtt.port}";
+          username = "wallfly-$USER";
+          password-file = "/run/wallfly-$USER/passwd";
+        };
+      };
+    };
+
+    services = {
+      mosquitto = mkIf (is-mqtt-broker) {
+        enable = true;
+        listeners = [{
+          settings.allow_anonymous = false;
+          port = cfg.mqtt.port;
+          address = cfg.mqtt.listen-address;
+          users = mapAttrs' (username: userOpts:
+            nameValuePair "wallfly-${username}" {
+              passwordFile = "/run/wallfly-mqtt/${username}.passwd";
+              acl = [ "readwrite homeassistant/binary_sensor/#" ];
+            }) user-cfg;
+        }];
+      };
+    };
+  };
+}