Torjus Håkestad
9bd48e0808
All checks were successful
Run nix flake check / flake-check (push) Successful in 2m6s
Empty valid_status_codes defaults to 2xx only, not "any". Explicitly list common status codes (2xx, 3xx, 4xx, 5xx) so services returning 400/401 like ha and nzbget pass the probe. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
93 lines
2.4 KiB
Nix
93 lines
2.4 KiB
Nix
{ pkgs, ... }:
|
|
let
|
|
# TLS endpoints to monitor for certificate expiration
|
|
# These are all services using ACME certificates from OpenBao PKI
|
|
tlsTargets = [
|
|
# Direct ACME certs (security.acme.certs)
|
|
"https://vault.home.2rjus.net:8200"
|
|
"https://auth.home.2rjus.net"
|
|
"https://testvm01.home.2rjus.net"
|
|
|
|
# Caddy auto-TLS on http-proxy
|
|
"https://nzbget.home.2rjus.net"
|
|
"https://radarr.home.2rjus.net"
|
|
"https://sonarr.home.2rjus.net"
|
|
"https://ha.home.2rjus.net"
|
|
"https://z2m.home.2rjus.net"
|
|
"https://prometheus.home.2rjus.net"
|
|
"https://alertmanager.home.2rjus.net"
|
|
"https://grafana.home.2rjus.net"
|
|
"https://jelly.home.2rjus.net"
|
|
"https://pyroscope.home.2rjus.net"
|
|
"https://pushgw.home.2rjus.net"
|
|
|
|
# Caddy auto-TLS on nix-cache01
|
|
"https://nix-cache.home.2rjus.net"
|
|
|
|
# Caddy auto-TLS on grafana01
|
|
"https://grafana-test.home.2rjus.net"
|
|
];
|
|
in
|
|
{
|
|
services.prometheus.exporters.blackbox = {
|
|
enable = true;
|
|
configFile = pkgs.writeText "blackbox.yml" ''
|
|
modules:
|
|
https_cert:
|
|
prober: http
|
|
timeout: 10s
|
|
http:
|
|
fail_if_not_ssl: true
|
|
preferred_ip_protocol: ip4
|
|
valid_status_codes:
|
|
- 200
|
|
- 204
|
|
- 301
|
|
- 302
|
|
- 303
|
|
- 307
|
|
- 308
|
|
- 400
|
|
- 401
|
|
- 403
|
|
- 404
|
|
- 405
|
|
- 500
|
|
- 502
|
|
- 503
|
|
'';
|
|
};
|
|
|
|
# Add blackbox scrape config to Prometheus
|
|
# Alert rules are in rules.yml (certificate_rules group)
|
|
services.prometheus.scrapeConfigs = [
|
|
{
|
|
job_name = "blackbox_tls";
|
|
metrics_path = "/probe";
|
|
params = {
|
|
module = [ "https_cert" ];
|
|
};
|
|
static_configs = [{
|
|
targets = tlsTargets;
|
|
}];
|
|
relabel_configs = [
|
|
# Pass the target URL to blackbox as a parameter
|
|
{
|
|
source_labels = [ "__address__" ];
|
|
target_label = "__param_target";
|
|
}
|
|
# Use the target URL as the instance label
|
|
{
|
|
source_labels = [ "__param_target" ];
|
|
target_label = "instance";
|
|
}
|
|
# Point the actual scrape at the local blackbox exporter
|
|
{
|
|
target_label = "__address__";
|
|
replacement = "127.0.0.1:9115";
|
|
}
|
|
];
|
|
}
|
|
];
|
|
}
|