nixos/birdwatcher: init
This commit is contained in:
Janik H
parent
55bd75e98f
commit
40136a1f7f
|
|
@ -79,6 +79,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||
|
||||
- [alice-lg](github.com/alice-lg/alice-lg), a looking-glass for BGP sessions. Available as [services.alice-lg](#opt-services.alice-lg.enable).
|
||||
|
||||
- [birdwatcher](github.com/alice-lg/birdwatcher), a small HTTP server meant to provide an API defined by Barry O'Donovan's birds-eye to the BIRD internet routing daemon. Available as [services.birdwatcher](#opt-services.birdwatcher.enable).
|
||||
|
||||
- [peroxide](https://github.com/ljanyst/peroxide), a fork of the official [ProtonMail bridge](https://github.com/ProtonMail/proton-bridge) that aims to be similar to [Hydroxide](https://github.com/emersion/hydroxide). Available as [services.peroxide](#opt-services.peroxide.enable).
|
||||
|
||||
- [autosuspend](https://github.com/languitar/autosuspend), a python daemon that suspends a system if certain conditions are met, or not met.
|
||||
|
|
|
|||
|
|
@ -803,6 +803,7 @@
|
|||
./services/networking/bind.nix
|
||||
./services/networking/bird-lg.nix
|
||||
./services/networking/bird.nix
|
||||
./services/networking/birdwatcher.nix
|
||||
./services/networking/bitcoind.nix
|
||||
./services/networking/bitlbee.nix
|
||||
./services/networking/blockbook-frontend.nix
|
||||
|
|
|
|||
129
nixos/modules/services/networking/birdwatcher.nix
Normal file
129
nixos/modules/services/networking/birdwatcher.nix
Normal file
|
|
@ -0,0 +1,129 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.birdwatcher;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.birdwatcher = {
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.birdwatcher;
|
||||
defaultText = literalExpression "pkgs.birdwatcher";
|
||||
description = lib.mdDoc "The Birdwatcher package to use.";
|
||||
};
|
||||
enable = mkEnableOption (lib.mdDoc "Birdwatcher");
|
||||
flags = mkOption {
|
||||
default = [ ];
|
||||
type = types.listOf types.str;
|
||||
example = [ "-worker-pool-size 16" "-6" ];
|
||||
description = lib.mdDoc ''
|
||||
Flags to append to the program call
|
||||
'';
|
||||
};
|
||||
|
||||
settings = mkOption {
|
||||
type = types.lines;
|
||||
default = { };
|
||||
description = lib.mdDoc ''
|
||||
birdwatcher configuration, for configuration options see the example on [github](https://github.com/alice-lg/birdwatcher/blob/master/etc/birdwatcher/birdwatcher.conf)
|
||||
'';
|
||||
example = literalExpression ''
|
||||
[server]
|
||||
allow_from = []
|
||||
allow_uncached = false
|
||||
modules_enabled = ["status",
|
||||
"protocols",
|
||||
"protocols_bgp",
|
||||
"protocols_short",
|
||||
"routes_protocol",
|
||||
"routes_peer",
|
||||
"routes_table",
|
||||
"routes_table_filtered",
|
||||
"routes_table_peer",
|
||||
"routes_filtered",
|
||||
"routes_prefixed",
|
||||
"routes_noexport",
|
||||
"routes_pipe_filtered_count",
|
||||
"routes_pipe_filtered"
|
||||
]
|
||||
|
||||
[status]
|
||||
reconfig_timestamp_source = "bird"
|
||||
reconfig_timestamp_match = "# created: (.*)"
|
||||
|
||||
filter_fields = []
|
||||
|
||||
[bird]
|
||||
listen = "0.0.0.0:29184"
|
||||
config = "/etc/bird/bird2.conf"
|
||||
birdc = "''${pkgs.bird}/bin/birdc"
|
||||
ttl = 5 # time to live (in minutes) for caching of cli output
|
||||
|
||||
[parser]
|
||||
filter_fields = []
|
||||
|
||||
[cache]
|
||||
use_redis = false # if not using redis cache, activate housekeeping to save memory!
|
||||
|
||||
[housekeeping]
|
||||
interval = 5
|
||||
force_release_memory = true
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config =
|
||||
let flagsStr = escapeShellArgs cfg.flags;
|
||||
in lib.mkIf cfg.enable {
|
||||
environment.etc."birdwatcher/birdwatcher.conf".source = pkgs.writeTextFile {
|
||||
name = "birdwatcher.conf";
|
||||
text = cfg.settings;
|
||||
};
|
||||
systemd.services = {
|
||||
birdwatcher = {
|
||||
wants = [ "network.target" ];
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
description = "Birdwatcher";
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 15;
|
||||
ExecStart = "${cfg.package}/bin/birdwatcher";
|
||||
StateDirectoryMode = "0700";
|
||||
UMask = "0117";
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
PrivateTmp = true;
|
||||
PrivateDevices = true;
|
||||
ProtectHostname = true;
|
||||
ProtectClock = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectControlGroups = true;
|
||||
RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
PrivateMounts = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
|
||||
BindReadOnlyPaths = [
|
||||
"-/etc/resolv.conf"
|
||||
"-/etc/nsswitch.conf"
|
||||
"-/etc/ssl/certs"
|
||||
"-/etc/static/ssl/certs"
|
||||
"-/etc/hosts"
|
||||
"-/etc/localtime"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -97,6 +97,7 @@ in {
|
|||
binary-cache = handleTest ./binary-cache.nix {};
|
||||
bind = handleTest ./bind.nix {};
|
||||
bird = handleTest ./bird.nix {};
|
||||
birdwatcher = handleTest ./birdwatcher.nix {};
|
||||
bitcoind = handleTest ./bitcoind.nix {};
|
||||
bittorrent = handleTest ./bittorrent.nix {};
|
||||
blockbook-frontend = handleTest ./blockbook-frontend.nix {};
|
||||
|
|
|
|||
94
nixos/tests/birdwatcher.nix
Normal file
94
nixos/tests/birdwatcher.nix
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
# This test does a basic functionality check for birdwatcher
|
||||
|
||||
{ system ? builtins.currentSystem
|
||||
, pkgs ? import ../.. { inherit system; config = { }; }
|
||||
}:
|
||||
|
||||
let
|
||||
inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
|
||||
inherit (pkgs.lib) optionalString;
|
||||
in
|
||||
makeTest {
|
||||
name = "birdwatcher";
|
||||
nodes = {
|
||||
host1 = {
|
||||
environment.systemPackages = with pkgs; [ jq ];
|
||||
services.bird2 = {
|
||||
enable = true;
|
||||
config = ''
|
||||
log syslog all;
|
||||
|
||||
debug protocols all;
|
||||
|
||||
router id 10.0.0.1;
|
||||
|
||||
protocol device {
|
||||
}
|
||||
|
||||
protocol kernel kernel4 {
|
||||
ipv4 {
|
||||
import none;
|
||||
export all;
|
||||
};
|
||||
}
|
||||
|
||||
protocol kernel kernel6 {
|
||||
ipv6 {
|
||||
import none;
|
||||
export all;
|
||||
};
|
||||
}
|
||||
'';
|
||||
};
|
||||
services.birdwatcher = {
|
||||
enable = true;
|
||||
settings = ''
|
||||
[server]
|
||||
allow_from = []
|
||||
allow_uncached = false
|
||||
modules_enabled = ["status",
|
||||
"protocols",
|
||||
"protocols_bgp",
|
||||
"protocols_short",
|
||||
"routes_protocol",
|
||||
"routes_peer",
|
||||
"routes_table",
|
||||
"routes_table_filtered",
|
||||
"routes_table_peer",
|
||||
"routes_filtered",
|
||||
"routes_prefixed",
|
||||
"routes_noexport",
|
||||
"routes_pipe_filtered_count",
|
||||
"routes_pipe_filtered"
|
||||
]
|
||||
[status]
|
||||
reconfig_timestamp_source = "bird"
|
||||
reconfig_timestamp_match = "# created: (.*)"
|
||||
filter_fields = []
|
||||
[bird]
|
||||
listen = "0.0.0.0:29184"
|
||||
config = "/etc/bird/bird2.conf"
|
||||
birdc = "${pkgs.bird}/bin/birdc"
|
||||
ttl = 5 # time to live (in minutes) for caching of cli output
|
||||
[parser]
|
||||
filter_fields = []
|
||||
[cache]
|
||||
use_redis = false # if not using redis cache, activate housekeeping to save memory!
|
||||
[housekeeping]
|
||||
interval = 5
|
||||
force_release_memory = true
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
start_all()
|
||||
|
||||
host1.wait_for_unit("bird2.service")
|
||||
host1.wait_for_unit("birdwatcher.service")
|
||||
host1.wait_for_open_port(29184)
|
||||
host1.succeed("curl http://[::]:29184/status | jq -r .status.message | grep 'Daemon is up and running'")
|
||||
host1.succeed("curl http://[::]:29184/protocols | jq -r .protocols.device1.state | grep 'up'")
|
||||
'';
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user