nixos/birdwatcher: init
This commit is contained in:
parent
55bd75e98f
commit
40136a1f7f
|
@ -79,6 +79,8 @@ In addition to numerous new and upgraded packages, this release has the followin
|
||||||
|
|
||||||
- [alice-lg](github.com/alice-lg/alice-lg), a looking-glass for BGP sessions. Available as [services.alice-lg](#opt-services.alice-lg.enable).
|
- [alice-lg](github.com/alice-lg/alice-lg), a looking-glass for BGP sessions. Available as [services.alice-lg](#opt-services.alice-lg.enable).
|
||||||
|
|
||||||
|
- [birdwatcher](github.com/alice-lg/birdwatcher), a small HTTP server meant to provide an API defined by Barry O'Donovan's birds-eye to the BIRD internet routing daemon. Available as [services.birdwatcher](#opt-services.birdwatcher.enable).
|
||||||
|
|
||||||
- [peroxide](https://github.com/ljanyst/peroxide), a fork of the official [ProtonMail bridge](https://github.com/ProtonMail/proton-bridge) that aims to be similar to [Hydroxide](https://github.com/emersion/hydroxide). Available as [services.peroxide](#opt-services.peroxide.enable).
|
- [peroxide](https://github.com/ljanyst/peroxide), a fork of the official [ProtonMail bridge](https://github.com/ProtonMail/proton-bridge) that aims to be similar to [Hydroxide](https://github.com/emersion/hydroxide). Available as [services.peroxide](#opt-services.peroxide.enable).
|
||||||
|
|
||||||
- [autosuspend](https://github.com/languitar/autosuspend), a python daemon that suspends a system if certain conditions are met, or not met.
|
- [autosuspend](https://github.com/languitar/autosuspend), a python daemon that suspends a system if certain conditions are met, or not met.
|
||||||
|
|
|
@ -803,6 +803,7 @@
|
||||||
./services/networking/bind.nix
|
./services/networking/bind.nix
|
||||||
./services/networking/bird-lg.nix
|
./services/networking/bird-lg.nix
|
||||||
./services/networking/bird.nix
|
./services/networking/bird.nix
|
||||||
|
./services/networking/birdwatcher.nix
|
||||||
./services/networking/bitcoind.nix
|
./services/networking/bitcoind.nix
|
||||||
./services/networking/bitlbee.nix
|
./services/networking/bitlbee.nix
|
||||||
./services/networking/blockbook-frontend.nix
|
./services/networking/blockbook-frontend.nix
|
||||||
|
|
129
nixos/modules/services/networking/birdwatcher.nix
Normal file
129
nixos/modules/services/networking/birdwatcher.nix
Normal file
|
@ -0,0 +1,129 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
cfg = config.services.birdwatcher;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options = {
|
||||||
|
services.birdwatcher = {
|
||||||
|
package = mkOption {
|
||||||
|
type = types.package;
|
||||||
|
default = pkgs.birdwatcher;
|
||||||
|
defaultText = literalExpression "pkgs.birdwatcher";
|
||||||
|
description = lib.mdDoc "The Birdwatcher package to use.";
|
||||||
|
};
|
||||||
|
enable = mkEnableOption (lib.mdDoc "Birdwatcher");
|
||||||
|
flags = mkOption {
|
||||||
|
default = [ ];
|
||||||
|
type = types.listOf types.str;
|
||||||
|
example = [ "-worker-pool-size 16" "-6" ];
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Flags to append to the program call
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
settings = mkOption {
|
||||||
|
type = types.lines;
|
||||||
|
default = { };
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
birdwatcher configuration, for configuration options see the example on [github](https://github.com/alice-lg/birdwatcher/blob/master/etc/birdwatcher/birdwatcher.conf)
|
||||||
|
'';
|
||||||
|
example = literalExpression ''
|
||||||
|
[server]
|
||||||
|
allow_from = []
|
||||||
|
allow_uncached = false
|
||||||
|
modules_enabled = ["status",
|
||||||
|
"protocols",
|
||||||
|
"protocols_bgp",
|
||||||
|
"protocols_short",
|
||||||
|
"routes_protocol",
|
||||||
|
"routes_peer",
|
||||||
|
"routes_table",
|
||||||
|
"routes_table_filtered",
|
||||||
|
"routes_table_peer",
|
||||||
|
"routes_filtered",
|
||||||
|
"routes_prefixed",
|
||||||
|
"routes_noexport",
|
||||||
|
"routes_pipe_filtered_count",
|
||||||
|
"routes_pipe_filtered"
|
||||||
|
]
|
||||||
|
|
||||||
|
[status]
|
||||||
|
reconfig_timestamp_source = "bird"
|
||||||
|
reconfig_timestamp_match = "# created: (.*)"
|
||||||
|
|
||||||
|
filter_fields = []
|
||||||
|
|
||||||
|
[bird]
|
||||||
|
listen = "0.0.0.0:29184"
|
||||||
|
config = "/etc/bird/bird2.conf"
|
||||||
|
birdc = "''${pkgs.bird}/bin/birdc"
|
||||||
|
ttl = 5 # time to live (in minutes) for caching of cli output
|
||||||
|
|
||||||
|
[parser]
|
||||||
|
filter_fields = []
|
||||||
|
|
||||||
|
[cache]
|
||||||
|
use_redis = false # if not using redis cache, activate housekeeping to save memory!
|
||||||
|
|
||||||
|
[housekeeping]
|
||||||
|
interval = 5
|
||||||
|
force_release_memory = true
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config =
|
||||||
|
let flagsStr = escapeShellArgs cfg.flags;
|
||||||
|
in lib.mkIf cfg.enable {
|
||||||
|
environment.etc."birdwatcher/birdwatcher.conf".source = pkgs.writeTextFile {
|
||||||
|
name = "birdwatcher.conf";
|
||||||
|
text = cfg.settings;
|
||||||
|
};
|
||||||
|
systemd.services = {
|
||||||
|
birdwatcher = {
|
||||||
|
wants = [ "network.target" ];
|
||||||
|
after = [ "network.target" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
description = "Birdwatcher";
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "simple";
|
||||||
|
Restart = "on-failure";
|
||||||
|
RestartSec = 15;
|
||||||
|
ExecStart = "${cfg.package}/bin/birdwatcher";
|
||||||
|
StateDirectoryMode = "0700";
|
||||||
|
UMask = "0117";
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
PrivateTmp = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
PrivateMounts = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
|
||||||
|
BindReadOnlyPaths = [
|
||||||
|
"-/etc/resolv.conf"
|
||||||
|
"-/etc/nsswitch.conf"
|
||||||
|
"-/etc/ssl/certs"
|
||||||
|
"-/etc/static/ssl/certs"
|
||||||
|
"-/etc/hosts"
|
||||||
|
"-/etc/localtime"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -97,6 +97,7 @@ in {
|
||||||
binary-cache = handleTest ./binary-cache.nix {};
|
binary-cache = handleTest ./binary-cache.nix {};
|
||||||
bind = handleTest ./bind.nix {};
|
bind = handleTest ./bind.nix {};
|
||||||
bird = handleTest ./bird.nix {};
|
bird = handleTest ./bird.nix {};
|
||||||
|
birdwatcher = handleTest ./birdwatcher.nix {};
|
||||||
bitcoind = handleTest ./bitcoind.nix {};
|
bitcoind = handleTest ./bitcoind.nix {};
|
||||||
bittorrent = handleTest ./bittorrent.nix {};
|
bittorrent = handleTest ./bittorrent.nix {};
|
||||||
blockbook-frontend = handleTest ./blockbook-frontend.nix {};
|
blockbook-frontend = handleTest ./blockbook-frontend.nix {};
|
||||||
|
|
94
nixos/tests/birdwatcher.nix
Normal file
94
nixos/tests/birdwatcher.nix
Normal file
|
@ -0,0 +1,94 @@
|
||||||
|
# This test does a basic functionality check for birdwatcher
|
||||||
|
|
||||||
|
{ system ? builtins.currentSystem
|
||||||
|
, pkgs ? import ../.. { inherit system; config = { }; }
|
||||||
|
}:
|
||||||
|
|
||||||
|
let
|
||||||
|
inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
|
||||||
|
inherit (pkgs.lib) optionalString;
|
||||||
|
in
|
||||||
|
makeTest {
|
||||||
|
name = "birdwatcher";
|
||||||
|
nodes = {
|
||||||
|
host1 = {
|
||||||
|
environment.systemPackages = with pkgs; [ jq ];
|
||||||
|
services.bird2 = {
|
||||||
|
enable = true;
|
||||||
|
config = ''
|
||||||
|
log syslog all;
|
||||||
|
|
||||||
|
debug protocols all;
|
||||||
|
|
||||||
|
router id 10.0.0.1;
|
||||||
|
|
||||||
|
protocol device {
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol kernel kernel4 {
|
||||||
|
ipv4 {
|
||||||
|
import none;
|
||||||
|
export all;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol kernel kernel6 {
|
||||||
|
ipv6 {
|
||||||
|
import none;
|
||||||
|
export all;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
services.birdwatcher = {
|
||||||
|
enable = true;
|
||||||
|
settings = ''
|
||||||
|
[server]
|
||||||
|
allow_from = []
|
||||||
|
allow_uncached = false
|
||||||
|
modules_enabled = ["status",
|
||||||
|
"protocols",
|
||||||
|
"protocols_bgp",
|
||||||
|
"protocols_short",
|
||||||
|
"routes_protocol",
|
||||||
|
"routes_peer",
|
||||||
|
"routes_table",
|
||||||
|
"routes_table_filtered",
|
||||||
|
"routes_table_peer",
|
||||||
|
"routes_filtered",
|
||||||
|
"routes_prefixed",
|
||||||
|
"routes_noexport",
|
||||||
|
"routes_pipe_filtered_count",
|
||||||
|
"routes_pipe_filtered"
|
||||||
|
]
|
||||||
|
[status]
|
||||||
|
reconfig_timestamp_source = "bird"
|
||||||
|
reconfig_timestamp_match = "# created: (.*)"
|
||||||
|
filter_fields = []
|
||||||
|
[bird]
|
||||||
|
listen = "0.0.0.0:29184"
|
||||||
|
config = "/etc/bird/bird2.conf"
|
||||||
|
birdc = "${pkgs.bird}/bin/birdc"
|
||||||
|
ttl = 5 # time to live (in minutes) for caching of cli output
|
||||||
|
[parser]
|
||||||
|
filter_fields = []
|
||||||
|
[cache]
|
||||||
|
use_redis = false # if not using redis cache, activate housekeeping to save memory!
|
||||||
|
[housekeeping]
|
||||||
|
interval = 5
|
||||||
|
force_release_memory = true
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
testScript = ''
|
||||||
|
start_all()
|
||||||
|
|
||||||
|
host1.wait_for_unit("bird2.service")
|
||||||
|
host1.wait_for_unit("birdwatcher.service")
|
||||||
|
host1.wait_for_open_port(29184)
|
||||||
|
host1.succeed("curl http://[::]:29184/status | jq -r .status.message | grep 'Daemon is up and running'")
|
||||||
|
host1.succeed("curl http://[::]:29184/protocols | jq -r .protocols.device1.state | grep 'up'")
|
||||||
|
'';
|
||||||
|
}
|
Loading…
Reference in New Issue
Block a user