flora: monit via ntfy sh

so it turns out ntfy can run a little smtp server, which monit can send
its alerts to, resulting in a halfway okayish monitoring setup. It
doesn't even require mucking about with `sendmail'!

Downside: this is still monit.

Upside: from what I've heard, the other monitoring tools don't actually
seem to be all that much better?

Now I only have to come up with reasonable checks for the stuff I want
to actually keep an eye on …

3 files changed, 40 insertions, 0 deletions

diff --git a/flora/configuration.nix b/flora/configuration.nix
index 9f2eb82..40cd3a5 100644
--- a/flora/configuration.nix
+++ b/flora/configuration.nix
@@ -12,6 +12,7 @@
     ./services/element.nix
     ./services/ntfy.nix
     ./services/murmur.nix
+    ./services/monit.nix
   ];
   
   # Use the GRUB 2 boot loader.
diff --git a/flora/services/monit.nix b/flora/services/monit.nix
new file mode 100644
index 0000000..c8f7b3f
--- /dev/null
+++ b/flora/services/monit.nix
@@ -0,0 +1,32 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # includes mail address, which includes ntfy token
+  sops.secrets."monit/mail" = {};
+
+  services.monit = {
+    enable = true;
+
+    config = ''
+      include /run/secrets/monit/mail
+
+      set daemon 120 with start delay 60
+      set mailserver
+          localhost
+          port 2525
+
+      set httpd port 2812 and use address localhost
+          allow localhost
+          allow admin:obwjoawijerfoijsiwfj29jf2f2jd
+
+      check filesystem root with path /
+            if space usage > 80% then alert
+            if inode usage > 80% then alert
+
+      check host stuebinm.eu with address stuebinm.eu
+            if failed
+              port 443 protocol https
+            then alert
+    '';
+  };
+}
diff --git a/flora/services/ntfy.nix b/flora/services/ntfy.nix
index cda212d..45dcb3c 100644
--- a/flora/services/ntfy.nix
+++ b/flora/services/ntfy.nix
@@ -10,6 +10,9 @@
       listen-unix = "/run/ntfy-sh/ntfy.sock";
       listen-unix-mode = 511; ## lossy nix->yaml conversion eats octal literals (equal to 0777)
 
+      smtp-server-listen = ":2525";
+      smtp-server-domain = "ping.stuebinm.eu";
+
       auth-file = "/var/lib/ntfy-sh/user.db";
       auth-default-access = "deny-all";
 
@@ -32,4 +35,8 @@
       RuntimeDirectory = [ "ntfy-sh" ];
     };
   };
+
+  environment.etc."ntfy/client.yml".text = ''
+    default-host: https://ping.stuebinm.eu
+  '';
 }