mazex/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(services): healthchecks + noms de ressources alignes (audiobookshelf, gotify, jellyfin, radarr, gitea, hermes-*)

Browse Source
This commit is contained in:
Hermes Agent
2026-10-06 21:42:04 -04:00
parent 8fa2497391
commit 667a76799b
9 changed files with 183 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/audiobookshelf/default.nix
+15 -1
View File
@@ -40,7 +40,7 @@
# (le Pangolin de ce VPS ignore silencieusement `public-resources`/`mode`,
# cf. services/newt). Pas d'auth Pangolin : audiobookshelf a sa propre auth.
services.newt.blueprint.proxy-resources.audiobookshelf = {
name = "Audiobookshelf";
name = "audiobookshelf";
protocol = "http";
full-domain = "audiobookshelf.marcpartensky.com";
targets = [
@@ -48,6 +48,20 @@
hostname = "127.0.0.1";
port = 8000;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = 8000;
path = "/healthcheck";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
services/gitea/default.nix
+15 -1
View File
@@ -144,7 +144,7 @@ in {
# / hermes-dashboard sur ce contrôleur Pangolin, cf. selfhosted-remote-access
# / references/pangolin-blueprint.md).
services.newt.blueprint.proxy-resources.gitea = {
name = "Gitea";
name = "gitea";
protocol = "http";
full-domain = "git.marcpartensky.com";
auth.sso-enabled = true;
@@ -153,6 +153,20 @@ in {
hostname = "127.0.0.1";
port = config.services.gitea.settings.server.HTTP_PORT;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = config.services.gitea.settings.server.HTTP_PORT;
path = "/api/healthz";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
services/gotify/default.nix
+15 -1
View File
@@ -116,7 +116,7 @@
# Exposition via Pangolin (newt blueprint) -> gotify.marcpartensky.com
services.newt.blueprint.proxy-resources.gotify = {
name = "Gotify notifications";
name = "gotify";
protocol = "http";
full-domain = "gotify.marcpartensky.com";
auth.sso-enabled = true;
@@ -125,6 +125,20 @@
hostname = "127.0.0.1";
port = 8070;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = 8070;
path = "/health";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
services/hermes-dashboard/default.nix
+15 -1
View File
@@ -77,7 +77,7 @@ in {
# NB : cle `proxy-resources` + `protocol` (schema attendu par le Pangolin du
# VPS), cf. le commentaire detaille dans services/newt.
services.newt.blueprint.proxy-resources.hermes-terminal = {
name = "Terminal web Hermes";
name = "hermes-terminal";
protocol = "http";
full-domain = "terminal.marcpartensky.com";
auth.sso-enabled = true;
@@ -86,6 +86,20 @@ in {
hostname = "127.0.0.1";
port = proxyPort;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = proxyPort;
path = "/";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
services/hermes-pocket/default.nix
+15 -1
View File
@@ -89,7 +89,7 @@ in {
# connecter (SSO navigateur impossible), exactement comme la ressource
# jellyfin. La cible reste loopback, seul nginx est publié.
services.newt.blueprint.proxy-resources.hermes-pocket = {
name = "Hermes Pocket (appli mobile)";
name = "hermes-pocket";
protocol = "http";
full-domain = "hermes-mobile.marcpartensky.com";
targets = [
@@ -97,6 +97,20 @@ in {
hostname = "127.0.0.1";
port = proxyPort;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = proxyPort;
path = "/";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
services/hermes-webui/default.nix
+15 -1
View File
@@ -124,7 +124,7 @@ in {
# deja hermes.marcpartensky.com cote VPS (cible tower:10274, port mort).
# Tant qu'elle existe, deux routers Traefik viseront le meme host.
services.newt.blueprint.proxy-resources.hermes-webui = {
name = "Chat web Hermes";
name = "hermes-webui";
protocol = "http";
full-domain = "hermes.marcpartensky.com";
auth.sso-enabled = true;
@@ -133,6 +133,20 @@ in {
hostname = "127.0.0.1";
port = proxyPort;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = proxyPort;
path = "/";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
services/jellyfin/default.nix
+15 -1
View File
@@ -57,7 +57,7 @@
# Pas d'auth Pangolin : Jellyfin a sa propre authentification et les apps
# natives (Roku, mobile) ne savent pas passer un SSO par navigateur.
services.newt.blueprint.proxy-resources.jellyfin = {
name = "Jellyfin";
name = "jellyfin";
protocol = "http";
full-domain = "jellyfin.marcpartensky.com";
targets = [
@@ -65,6 +65,20 @@
hostname = "127.0.0.1";
port = 8096;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = 8096;
path = "/health";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
services/newt/default.nix
+63 -1
View File
@@ -13,6 +13,22 @@
enable = true;
environmentFile = config.sops.secrets.newt_env.path;
# Ressource publique Winnie : front (Dioxus UI, developpement local :8080).
# Le domaine public sert le front ; le backend est deplace sur api.*.
blueprint.proxy-resources.winnie-frontend = {
name = "winnie-frontend";
protocol = "http";
full-domain = "winnie.marcpartensky.com";
auth.sso-enabled = false;
targets = [
{
hostname = "127.0.0.1";
port = 8080;
method = "http";
}
];
};
# Ressource publique Pangolin : le client noVNC de tower (wayvnc + websockify,
# cf. modules/home/wayvnc). HTTP + SSO, donc aucune contrainte de version de
# newt (le mode VNC natif de Pangolin exigerait newt > 1.13, et tower est en
@@ -26,8 +42,37 @@
# + le champ `protocol`. `public-resources`/`mode` (doc actuelle) sont
# ignores SILENCIEUSEMENT par le serveur -> ressource jamais creee, et
# Traefik repond 404 sur le domaine. Verifie le 26/09/2026.
# Ressource publique Winnie (backend Rust/Axum, reverse proxy).
blueprint.proxy-resources.winnie-backend = {
name = "winnie-backend";
protocol = "http";
full-domain = "api.winnie.marcpartensky.com";
auth.sso-enabled = false; # l'app mobile ne peut pas suivre une redirection SSO
targets = [
{
hostname = "127.0.0.1";
port = 8787;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = 8787;
path = "/healthz";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
blueprint.proxy-resources.novnc-tower = {
name = "noVNC tower";
name = "vnc";
protocol = "http";
full-domain = "vnc.marcpartensky.com";
auth.sso-enabled = true;
@@ -36,6 +81,23 @@
hostname = "127.0.0.1";
port = 6080;
method = "http";
# noVNC sert son client sur /vnc.html : "/" repond 404 (mesure du
# 28/09/2026), donc un healthcheck sur "/" marquerait la cible
# unhealthy et Pangolin la sortirait du load-balancer.
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = 6080;
path = "/vnc.html";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};
services/radarr/default.nix
+15 -1
View File
@@ -50,7 +50,7 @@
# "DisabledForLocalAddresses" ne filtrerait RIEN. Sans SSO, l'UI complete et
# l'API v3 (qui suffit a piloter Radarr) seraient ouvertes a Internet.
services.newt.blueprint.proxy-resources.radarr = {
name = "Radarr";
name = "radarr";
protocol = "http";
full-domain = "radarr.marcpartensky.com";
auth.sso-enabled = true;
@@ -59,6 +59,20 @@
hostname = "127.0.0.1";
port = 8086;
method = "http";
healthcheck = {
enabled = true;
hostname = "127.0.0.1";
port = 8086;
path = "/ping";
scheme = "http";
mode = "http";
method = "GET";
interval = 30;
unhealthy-interval = 30;
timeout = 5;
healthy-threshold = 1;
unhealthy-threshold = 3;
};
}
];
};