This repository has no description
2.0 kB
51 lines
1# sigexec dashboard: one page + executor registry + reverse proxy (no key
2# material, no job data). nginx terminates TLS and forwards to it; the
3# executors themselves live in ./executor.nix on each machine.
4# browser: https://sigexec.lassul.us (register passkeys at /register)
5# CLI: sigexec run -x https://sigexec.lassul.us/x/neoprism -- uptime
6# (statements sign the path relative to the base URL, so the executor
7# verifies /jobs after the proxy strips /x/neoprism)
8let
9 domain = "sigexec.lassul.us";
10 dashboardPort = 7501;
11 # Must match 2configs/sigexec/executor.nix.
12 executorPort = 7601;
13in
14{ self, ... }:
15{
16 imports = [ self.inputs.sigexec.nixosModules.dashboard ];
17
18 services.sigexec-dashboard = {
19 enable = true;
20 rpId = domain;
21 port = dashboardPort;
22 executors = {
23 # this host's own executor (neoprism also imports ./executor.nix)
24 neoprism = "http://127.0.0.1:${toString executorPort}";
25 # reached over retiolum (executor port is open on that interface only)
26 coaxmetal = "http://coaxmetal.r:${toString executorPort}";
27 icarus = "http://icarus.r:${toString executorPort}";
28 shodan = "http://shodan.r:${toString executorPort}";
29 # starkstrom is not in the shared kartei registry yet, so the fleet has
30 # no retiolum route to it; its own nginx terminates TLS and strips the
31 # /sigexec prefix (machines/starkstrom/config.nix).
32 starkstrom = "https://starkstrom.lassul.us/sigexec";
33 };
34 };
35
36 services.nginx.virtualHosts.${domain} = {
37 enableACME = true;
38 forceSSL = true;
39 locations."/" = {
40 proxyPass = "http://127.0.0.1:${toString dashboardPort}";
41 extraConfig = ''
42 # Job streams are long-lived chunked responses: unbuffered so output
43 # arrives live, and a generous read timeout because `logs` on a
44 # pending job legitimately blocks until someone approves it.
45 proxy_buffering off;
46 proxy_read_timeout 1d;
47 proxy_send_timeout 1d;
48 '';
49 };
50 };
51}