Erich Blume
b97e37543f
## Summary - Add Snowflake proxy as a native systemd service on ringtail (NixOS) - Uses `pkgs.snowflake` from nixpkgs (v2.11.0) - Hardened systemd unit with DynamicUser, ProtectSystem=strict, 512MB memory limit - Prometheus metrics enabled on localhost:9999 ## What is Snowflake? A Tor pluggable transport that helps censored users reach the Tor network via WebRTC. **This is NOT a Tor exit node** — traffic exits through Tor exit nodes operated by others. The proxy operator cannot see traffic content (double-encrypted) and destination servers never see the proxy's IP. ## Changes - `nixos/ringtail/configuration.nix` — new systemd service definition - `docs/reference/services/snowflake-proxy.md` — service reference card - `docs/reference/infrastructure/ringtail.md` — updated systemd services section - `service-versions.yaml` — added entry (type: nixos) ## Deploy plan After review, deploy via `mise run provision-ringtail`. Service starts automatically. ## Test plan - [ ] `mise run provision-ringtail` succeeds - [ ] `ssh ringtail 'systemctl status snowflake-proxy'` shows active - [ ] `ssh ringtail 'journalctl -u snowflake-proxy --no-pager -n 20'` shows broker connections - [ ] `ssh ringtail 'curl -s localhost:9999/metrics'` returns Prometheus metrics Reviewed-on: #311
323 lines
10 KiB
YAML
323 lines
10 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: grafana-dashboard-snowflake-proxy
|
|
namespace: monitoring
|
|
labels:
|
|
grafana_dashboard: "1"
|
|
data:
|
|
snowflake-proxy.json: |
|
|
{
|
|
"annotations": { "list": [] },
|
|
"editable": true,
|
|
"fiscalYearStartMonth": 0,
|
|
"graphTooltip": 1,
|
|
"id": null,
|
|
"links": [],
|
|
"panels": [
|
|
{
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": { "mode": "thresholds" },
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{ "color": "green", "value": null }
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
|
|
"id": 1,
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"textMode": "auto",
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }
|
|
},
|
|
"title": "Total Connections",
|
|
"type": "stat",
|
|
"targets": [
|
|
{
|
|
"expr": "sum(tor_snowflake_proxy_connections_total)",
|
|
"legendFormat": "connections",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": { "mode": "thresholds" },
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{ "color": "green", "value": null }
|
|
]
|
|
},
|
|
"unit": "bytes"
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
|
|
"id": 2,
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"textMode": "auto",
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }
|
|
},
|
|
"title": "Total Traffic (Inbound)",
|
|
"type": "stat",
|
|
"targets": [
|
|
{
|
|
"expr": "tor_snowflake_proxy_traffic_inbound_bytes_total",
|
|
"legendFormat": "inbound",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": { "mode": "thresholds" },
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{ "color": "blue", "value": null }
|
|
]
|
|
},
|
|
"unit": "bytes"
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": { "h": 4, "w": 6, "x": 12, "y": 0 },
|
|
"id": 3,
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"textMode": "auto",
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }
|
|
},
|
|
"title": "Total Traffic (Outbound)",
|
|
"type": "stat",
|
|
"targets": [
|
|
{
|
|
"expr": "tor_snowflake_proxy_traffic_outbound_bytes_total",
|
|
"legendFormat": "outbound",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": { "mode": "thresholds" },
|
|
"mappings": [],
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{ "color": "orange", "value": null }
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": { "h": 4, "w": 6, "x": 18, "y": 0 },
|
|
"id": 4,
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "area",
|
|
"justifyMode": "auto",
|
|
"textMode": "auto",
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false }
|
|
},
|
|
"title": "Connection Timeouts",
|
|
"type": "stat",
|
|
"targets": [
|
|
{
|
|
"expr": "tor_snowflake_proxy_connection_timeouts_total",
|
|
"legendFormat": "timeouts",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": { "mode": "palette-classic" },
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "",
|
|
"drawStyle": "line",
|
|
"fillOpacity": 20,
|
|
"lineWidth": 2,
|
|
"pointSize": 5,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"stacking": { "group": "A", "mode": "none" }
|
|
},
|
|
"unit": "cps"
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 4 },
|
|
"id": 5,
|
|
"options": {
|
|
"legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom" },
|
|
"tooltip": { "mode": "multi", "sort": "desc" }
|
|
},
|
|
"title": "Connection Rate",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"expr": "rate(tor_snowflake_proxy_connections_total[5m])",
|
|
"legendFormat": "{{ country }}",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": { "mode": "palette-classic" },
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "",
|
|
"drawStyle": "line",
|
|
"fillOpacity": 20,
|
|
"lineWidth": 2,
|
|
"pointSize": 5,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"stacking": { "group": "A", "mode": "none" }
|
|
},
|
|
"unit": "Bps"
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 4 },
|
|
"id": 6,
|
|
"options": {
|
|
"legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom" },
|
|
"tooltip": { "mode": "multi", "sort": "desc" }
|
|
},
|
|
"title": "Traffic Rate",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"expr": "rate(tor_snowflake_proxy_traffic_inbound_bytes_total[5m])",
|
|
"legendFormat": "inbound",
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"expr": "rate(tor_snowflake_proxy_traffic_outbound_bytes_total[5m])",
|
|
"legendFormat": "outbound",
|
|
"refId": "B"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": { "mode": "palette-classic" },
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "",
|
|
"drawStyle": "bars",
|
|
"fillOpacity": 80,
|
|
"lineWidth": 1,
|
|
"pointSize": 5,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"stacking": { "group": "A", "mode": "normal" }
|
|
}
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 12 },
|
|
"id": 7,
|
|
"options": {
|
|
"legend": { "calcs": ["sum"], "displayMode": "table", "placement": "right", "sortBy": "Total", "sortDesc": true },
|
|
"tooltip": { "mode": "multi", "sort": "desc" }
|
|
},
|
|
"title": "Connections by Country",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"expr": "increase(tor_snowflake_proxy_connections_total[1h])",
|
|
"legendFormat": "{{ country }}",
|
|
"refId": "A"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"datasource": { "type": "prometheus", "uid": "prometheus" },
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"color": { "mode": "palette-classic" },
|
|
"custom": {
|
|
"axisBorderShow": false,
|
|
"axisCenteredZero": false,
|
|
"axisLabel": "",
|
|
"drawStyle": "line",
|
|
"fillOpacity": 10,
|
|
"lineWidth": 2,
|
|
"pointSize": 5,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"stacking": { "group": "A", "mode": "none" }
|
|
},
|
|
"unit": "bytes"
|
|
},
|
|
"overrides": []
|
|
},
|
|
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 12 },
|
|
"id": 8,
|
|
"options": {
|
|
"legend": { "calcs": ["lastNotNull"], "displayMode": "table", "placement": "bottom" },
|
|
"tooltip": { "mode": "multi", "sort": "desc" }
|
|
},
|
|
"title": "Process Memory",
|
|
"type": "timeseries",
|
|
"targets": [
|
|
{
|
|
"expr": "process_resident_memory_bytes{job=\"snowflake_proxy\"}",
|
|
"legendFormat": "RSS",
|
|
"refId": "A"
|
|
},
|
|
{
|
|
"expr": "process_virtual_memory_bytes{job=\"snowflake_proxy\"}",
|
|
"legendFormat": "Virtual",
|
|
"refId": "B"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"schemaVersion": 39,
|
|
"tags": ["snowflake", "tor", "anti-censorship"],
|
|
"templating": { "list": [] },
|
|
"time": { "from": "now-24h", "to": "now" },
|
|
"timepicker": {},
|
|
"timezone": "browser",
|
|
"title": "Snowflake Proxy",
|
|
"uid": "snowflake-proxy",
|
|
"version": 1
|
|
}
|