Erich Blume
b97e37543f
## Summary - Add Snowflake proxy as a native systemd service on ringtail (NixOS) - Uses `pkgs.snowflake` from nixpkgs (v2.11.0) - Hardened systemd unit with DynamicUser, ProtectSystem=strict, 512MB memory limit - Prometheus metrics enabled on localhost:9999 ## What is Snowflake? A Tor pluggable transport that helps censored users reach the Tor network via WebRTC. **This is NOT a Tor exit node** — traffic exits through Tor exit nodes operated by others. The proxy operator cannot see traffic content (double-encrypted) and destination servers never see the proxy's IP. ## Changes - `nixos/ringtail/configuration.nix` — new systemd service definition - `docs/reference/services/snowflake-proxy.md` — service reference card - `docs/reference/infrastructure/ringtail.md` — updated systemd services section - `service-versions.yaml` — added entry (type: nixos) ## Deploy plan After review, deploy via `mise run provision-ringtail`. Service starts automatically. ## Test plan - [ ] `mise run provision-ringtail` succeeds - [ ] `ssh ringtail 'systemctl status snowflake-proxy'` shows active - [ ] `ssh ringtail 'journalctl -u snowflake-proxy --no-pager -n 20'` shows broker connections - [ ] `ssh ringtail 'curl -s localhost:9999/metrics'` returns Prometheus metrics Reviewed-on: #311
33 lines
1.3 KiB
YAML
33 lines
1.3 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: monitoring
|
|
|
|
resources:
|
|
- ingress-tailscale.yaml
|
|
- external-secret-admin.yaml
|
|
- external-secret-teslamate-datasource.yaml
|
|
- external-secret-authentik-oauth.yaml
|
|
# Dashboard ConfigMaps - discovered by Grafana sidecar via label grafana_dashboard=1
|
|
- dashboards/configmap-borgmatic.yaml
|
|
- dashboards/configmap-devpi.yaml
|
|
- dashboards/configmap-loki.yaml
|
|
- dashboards/configmap-macos.yaml
|
|
- dashboards/configmap-kubernetes.yaml
|
|
- dashboards/configmap-jellyfin.yaml
|
|
- dashboards/configmap-postgresql.yaml
|
|
- dashboards/configmap-ringtail.yaml
|
|
- dashboards/configmap-zot.yaml
|
|
- dashboards/configmap-frigate.yaml
|
|
- dashboards/configmap-transmission.yaml
|
|
- dashboards/configmap-cv-apm.yaml
|
|
- dashboards/configmap-docs-apm.yaml
|
|
- dashboards/configmap-flyio.yaml
|
|
- dashboards/configmap-sifaka-disks.yaml
|
|
- dashboards/configmap-forgejo.yaml
|
|
- dashboards/configmap-tempo.yaml
|
|
- dashboards/configmap-alerts.yaml
|
|
- dashboards/configmap-snowflake-proxy.yaml
|
|
# TeslaMate dashboards are fetched by the init-teslamate-dashboards init
|
|
# container in the Grafana deployment, sourced from mirrors/teslamate on forge.
|
|
# See argocd/manifests/grafana/deployment.yaml for the version pin.
|