Archived

This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 cded77919d

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s

Details

refactor: full repo sweep — variables, docs, and comment cleanup

- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath,
  extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp,
  ports.dns; ipaServer now derives from homeDomain ref; section headers
- modules: use new vars throughout (pxe-boot, ts-dns-forwarder,
  cluster-config, configuration.nix, mount-pxe-images) — eval unchanged
- docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit,
  network-cutover); add docs/ha.md; drop migration reference table from
  ip-addressing.md; remove stale server example from beszel.md
- CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router,
  ha-server, drop server); document scripts/ha/, scripts/ipa/, and
  all previously undocumented top-level and lib scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-30 06:28:52 +10:00

2.9 KiB

Raw Permalink Blame History

Beszel agent

Beszel is the monitoring dashboard used in this LAN. The hub runs as a Docker container on docker.sweet.home (port vars.ports.beszelHub, 8090). Each monitored NixOS host runs a beszel-agent that connects back to the hub.

How it works

Everything is handled by a single module:

modules/beszel/enable-agent.nix — imported by a build type. It:

Enables beszel-agent
Sets HUB_URL to docker.sweet.home:8090
Sets KEY from vars.beszelHubKey (variables.nix) — the hub's SSH public key, shared by every agent. Update beszelHubKey if the docker host is ever rebuilt and the hub generates a new keypair.
Reads the universal beszel-token from secrets/common.yaml via sops and passes it to the agent as TOKEN in an env file
Fixes an upstream bug where the agent couldn't persist its hub-pairing fingerprint across restarts (adds a real StateDirectory)

A host file needs no beszel configuration at all — just import the module in the build type and add the system in the hub UI.

Adding beszel to a new build type

Add ../beszel/enable-agent.nix to the imports list in modules/build-types/<type>.nix:

imports = [
  ../beszel/enable-agent.nix
  # ... other imports
];

That's the only change required. The host file needs nothing.

Adding a new system to the hub

Rebuild and deploy the host with its build type importing enable-agent.nix.
Open the beszel hub (http://docker.sweet.home:8090).
Go to Systems → Add system, enter the host's IP and the default port (45876). The agent will connect and the system will appear as active.

One-time setup: add the token to `secrets/common.yaml`

The universal token is stored once in the common secrets file, shared by all agents. Only needed once, not per-host:

sops secrets/common.yaml

Add:

beszel-token: <token from the beszel hub Settings → Keys>

secrets/common.yaml is already a sops recipient for every host via their SSH host keys, so no additional sops recipient setup is needed.

Optional: monitoring extra filesystems

To report disk usage for a mount beyond the root filesystem, add EXTRA_FILESYSTEMS in the host file:

services.beszel.agent.environment = {
  EXTRA_FILESYSTEMS = "/mnt/data";   # colon-separated for multiple paths
};

Optional: monitoring Docker containers

enable-agent.nix has a commented-out line for Docker monitoring:

#DOCKER_HOST = "tcp://docker-socket-proxy:2375";

Uncomment it if the host runs docker-socket-proxy and you want per-container stats. Hosts without Docker should leave it commented out.

If the hub key changes

If the docker host is ever rebuilt and beszel generates a new SSH keypair, update beszelHubKey in variables.nix and rebuild all beszel-enabled hosts. The new key is visible in the beszel hub under Settings → Keys.

2.9 KiB Raw Permalink Blame History