Nix Podman Stacks
Search K

Appearance

beszel ​

Lightweight server monitoring platform

Example ​

nix
{config, ...}: {
  nps.stacks.beszel = {
    enable = true;
    ed25519PrivateKeyFile = config.sops.secrets."beszel/ssh_key".path;
    ed25519PublicKeyFile = config.sops.secrets."beszel/ssh_pub_key".path;
    tokenFile = config.sops.secrets."beszel/token".path;
    adminProvisioning = {
      email = "admin@example.com";
      passwordFile = config.sops.secrets."beszel/admin_password".path;
    };
    oidc = {
      registerClient = true;
      clientSecretHash = "$pbkdf2-sha512$...";
    };
  };
}

Stack Options ​

nps.stacks.beszel.adminProvisioning.email ​

Email address for the initial admin user

Type
plaintext
string
Declaration
<nps/modules/beszel>

nps.stacks.beszel.adminProvisioning.passwordFile ​

Path to a file containing the initial admin user password.

Type
plaintext
absolute path
Declaration
<nps/modules/beszel>

nps.stacks.beszel.containers.beszel ​

Alias of {option}services.podman.containers.beszel.

Type
plaintext
submodule
Declaration
<nps/modules/beszel>

nps.stacks.beszel.containers.beszel-agent ​

Alias of {option}services.podman.containers.beszel-agent.

Type
plaintext
submodule
Declaration
<nps/modules/beszel>

nps.stacks.beszel.ed25519PrivateKeyFile ​

Path to private SSH key that will be used by the hub to authenticate against agent

Type
plaintext
absolute path
Declaration
<nps/modules/beszel>

nps.stacks.beszel.ed25519PublicKeyFile ​

Path to public SSH key of the hub that will be considered authorized by agent

Type
plaintext
absolute path
Declaration
<nps/modules/beszel>

nps.stacks.beszel.enable ​

Whether to enable beszel.

Type
plaintext
boolean
Default
nix
false
Example
nix
true
Declaration
<nps/modules/beszel>

nps.stacks.beszel.oidc.clientSecretHash ​

The client secret hash. For examples on how to generate a client secret, see

https://www.authelia.com/integration/openid-connect/frequently-asked-questions/#client-secret

The value can be passed in multiple ways:

  1. As a literal string
  2. As an absolute path to a file containing the hash (toFile)
  3. As an absolute oath to a file containing the client_secret, in which case the hash will be automatically computed (toHash)
Type
plaintext
string or (submodule)
Example
nix
# Literal String:
"$pbkdf2-sha512$310000$cbOAIWbfz3vCVXIPIp6d2A$J0klwULa6TvPRCU1HAfuKua/dMKTl8gbTYJz2N73ejGUu0LUGz/y3kwmJLuKuAYGg3WQOT0q9ZzVHHUvpKpgvQ"

# Client secret hash stored in a file
{ fromFile = config.sops.secrets."immich/client_secret_hash".path; }

# Client secret stored in a file: Hash will be computed dynamically
{ toHash = config.sops.secrets."immich/client_secret".path; }
Declaration
<nps/modules/beszel>

nps.stacks.beszel.oidc.registerClient ​

Whether to register a Beszel OIDC client in Authelia. If enabled you need to provide a hashed secret in the client_secret option.

To enable OIDC Login for Beszel, you will have to set it up in Beszels Web-UI. For details, see:

Type
plaintext
boolean
Default
nix
false
Declaration
<nps/modules/beszel>

nps.stacks.beszel.oidc.userGroup ​

Users of this group will be able to log in

Type
plaintext
string
Default
nix
"beszel_user"
Declaration
<nps/modules/beszel>

nps.stacks.beszel.settings ​

System configuration (optional). If provided, on each restart, systems in the database will be updated to match the systems defined in the settings. To see your current configuration, refer to settings -> YAML Config -> Export configuration.

The module will configure a single system called "Local" that connects to the Beszel hub through the beszel socket.

The config will be templated using gomplate, so you can refer to secrets etc.

Type
plaintext
null or YAML 1.1 value
Default
nix
null
Example
nix
{
  systems = [
    {
      host = "some.remote.host";
      name = "Some Remote System";
      token = "{{ file.Read `\${config.sops.secrets.\"BESZEL_REMOTE_TOKEN\".path}`}}";
      users = [
        "admin@example.com"
      ];
    }
  ];
}
Declaration
<nps/modules/beszel>

nps.stacks.beszel.tokenFile ​

Path to a file containing the Beszel token (UUIDv4). The token is used by the agent to self-register itself at the hub. Can be generated using uuidgen

Type
plaintext
absolute path
Declaration
<nps/modules/beszel>

nps.stacks.beszel.useSocketProxy ​

Whether to access the Podman socket through the read-only proxy for the beszel stack. Will be enabled by default if the 'docker-socket-proxy' stack is enabled.

Type
plaintext
boolean
Default
nix
config.nps.stacks.docker-socket-proxy.enable
Declaration
<nps/modules/beszel>