hosts/VEGAS: add monitoring service

hosts/VEGAS/services/monitoring/default.nix

@@ -0,0 +1,102 @@
+{ config, hosts, lib, tools, ... }:
+let
+  inherit (tools.meta) domain;
+
+  inherit (config) ports portsStr;
+
+  toString' = v:
+    if v == true then "true" else
+    if v == false then "false" else
+    toString v;
+
+  mapPaths = lib.mapAttrsRecursive (
+    path: value: lib.nameValuePair
+      (lib.toUpper (lib.concatStringsSep "_" path))
+      (toString' value)
+  );
+
+  translateConfig = config: lib.listToAttrs (
+    lib.collect
+      (x: x ? name && x ? value)
+      (mapPaths config)
+  );
+
+  login = x: "https://login.${domain}/auth/realms/master/protocol/openid-connect/${x}";
+
+  filteredHosts = lib.filterAttrs (_: host: host ? hypr && host ? nixos) hosts;
+in
+{
+  age.secrets.grafana-secrets = {
+    file = ../../../../secrets/grafana-secrets.age;
+  };
+
+  reservePortsFor = [ "grafana" "prometheus" ];
+  services.grafana = {
+    enable = true;
+    port = ports.grafana;
+    rootUrl = "https://monitoring.${domain}/";
+    dataDir = "/srv/storage/private/grafana";
+    analytics.reporting.enable = false;
+    extraOptions = translateConfig {
+      auth.generic_oauth = {
+        enabled = true;
+        allow_sign_up = true;
+        client_id = "net.privatevoid.monitoring1";
+        auth_url = login "auth";
+        token_url = login "token";
+        api_url = login "userinfo";
+        scopes = [ "openid" "profile" "email" "roles" ];
+        role_attribute_strict = true;
+        role_attribute_path = "resource_access.monitoring.roles[0]";
+      };
+      security = {
+        cookie_secure = true;
+        disable_gravatar = true;
+      };
+    };
+    provision = {
+      enable = true;
+      datasources = [
+        {
+          name = "Prometheus";
+          url = "http://127.0.0.1:${portsStr.prometheus}";
+          type = "prometheus";
+          isDefault = true;
+        }
+      ];
+    };
+  };
+
+  systemd.services.grafana.serviceConfig = {
+    EnvironmentFile = config.age.secrets.grafana-secrets.path;
+  };
+
+  services.nginx.virtualHosts."monitoring.${domain}" = tools.nginx.vhosts.proxy "http://127.0.0.1:${portsStr.grafana}";
+
+  services.prometheus = {
+    enable = true;
+    listenAddress = "127.0.0.1";
+    port = ports.prometheus;
+    globalConfig = {
+      scrape_interval = "60s";
+    };
+    scrapeConfigs = [
+      {
+        job_name = "node";
+        static_configs = lib.flip lib.mapAttrsToList filteredHosts (name: host: {
+          targets = [ "${host.hypr.addr}:9100" ];
+          labels.instance = name;
+        });
+      }
+      {
+        job_name = "jitsi";
+        static_configs = [
+          {
+            targets = [ "${hosts.prophet.hypr.addr}:9700" ];
+            labels.instance = "meet.${domain}";
+          }
+        ];
+      }
+    ];
+  };
+}

hosts/VEGAS/system.nix

@@ -31,6 +31,7 @@
       ./services/mail
       ./services/matrix
       ./services/minecraft
+      ./services/monitoring
       ./services/nix/binary-cache.nix
       ./services/nix/nar-serve.nix
       ./services/object-storage

secrets/grafana-secrets.age

@@ -0,0 +1,12 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A 2qivuJRscNgO3c+hS8ZkTLdWGKsswTt8qmxM9Uhyixw
+5JbWwwzRFK9uc/6BDgQyWo+6vinZ0E3jf3Bk8nao6Rk
+-> ssh-ed25519 5/zT0w h4WIKhb3AU4FSLr0qLbhK0oLfk531cihqz0IVcXLbFU
+weLZXuXV/A5II8ZP5hzCbhwN1IT0eAlBhKFHlCHaGks
+-> ssh-ed25519 d3WGuA jejKXO17+U/JEdNZQW/0XfUOo3IxH3Di+5gUUCN4zAQ
+5mwkp9+UzTiOWjE+X70egHPU13Iy4xoZS4t/vpO9cE4
+-> C%-grease 6,+fR
+0CJQ4acXn9gqgkyG9B6DG8+VotwqXw
+--- TFou/6wFh0Fcs5KNETBdIKgVxN1EpLufRLADO6vEWyI
+ôçNGDK™©¦¥²“™<E2809C>©§°@o¯nËBÄŠ¨/—Z³§CÜÇœsÅî3µ÷'·jzb§v¸ÓŨõÊ›	µZZžS<C5BE>"-p´<70>E-®¯<çÖ-¤UU)Y½½
+y¾éØW¨iSN ‰

secrets/secrets.nix

@@ -14,6 +14,7 @@ in with hosts;
   "gitlab-secret-jws.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "gitlab-secret-otp.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "gitlab-secret-secret.age".publicKeys = max ++ map systemKeys [ VEGAS ];
+  "grafana-secrets.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "hci-cache-config.age".publicKeys = max ++ map systemKeys [ VEGAS prophet ];
   "hci-cache-credentials-prophet.age".publicKeys = max ++ map systemKeys [ prophet ];
   "hci-cache-credentials-VEGAS.age".publicKeys = max ++ map systemKeys [ VEGAS ];