Add monitoring profile: Grafana + Prometheus + Loki + Alloy

Native NixOS modules under my.profiles.monitoring, enabled on jupiter. Grafana provisions datasources/dashboards/alert rules from the grafana-content flake input (rechberg dashboards repo). Prometheus scrapes host + stack (90d), Loki+Alloy ship the systemd journal (90d). Grafana LAN-only :3000, anonymous viewer, admin password + secret_key via /etc/grafana file providers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZJkwCnSbykq9rRTTeHc6b
2026-08-07 10:25:04 +02:00
parent e9a5781944
commit 1643690124
9 changed files with 282 additions and 0 deletions
@@ -0,0 +1,51 @@
+# Grafana Alloy: ships the full systemd journal to Loki.
+# The nixpkgs module reads /etc/alloy/*.alloy and already runs with the
+# systemd-journal supplementary group. Alloy exposes /metrics + UI on :12345.
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.monitoring;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.alloy.enable = true;
+
+    environment.etc."alloy/config.alloy".text = ''
+      loki.source.journal "journal" {
+        max_age       = "24h"
+        forward_to    = [loki.write.local.receiver]
+        relabel_rules = loki.relabel.journal.rules
+        labels        = { host = "jupiter" }
+      }
+
+      loki.relabel "journal" {
+        forward_to = []
+        rule {
+          source_labels = ["__journal__systemd_unit"]
+          target_label  = "unit"
+        }
+        rule {
+          source_labels = ["__journal_priority_keyword"]
+          target_label  = "priority"
+        }
+        rule {
+          source_labels = ["__journal__transport"]
+          target_label  = "transport"
+        }
+        rule {
+          source_labels = ["__journal__boot_id"]
+          target_label  = "boot_id"
+        }
+      }
+
+      loki.write "local" {
+        endpoint {
+          url = "http://127.0.0.1:3100/loki/api/v1/push"
+        }
+      }
+    '';
+  };
+}