Add monitoring profile: Grafana + Prometheus + Loki + Alloy

Native NixOS modules under my.profiles.monitoring, enabled on jupiter. Grafana provisions datasources/dashboards/alert rules from the grafana-content flake input (rechberg dashboards repo). Prometheus scrapes host + stack (90d), Loki+Alloy ship the systemd journal (90d). Grafana LAN-only :3000, anonymous viewer, admin password + secret_key via /etc/grafana file providers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZJkwCnSbykq9rRTTeHc6b
2026-08-07 10:25:04 +02:00
parent e9a5781944
commit 1643690124
9 changed files with 282 additions and 0 deletions
@@ -0,0 +1,83 @@
+# Grafana service + provisioning from the grafana-content flake input.
+# Provisioning shape verified against nixpkgs 26.05 grafana module:
+#  - datasources.path takes a directory (lndir'd into the provisioning dir)
+#  - dashboard provider is generated here so the store path can be injected
+#  - each alerting resource takes its own YAML *file* (they share one target dir,
+#    so pointing them at a directory would collide)
+{
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  cfg = config.my.profiles.monitoring;
+  content = inputs.grafana-content;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.grafana = {
+      enable = true;
+
+      settings = {
+        server = {
+          http_addr = "0.0.0.0";
+          http_port = 3000;
+          domain = "jupiter.solar.internal";
+          root_url = "http://jupiter.solar.internal:3000/";
+        };
+        security.admin_password = "$__file{/etc/grafana/admin_password}";
+        # 26.05 removed the built-in default; encrypts secrets in Grafana's DB.
+        security.secret_key = "$__file{/etc/grafana/secret_key}";
+        "auth.anonymous" = {
+          enabled = true;
+          org_role = "Viewer";
+        };
+        metrics.enabled = true; # /metrics for Prometheus self-scrape
+        unified_alerting.enabled = true;
+        alerting.enabled = false; # disable legacy alerting
+      };
+
+      provision = {
+        enable = true;
+
+        # static datasources dir → all *.yaml linked in
+        datasources.path = "${content}/provisioning/datasources";
+
+        # dashboard provider generated here with the store path injected
+        dashboards.settings.providers = [
+          {
+            name = "content";
+            type = "file";
+            disableDeletion = true;
+            allowUiUpdates = false;
+            options = {
+              path = "${content}/dashboards";
+              foldersFromFilesStructure = true;
+            };
+          }
+        ];
+
+        # per-resource alerting files (share one target dir → must be files)
+        alerting = {
+          rules.path = "${content}/provisioning/alerting/rules.yaml";
+          contactPoints.path = "${content}/provisioning/alerting/contactpoints.yaml";
+          policies.path = "${content}/provisioning/alerting/policies.yaml";
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 3000 ];
+
+    # Register a homepage-dashboard tile (matches the other profiles).
+    my.homepage.services = [
+      {
+        group = "Monitoring";
+        name = "Grafana";
+        description = "Metrics & logs dashboards";
+        href = "http://jupiter.solar.internal:3000";
+        icon = "grafana.png";
+      }
+    ];
+  };
+}