Add monitoring profile: Grafana + Prometheus + Loki + Alloy

Native NixOS modules under my.profiles.monitoring, enabled on jupiter. Grafana provisions datasources/dashboards/alert rules from the grafana-content flake input (rechberg dashboards repo). Prometheus scrapes host + stack (90d), Loki+Alloy ship the systemd journal (90d). Grafana LAN-only :3000, anonymous viewer, admin password + secret_key via /etc/grafana file providers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZJkwCnSbykq9rRTTeHc6b
2026-08-07 10:25:04 +02:00
parent e9a5781944
commit 1643690124
9 changed files with 282 additions and 0 deletions
@@ -0,0 +1,52 @@
+# Prometheus + node_exporter. Prometheus UI reachable on the LAN (:9090);
+# node_exporter bound to localhost. Scrapes the host plus the stack itself.
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.profiles.monitoring;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.prometheus = {
+      enable = true;
+      listenAddress = "0.0.0.0";
+      port = 9090;
+      retentionTime = "90d";
+
+      exporters.node = {
+        enable = true;
+        listenAddress = "127.0.0.1";
+        port = 9100;
+        # default collectors
+      };
+
+      scrapeConfigs = [
+        {
+          job_name = "node";
+          static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ];
+        }
+        {
+          job_name = "prometheus";
+          static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ];
+        }
+        {
+          job_name = "grafana";
+          static_configs = [ { targets = [ "127.0.0.1:3000" ]; } ];
+        }
+        {
+          job_name = "loki";
+          static_configs = [ { targets = [ "127.0.0.1:3100" ]; } ];
+        }
+        {
+          job_name = "alloy";
+          static_configs = [ { targets = [ "127.0.0.1:12345" ]; } ];
+        }
+      ];
+    };
+
+    networking.firewall.allowedTCPPorts = [ 9090 ];
+  };
+}