# Grafana service + provisioning from the grafana-content flake input.
# Provisioning shape verified against nixpkgs 26.05 grafana module:
#  - datasources.path takes a directory (lndir'd into the provisioning dir)
#  - dashboard provider is generated here so the store path can be injected
#  - each alerting resource takes its own YAML *file* (they share one target dir,
#    so pointing them at a directory would collide)
{
  config,
  lib,
  inputs,
  ...
}:
let
  cfg = config.my.profiles.monitoring;
  content = inputs.grafana-content;
in
{
  config = lib.mkIf cfg.enable {
    services.grafana = {
      enable = true;

      settings = {
        server = {
          http_addr = "0.0.0.0";
          http_port = 3000;
          domain = "jupiter.solar.internal";
          root_url = "http://jupiter.solar.internal:3000/";
        };
        security.admin_password = "$__file{/etc/grafana/admin_password}";
        # 26.05 removed the built-in default; encrypts secrets in Grafana's DB.
        security.secret_key = "$__file{/etc/grafana/secret_key}";
        "auth.anonymous" = {
          enabled = true;
          org_role = "Viewer";
        };
        metrics.enabled = true; # /metrics for Prometheus self-scrape
        unified_alerting.enabled = true;
        alerting.enabled = false; # disable legacy alerting
      };

      provision = {
        enable = true;

        # static datasources dir → all *.yaml linked in
        datasources.path = "${content}/provisioning/datasources";

        # dashboard provider generated here with the store path injected
        dashboards.settings.providers = [
          {
            name = "content";
            type = "file";
            disableDeletion = true;
            allowUiUpdates = false;
            options = {
              path = "${content}/dashboards";
              foldersFromFilesStructure = true;
            };
          }
        ];

        # per-resource alerting files (share one target dir → must be files)
        alerting = {
          rules.path = "${content}/provisioning/alerting/rules.yaml";
          contactPoints.path = "${content}/provisioning/alerting/contactpoints.yaml";
          policies.path = "${content}/provisioning/alerting/policies.yaml";
        };
      };
    };

    networking.firewall.allowedTCPPorts = [ 3000 ];

    # Register a homepage-dashboard tile (matches the other profiles).
    my.homepage.services = [
      {
        group = "Monitoring";
        name = "Grafana";
        description = "Metrics & logs dashboards";
        href = "http://jupiter.solar.internal:3000";
        icon = "grafana.png";
      }
    ];
  };
}