finn.markwitz
1643690124
Native NixOS modules under my.profiles.monitoring, enabled on jupiter. Grafana provisions datasources/dashboards/alert rules from the grafana-content flake input (rechberg dashboards repo). Prometheus scrapes host + stack (90d), Loki+Alloy ship the systemd journal (90d). Grafana LAN-only :3000, anonymous viewer, admin password + secret_key via /etc/grafana file providers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CZJkwCnSbykq9rRTTeHc6b
84 lines
2.6 KiB
Nix
84 lines
2.6 KiB
Nix
# Grafana service + provisioning from the grafana-content flake input.
|
|
# Provisioning shape verified against nixpkgs 26.05 grafana module:
|
|
# - datasources.path takes a directory (lndir'd into the provisioning dir)
|
|
# - dashboard provider is generated here so the store path can be injected
|
|
# - each alerting resource takes its own YAML *file* (they share one target dir,
|
|
# so pointing them at a directory would collide)
|
|
{
|
|
config,
|
|
lib,
|
|
inputs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.my.profiles.monitoring;
|
|
content = inputs.grafana-content;
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.enable {
|
|
services.grafana = {
|
|
enable = true;
|
|
|
|
settings = {
|
|
server = {
|
|
http_addr = "0.0.0.0";
|
|
http_port = 3000;
|
|
domain = "jupiter.solar.internal";
|
|
root_url = "http://jupiter.solar.internal:3000/";
|
|
};
|
|
security.admin_password = "$__file{/etc/grafana/admin_password}";
|
|
# 26.05 removed the built-in default; encrypts secrets in Grafana's DB.
|
|
security.secret_key = "$__file{/etc/grafana/secret_key}";
|
|
"auth.anonymous" = {
|
|
enabled = true;
|
|
org_role = "Viewer";
|
|
};
|
|
metrics.enabled = true; # /metrics for Prometheus self-scrape
|
|
unified_alerting.enabled = true;
|
|
alerting.enabled = false; # disable legacy alerting
|
|
};
|
|
|
|
provision = {
|
|
enable = true;
|
|
|
|
# static datasources dir → all *.yaml linked in
|
|
datasources.path = "${content}/provisioning/datasources";
|
|
|
|
# dashboard provider generated here with the store path injected
|
|
dashboards.settings.providers = [
|
|
{
|
|
name = "content";
|
|
type = "file";
|
|
disableDeletion = true;
|
|
allowUiUpdates = false;
|
|
options = {
|
|
path = "${content}/dashboards";
|
|
foldersFromFilesStructure = true;
|
|
};
|
|
}
|
|
];
|
|
|
|
# per-resource alerting files (share one target dir → must be files)
|
|
alerting = {
|
|
rules.path = "${content}/provisioning/alerting/rules.yaml";
|
|
contactPoints.path = "${content}/provisioning/alerting/contactpoints.yaml";
|
|
policies.path = "${content}/provisioning/alerting/policies.yaml";
|
|
};
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 3000 ];
|
|
|
|
# Register a homepage-dashboard tile (matches the other profiles).
|
|
my.homepage.services = [
|
|
{
|
|
group = "Monitoring";
|
|
name = "Grafana";
|
|
description = "Metrics & logs dashboards";
|
|
href = "http://jupiter.solar.internal:3000";
|
|
icon = "grafana.png";
|
|
}
|
|
];
|
|
};
|
|
}
|