nixos/modules/environments/monitoring/prometheus.nix

# Prometheus + node_exporter. Prometheus UI reachable on the LAN (:9090);
# node_exporter bound to localhost. Scrapes the host plus the stack itself.
{
  config,
  lib,
  ...
}:
let
  cfg = config.my.profiles.monitoring;
in
{
  config = lib.mkIf cfg.enable {
    services.prometheus = {
      enable = true;
      listenAddress = "0.0.0.0";
      port = 9090;
      retentionTime = "90d";

      exporters.node = {
        enable = true;
        listenAddress = "127.0.0.1";
        port = 9100;
        # default collectors
      };

      scrapeConfigs = [
        {
          job_name = "node";
          static_configs = [ { targets = [ "127.0.0.1:9100" ]; } ];
        }
        {
          job_name = "prometheus";
          static_configs = [ { targets = [ "127.0.0.1:9090" ]; } ];
        }
        {
          job_name = "grafana";
          static_configs = [ { targets = [ "127.0.0.1:3000" ]; } ];
        }
        {
          job_name = "loki";
          static_configs = [ { targets = [ "127.0.0.1:3100" ]; } ];
        }
        {
          job_name = "alloy";
          static_configs = [ { targets = [ "127.0.0.1:12345" ]; } ];
        }
      ];
    };

    networking.firewall.allowedTCPPorts = [ 9090 ];
  };
}