add monitoring

2026-01-30 07:43:34 +02:00 · 2026-01-30 07:43:34 +02:00 · 250eea0c18
commit 250eea0c18
parent 80c49ec8a5
7 changed files with 15420 additions and 2 deletions
--- a/config/monitoring/grafana.nix
+++ b/config/monitoring/grafana.nix
@ -0,0 +1,93 @@
+{config, ...}: let
+  cfg = config.services.grafana;
+  owner = config.customOps.owner;
+  domain = config.customOps.domain.fqdn;
+  hostname = config.networking.hostName;
+  subdomain = "${hostname}.${domain}";
+
+  dashboardsDir = ./dashboards;
+  dashboardFiles = builtins.attrNames (builtins.readDir dashboardsDir);
+in {
+  sops.secrets."grafana/admin_password".owner = "grafana";
+
+  services.nginx.virtualHosts."${subdomain}" = {
+    locations."/" = {
+      proxyPass = "http://${
+        toString cfg.settings.server.http_addr
+      }:${
+        toString cfg.settings.server.http_port
+      }";
+      proxyWebsockets = true;
+      recommendedProxySettings = true;
+    };
+    forceSSL = true;
+    enableACME = true;
+  };
+
+  services.grafana = {
+    enable = true;
+    settings = {
+      server = {
+        http_addr = "127.0.0.1";
+        http_port = 3030;
+        domain = subdomain;
+        enforce_domain = true;
+        enable_gzip = true;
+      };
+      security = {
+        disable_initial_admin_creation = false;
+        admin_user = owner;
+        admin_email = "admin.grafana@${domain}";
+        admin_password = "$__file{${
+          config.sops.secrets."grafana/admin_password".path
+        }}";
+        disable_brute_force_login_protection = false;
+        brute_force_login_protection_max_attempts = 3;
+        disable_username_login_protection = false;
+        disable_ip_address_login_protection = false;
+        cookie_secure = true;
+        cookie_samesite = "strict";
+      };
+      analytics = {
+        reporting_enabled = false;
+        check_for_updates = false;
+      };
+    };
+
+    provision = {
+      enable = true;
+      dashboards.settings.providers = [
+        {
+          name = "dashboards";
+          disableDeletion = true;
+          options = {
+            path = "/etc/grafana-dashboards";
+            foldersFromFilesStructure = true;
+          };
+        }
+      ];
+
+      datasources.settings.datasources = [
+        {
+          name = "prometheus";
+          type = "prometheus";
+          url = "http://${
+            config.services.prometheus.listenAddress
+          }:${
+            toString config.services.prometheus.port
+          }";
+          isDefault = true;
+          editable = false;
+        }
+      ];
+    };
+  };
+
+  environment.etc = builtins.listToAttrs (map (
+      name: {
+        name = "grafana-dashboards/" + name;
+        value = {source = dashboardsDir + "/" + name;};
+      }
+    )
+    dashboardFiles);
+}