feat: add WIP monitoring extension

Signed-off-by: Sefa Eyeoglu <[e-mail]>

nix/modules/extensions/monitoring/alloy.env.age

···
+age-encryption.org/v1
+-> ssh-ed25519 1Q/fmg tG5EaBxZhX7rLwXaeICjKhYlSnutbIa7OOhak6kwPHY
+OxYf7XCVYKf0UMVrryxZGHlSh24LsdXrjCjE/5O/6/k
+-> ssh-ed25519 KGcorg N76gB4IWkuR1nMAcMAA2yt/WnitJsCCJZCbKwGP7Pzo
+KeylsEHCoPVj4O2q7ZMsYz90UpLsUED8/tNShLFhoQo
+-> ssh-ed25519 Zu6W7Q t5JQxEmHJ9o6DdidG2PO3fMosyViqLul0eQgQUC7gmo
+s5XE5XBD756lWz9bI3QbV50z/rOYr/tUrOdqOoD0rxw
+-> ssh-ed25519 ywGURw hzB+83uFILTQCKY+NGU1qKXWe5lhH/gjLHp5PHJ1iRk
+RyKW9XvexD2dLTeVZ72cuQokyDuSV5oikyeoIC3+2o4
+-> ssh-ed25519 HEOV7w sKJm1+muTLahi91l7LFvvq/NzkHT5v+gpQpSoPR76R8
+ae8flidFkzkblYzTaR0CZlqzeG5mFUAiOpu3ix/2wH8
+--- T4BDmaoTMR6QGEZrfYodBG3PENwpt7Q2VdTbXmwA/sM
+�������t�������G���w޳�]��o����h���R���൐��j���ox6���&�	�z/��ni�.��T!R�؟j�`2EDa�����bڞA[�~O,ö.�����ɱ!a�ܐ��ܸ��D�����O�Ӯ��%�FRM�?��%*��}V}�nUq}��g釰�B'��$0t��i��i�J-���B��T~֕��IOL�n�d�P0D}���ήS����&�ܺ�KhA1>��ʭG[M�F��
����

nix/modules/extensions/monitoring/alloy.nix

···
+{
+  flake.modules.nixos."ext-monitoring" = {config, ...}: {
+    age.secrets."alloy.env".file = ./alloy.env.age;
+
+    services.alloy = {
+      enable = true;
+      environmentFile = config.age.secrets."alloy.env".path;
+    };
+
+    systemd.services."alloy".environment.HOSTNAME = config.networking.hostName;
+
+    environment.etc."alloy/remotes.alloy".text = ''
+      prometheus.remote_write "default" {
+        endpoint {
+          name = "grafana-cloud"
+          url = "https://prometheus-prod-65-prod-eu-west-2.grafana.net/api/prom/push"
+
+          basic_auth {
+            username = sys.env("GCLOUD_MIMIR_USERNAME")
+            password = sys.env("GCLOUD_RW_TOKEN")
+          }
+        }
+      }
+
+      loki.write "default" {
+        endpoint {
+          url = "https://logs-prod-012.grafana.net/loki/api/v1/push"
+
+          basic_auth {
+            username = sys.env("GCLOUD_LOKI_USERNAME")
+            password = sys.env("GCLOUD_RW_TOKEN")
+          }
+        }
+      }
+    '';
+  };
+}

nix/modules/extensions/monitoring/discovery.nix

···
+{
+  flake.modules.nixos."ext-monitoring" = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: let
+    cfg = config.services.alloy.scrape;
+    jsonFormat = pkgs.formats.json {};
+    scrapeModule = lib.types.submodule {
+      freeformType = jsonFormat.type;
+      options = {
+        targets = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [];
+        };
+        labels = lib.mkOption {
+          type = lib.types.attrsOf lib.types.str;
+          default = {};
+        };
+      };
+    };
+  in {
+    options.services.alloy.scrape = lib.mkOption {
+      type = lib.types.listOf scrapeModule;
+      default = [];
+    };
+
+    config = lib.mkIf (cfg != []) {
+      environment.etc."alloy/discovery.alloy".text = ''
+        discovery.file "default" {
+          files = ["/etc/alloy/discovery.json"]
+        }
+
+        prometheus.scrape "default" {
+          targets    = discovery.file.default.targets
+          scrape_interval = "15s"
+
+          forward_to = [prometheus.relabel.default.receiver]
+        }
+
+        prometheus.relabel "default" {
+          rule {
+            target_label = "node"
+            replacement = sys.env("HOSTNAME")
+          }
+          forward_to = [prometheus.remote_write.default.receiver]
+        }
+      '';
+      environment.etc."alloy/discovery.json".source = jsonFormat.generate "alloy-discovery.json" cfg;
+    };
+  };
+}

nix/modules/extensions/monitoring/node-exporter.nix

···
+{
+  flake.modules.nixos."ext-monitoring" = {config, ...}: {
+    services.prometheus.exporters.node.enable = true;
+
+    services.alloy.scrape = [
+      {
+        targets = with config.services.prometheus.exporters.node; ["${listenAddress}:${toString port}"];
+      }
+    ];
+  };
+}

nixosConfigurations/universe/configuration.nix

···
 
     fpConfig.flake.modules.nixos.netcup-vps
     fpConfig.flake.modules.nixos.machine-universe
+    fpConfig.flake.modules.nixos.ext-monitoring
 
     inputs.srvos.nixosModules.server
     inputs.srvos.nixosModules.mixins-systemd-boot

secrets.nix

···
   "nix/modules/machines/galileo/wifi/Beehive.psk.age".publicKeys = galileo ++ scrumplex;
   "nix/modules/machines/galileo/wireguard/wg-scrumplex.key.age".publicKeys = galileo ++ scrumplex;
   "nix/modules/machines/universe/pocket-id/encryption-key.age".publicKeys = universe ++ scrumplex;
+  "nix/modules/extensions/monitoring/alloy.env.age".publicKeys = universe ++ eclipse ++ galileo ++ scrumplex;
 
   "nixosConfigurations/eclipse/hetzner-api-token.env.age".publicKeys = scrumplex ++ eclipse;
   "nixosConfigurations/eclipse/media/sabnzbd-secrets.ini.age".publicKeys = scrumplex ++ eclipse;