monitoring-client: fix alloy

modules/monitoring-client/alloy-config.nix

@@ -22,10 +22,10 @@
   loki.write "default" {
     endpoint {
       url = "https://loki.${config.momo-cloud.networking.domain}/loki/api/v1/push"
-    }
-    basic_auth = {
-      username = "loki"
-      password_file = "${config.momo-cloud.monitoring-client.basicAuthPasswordFile}"
+      basic_auth {
+        username = "loki"
+        password_file = sys.env("LOKI_BASIC_AUTH_PASSWORD_FILE")
+      }
     }
     external_labels = {}
   }

modules/monitoring-client/default.nix

@@ -18,8 +18,13 @@ in
       enable = true;
     };
 
-    systemd.services.alloy.reloadTriggers = [
-      cfg.basicAuthPasswordFile
-    ];
+    systemd.services.alloy = {
+      environment = {
+        LOKI_BASIC_AUTH_PASSWORD_FILE = "%d/loki_basic_auth_password_file";
+      };
+      serviceConfig = {
+        LoadCredential = "loki_basic_auth_password_file:${config.momo-cloud.monitoring-client.basicAuthPasswordFile}";
+      };
+    };
   };
 }

modules/monitoring-server/loki.nix

@@ -35,7 +35,7 @@ in
           http_listen_address = "127.0.0.1";
           http_listen_port = 3100;
         };
-        auth_enabled = true;
+        auth_enabled = false;
         common = {
           ring = {
             instance_enable_ipv6 = true;

staging/flake.lock

@@ -252,7 +252,7 @@
       },
       "locked": {
         "lastModified": 0,
-        "narHash": "sha256-5HBdgwzMiOVThrpkmaJ8GrJ3S+Qn74AhQ4Xf1gIL1CE=",
+        "narHash": "sha256-7gFtsCcqhHvKcoSpKnbHk2eq71wJOwTW2mtpgi4qWbI=",
         "path": "../",
         "type": "path"
       },

staging/hosts/cassiopeia/monitoring.nix

@@ -6,8 +6,6 @@
 {
   age.secrets.alloy-basic-auth-password = {
     file = "${flake.self}/secrets/alloy-basic-auth-password.age";
-    path = "/etc/alloy/secrets.alloy";
-    symlink = false;
     mode = "400";
   };