infra/modules/prometheus/default.nix

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

147 lines
3.9 KiB
Nix
Raw Normal View History

2024-04-28 17:05:12 +00:00
{
config,
lib,
pkgs,
flake,
...
}:
{
age.secrets.nachtigall-metrics-prometheus-basic-auth-password = {
file = "${flake.self}/secrets/nachtigall-metrics-prometheus-basic-auth-password.age";
mode = "600";
owner = "prometheus";
};
2024-05-15 15:15:46 +00:00
age.secrets.alertmanager-envfile = {
file = "${flake.self}/secrets/alertmanager-envfile.age";
mode = "600";
owner = "alertmanager";
};
2024-04-28 17:05:12 +00:00
services.caddy.virtualHosts."alerts.${config.pub-solar-os.networking.domain}" = {
logFormat = lib.mkForce ''
output discard
'';
extraConfig = ''
2024-05-12 20:17:58 +00:00
bind 10.7.6.2 fd00:fae:fae:fae:fae:2::
tls internal
reverse_proxy :${toString config.services.prometheus.alertmanager.port}
'';
};
2024-04-28 17:05:12 +00:00
services.prometheus = {
enable = true;
port = 9001;
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
port = 9002;
};
};
globalConfig = {
scrape_interval = "10s";
scrape_timeout = "9s";
};
scrapeConfigs = [
{
job_name = "node-exporter-http";
static_configs = [
{
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
labels = {
instance = "flora-6";
};
}
];
}
{
job_name = "node-exporter-https";
scheme = "https";
metrics_path = "/metrics";
basic_auth = {
username = "hakkonaut";
password_file = "${config.age.secrets.nachtigall-metrics-prometheus-basic-auth-password.path}";
};
static_configs = [
{
targets = [ "nachtigall.${config.pub-solar-os.networking.domain}" ];
2024-04-28 17:05:12 +00:00
labels = {
instance = "nachtigall";
};
}
];
}
{
job_name = "matrix-synapse";
scheme = "https";
metrics_path = "/_synapse/metrics";
basic_auth = {
username = "hakkonaut";
password_file = "${config.age.secrets.nachtigall-metrics-prometheus-basic-auth-password.path}";
};
static_configs = [
{
targets = [ "nachtigall.${config.pub-solar-os.networking.domain}" ];
2024-04-28 17:05:12 +00:00
labels = {
instance = "nachtigall";
};
}
];
}
];
2024-04-26 22:08:23 +00:00
ruleFiles = [
2024-05-12 19:17:49 +00:00
(pkgs.writeText "prometheus-rules.yml" (
builtins.toJSON {
groups = [
{
name = "alerting-rules";
rules = import ./alert-rules.nix { inherit lib; };
}
];
}
))
2024-04-26 22:08:23 +00:00
];
2024-05-12 19:17:49 +00:00
alertmanagers = [ { static_configs = [ { targets = [ "localhost:9093" ]; } ]; } ];
2024-04-26 22:08:23 +00:00
alertmanager = {
enable = true;
# port = 9093; # Default
2024-05-12 20:17:58 +00:00
webExternalUrl = "https://alerts.pub.solar";
2024-05-15 15:15:46 +00:00
environmentFile = "${config.age.secrets.alertmanager-envfile.path}";
2024-04-26 22:08:23 +00:00
configuration = {
route = {
receiver = "all";
group_by = [ "instance" ];
group_wait = "30s";
group_interval = "2m";
repeat_interval = "24h";
};
2024-05-12 19:17:49 +00:00
receivers = [
{
name = "all";
# Email config documentation: https://prometheus.io/docs/alerting/latest/configuration/#email_config
email_configs = [
{
send_resolved = true;
2024-05-12 20:17:58 +00:00
to = "admins@pub.solar";
2024-05-12 19:17:49 +00:00
from = "alerts@pub.solar";
2024-05-12 20:17:58 +00:00
smarthost = "mail.greenbaum.zone:465";
auth_username = "admins@pub.solar";
2024-05-15 15:15:46 +00:00
auth_password = "$SMTP_AUTH_PASSWORD";
require_tls = false;
2024-05-12 19:17:49 +00:00
}
];
# TODO:
# For matrix notifications, look into: https://github.com/pinpox/matrix-hook and add a webhook
# webhook_configs = [ { url = "http://127.0.0.1:11000/alert"; } ];
}
];
2024-04-26 22:08:23 +00:00
};
};
2024-04-28 17:05:12 +00:00
};
}