telemetry: deployed grafana service

options/services.nix

@@ -22,5 +22,29 @@ in
     wireguard.enable = mkEnableOption "wireguard";
     photoprism.enable = mkEnableOption "photoprism";
     navidrome.enable = mkEnableOption "navidrome";
+
+    telemetry = {
+      enable = mkEnableOption "telemetry";
+      grafana.enable = mkOption {
+        type = types.bool;
+        default = config.profile.services.telemetry.enable;
+      };
+      loki.enable = mkOption {
+        type = types.bool;
+        default = config.profile.services.telemetry.enable;
+      };
+      promtail.enable = mkOption {
+        type = types.bool;
+        default = config.profile.services.telemetry.enable;
+      };
+      tempo.enable = mkOption {
+        type = types.bool;
+        default = config.profile.services.telemetry.enable;
+      };
+      minio.enable = mkOption {
+        type = types.bool;
+        default = config.profile.services.telemetry.enable;
+      };
+    };
   };
 }

profiles/homeserver.nix

@@ -69,6 +69,7 @@
       wireguard.enable = true;
       photoprism.enable = true;
       navidrome.enable = true;
+      telemetry.enable = true;
     };
   };
 }

secrets/telemetry.yaml

@@ -0,0 +1,25 @@
+grafana:
+    admin_user: ENC[AES256_GCM,data:pg3WnfsF8L+/Tg==,iv:wh8VM567ClsFz7GS00OCh9kx3HZCz5GZ/BaTtOt3ksk=,tag:k6mJiktl1Met6Kzl738jpQ==,type:str]
+    admin_password: ENC[AES256_GCM,data:EFJfC78YtBLF5CIxLLhN9deZYcSL7/EfS4w=,iv:qrNi3WsRD26W5L67Fxch7qasEUh9vTj6HUWZs5PGz4o=,tag:bxW1CJyXOcz/pgN39ncQ+w==,type:str]
+    admin_email: ENC[AES256_GCM,data:2cvoq65K2/mdDuykkPVZryDJeNCK,iv:rU4jUYm+3dcvx1KooN9mWQDoovn7t+V7z1eU1m7VagE=,tag:Bhdbiq4BXO3nDwG9StUOkQ==,type:str]
+    secret_key: ENC[AES256_GCM,data:f4f1YF27VU/893HASHmCVL8vnsJEaHD33GOdFVpMj81MOutXqb7d03Hb1DYkDV3aMVmEdpvBcFK3SpZdFma3,iv:q6d59H1PniaVhw6tbd1maCelEGlAC4y2i38jMZ9Jn/Q=,tag:uSbCRstKy7C4Vwp+/FxF/Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1kruum2varzua7w5n6n52vhwyek2arc685rhcwt0u7k2jf5mecsjslkl9ll
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1KzFkak5QQ01MUVV0djVH
+            cXlveDhxU3RRelhNL3JQbE1xVWNlaFYzem40CmtGYlpZMTJPS2lKUGl2Vy9CVW5j
+            bFoyNVlJM1lmSGhSM2lGREN3N3VXWTAKLS0tIE9xWFpoTUdrVVBtOS9lckRXWGc1
+            bzYzSEQrRkN6WVVmN254a2NCcUxGVFkK4aHv8tiFiNEnd7I5LB0Jd/4upkEEEXis
+            9A5hdTn20EqL62QuHeYRav1TRu42dp+R4iZAlVl9cRzThkzZKJdHlg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-28T13:04:02Z"
+    mac: ENC[AES256_GCM,data:b0F+YQZI7lVoOarse5dNBU6WQfnGRMgSlw/SaEE4ZuANXaL8zK1vY+zztB/MMEd5Y2mrNn/rBZt/9V9RXkMp49Bns0tCtUzAghOT8vIRjVk+hjYVuTiET5o5JokGOiT3vrSWIAo1zFuASq4lUlgXaWX3rX57EVvq7iFb7Lye53Q=,iv:xAtK6HMC8rt+OtnYYq6u3eOYhxV2PjfYB7yf0KmY9eg=,tag:++XgTe4zvEeAehCj2KsqYw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

system/services/default.nix

@@ -15,5 +15,6 @@
     ./syncthing.nix
     ./wireguard.nix
     ./photoprism.nix
+    ./telemetry.nix
   ];
 }

system/services/telemetry.nix

@@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.profile.services.telemetry;
+  inherit (lib) mkIf;
+  grafanaDomain = "grafana.tigor.web.id";
+in
+{
+  config = mkIf cfg.enable {
+    sops.secrets =
+      let
+        opts = { sopsFile = ../../secrets/telemetry.yaml; owner = "grafana"; };
+      in
+      mkIf cfg.grafana.enable {
+        "grafana/admin_user" = opts;
+        "grafana/admin_password" = opts;
+        "grafana/admin_email" = opts;
+        "grafana/secret_key" = opts;
+      };
+
+    services.caddy.virtualHosts.${grafanaDomain}.extraConfig = mkIf cfg.grafana.enable ''
+      reverse_proxy ${config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}
+    '';
+
+    services.grafana = mkIf cfg.grafana.enable {
+      enable = true;
+      package = pkgs.grafana;
+      settings = {
+        # https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/
+        server = {
+          protocol = "http"; # served behind caddy
+          http_addr = "0.0.0.0";
+          http_port = 44518;
+          domain = grafanaDomain;
+          root_url = "https://${grafanaDomain}";
+          enable_gzip = true;
+        };
+        database = {
+          type = "sqlite3";
+          cache_mode = "shared";
+          wal = true;
+          query_retries = 3;
+        };
+        security = {
+          # Admin credentials is already available in the secrets
+          admin_user = "$__file{${config.sops.secrets."grafana/admin_user".path}}";
+          admin_password = "$__file{${config.sops.secrets."grafana/admin_password".path}}";
+          admin_email = "$__file{${config.sops.secrets."grafana/admin_email".path}}";
+          secret_key = "$__file{${config.sops.secrets."grafana/secret_key".path}}";
+          cookie_secure = true;
+          cookie_samesite = "lax";
+          strict_transport_security = true;
+        };
+      };
+    };
+  };
+}