make-monitoring.nix

{ publicIPv4
, hardware
, publicStoragePort
, ristrettoSigningKeyPath
, passValue
, sshUsers
, stateVersion
, monitoringvpnIPv4 ? null
, monitoringvpnKeyDir ? null
, vpnClientIPs ? null
, nodeExporterTargets ? []
, nginxExporterTargets ? []
, hostsMap ? {}
, ... }: let

  enableVpn = monitoringvpnKeyDir != null &&
              monitoringvpnIPv4 != null &&
              vpnClientIPs != null;

  vpnSecrets = if !enableVpn then {} else {
    "monitoringvpn-private-key" = {
      source = monitoringvpnKeyDir + "/server.key";
      destination = "/run/keys/monitoringvpn/server.key";
      owner.user = "root";
      owner.group = "root";
      permissions = "0400";
      action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
    };
    "monitoringvpn-preshared-key" = {
      source = monitoringvpnKeyDir + "/preshared.key";
      destination = "/run/keys/monitoringvpn/preshared.key";
      owner.user = "root";
      owner.group = "root";
      permissions = "0400";
      action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
    };
  };

in rec {

  deployment = {
    targetHost = publicIPv4;
    secrets = vpnSecrets;
  };

  imports = [
    hardware
    ../../nixos/modules/monitoring/vpn/server.nix
    ../../nixos/modules/monitoring/server/grafana.nix
    ../../nixos/modules/monitoring/server/prometheus.nix
    ../../nixos/modules/monitoring/exporters/node.nix
    # Loki 0.3.0 from Nixpkgs 19.09 is too old and does not work:
    # ../../nixos/modules/monitoring/server/loki.nix
  ];

  services.private-storage.monitoring.vpn.server = if !enableVpn then {} else {
    enable = true;
    ip = monitoringvpnIPv4;
    inherit vpnClientIPs;
    pubKeysPath = monitoringvpnKeyDir;
  };

  services.private-storage.monitoring.grafana = {
    domain = "monitoring.private.storage";
    prometheusUrl = "http://localhost:9090/";
    lokiUrl = "http://localhost:3100/";
  };

  services.private-storage.monitoring.prometheus = {
    inherit nodeExporterTargets;
    inherit nginxExporterTargets;
  };

  system.stateVersion = stateVersion;

  networking.hosts = hostsMap;
}