Factor out the configuration necessary for a monitored node into its own module.

This includes the host-based metrics collector, and the VPN client setup (including key deployment).

morph/lib/issuer.nix

@@ -2,12 +2,11 @@
 # "issuer"-type system.
 { lib, config, ...}:
 let
-  inherit (config.grid) publicKeyPath privateKeyPath monitoringvpnEndpoint monitoringvpnIPv4;
+  inherit (config.grid) privateKeyPath;
   inherit (config.grid.issuer) issuerDomains allowedChargeOrigins;
 in {
   imports = [
-    ../../nixos/modules/monitoring/vpn/client.nix
-    ../../nixos/modules/monitoring/exporters/node.nix
+    ./monitored-node.nix
   ];
 
   options.grid.issuer = {
@@ -47,26 +46,8 @@ in {
           permissions = "0400";
           action = ["sudo" "systemctl" "restart" "zkapissuer.service"];
         };
-
-        "monitoringvpn-secret-key" = {
-          destination = "/run/keys/monitoringvpn/client.key";
-          source = "${privateKeyPath}/monitoringvpn/${monitoringvpnIPv4}.key";
-          owner.user = "root";
-          owner.group = "root";
-          permissions = "0400";
-          action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
-        };
-        "monitoringvpn-preshared-key" = {
-          destination = "/run/keys/monitoringvpn/preshared.key";
-          source = "${privateKeyPath}/monitoringvpn/preshared.key";
-          owner.user = "root";
-          owner.group = "root";
-          permissions = "0400";
-          action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
-        };
       };
     };
-
     services.private-storage-issuer = {
       enable = true;
       tls = true;
@@ -79,13 +60,6 @@ in {
       domains = issuerDomains;
     };
 
-    services.private-storage.monitoring.vpn.client = {
-      enable = true;
-      ip = monitoringvpnIPv4;
-      endpoint = monitoringvpnEndpoint;
-      endpointPublicKeyFile = "${publicKeyPath}/monitoringvpn/server.pub";
-    };
-
     system.stateVersion = "19.03";
   };
 }

morph/lib/monitored-node.nix

+{ lib, config, ...}:
+let
+  inherit (config.grid) publicKeyPath privateKeyPath monitoringvpnEndpoint monitoringvpnIPv4;
+in {
+  config = {
+    deployment = {
+      secrets = {
+        "monitoringvpn-secret-key" = {
+          destination = "/run/keys/monitoringvpn/client.key";
+          source = "${privateKeyPath}/monitoringvpn/${monitoringvpnIPv4}.key";
+          owner.user = "root";
+          owner.group = "root";
+          permissions = "0400";
+          action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
+        };
+        "monitoringvpn-preshared-key" = {
+          destination = "/run/keys/monitoringvpn/preshared.key";
+          source = "${privateKeyPath}/monitoringvpn/preshared.key";
+          owner.user = "root";
+          owner.group = "root";
+          permissions = "0400";
+          action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
+        };
+      };
+    };
+
+    services.private-storage.monitoring.node.enable = true;
+    services.private-storage.monitoring.vpn.client = {
+      enable = true;
+      ip = monitoringvpnIPv4;
+      endpoint = monitoringvpnEndpoint;
+      endpointPublicKeyFile = "${publicKeyPath}/monitoringvpn/server.pub";
+    };
+  };
+}

morph/lib/monitoring.nix

@@ -30,7 +30,6 @@ in {
     ../../nixos/modules/monitoring/vpn/server.nix
     ../../nixos/modules/monitoring/server/grafana.nix
     ../../nixos/modules/monitoring/server/prometheus.nix
-    ../../nixos/modules/monitoring/exporters/node.nix
     ../../nixos/modules/monitoring/exporters/blackbox.nix
     # Loki 0.3.0 from Nixpkgs 19.09 is too old and does not work:
     # ../../nixos/modules/monitoring/server/loki.nix
@@ -162,5 +161,7 @@ in {
       inherit letsEncryptAdminEmail;
       domains = cfg.monitoringDomains;
     };
+
+    services.private-storage.monitoring.node.enable = true;
   };
 }

morph/lib/storage.nix

@@ -2,19 +2,12 @@
 # "storage"-type system.
 { lib, config, ...} :
 let
-  inherit (config.grid) publicKeyPath privateKeyPath monitoringvpnIPv4 monitoringvpnEndpoint;
+  inherit (config.grid) privateKeyPath;
 in {
   # Any extra NixOS modules to load on this server.
   imports = [
-    # Bring in our module for configuring the Tahoe-LAFS service and other
-    # Private Storage-specific things.
-    ../../nixos/modules/private-storage.nix
-    # Connect to the monitoringvpn.
-    ../../nixos/modules/monitoring/vpn/client.nix
-    # Expose base system metrics over the monitoringvpn.
-    ../../nixos/modules/monitoring/exporters/node.nix
-    # Collect Tahoe OpenMetrics statistics.
-    ../../nixos/modules/monitoring/exporters/tahoe.nix
+    # Configure the node to be monitored.
+    ./monitored-node.nix
   ];
 
   options.grid.storage = {
@@ -48,22 +41,6 @@ in {
           # extract it from the tahoe-lafs nixos module somehow?
           action = ["sudo" "systemctl" "restart" "tahoe.storage.service"];
         };
-        "monitoringvpn-secret-key" = {
-          destination = "/run/keys/monitoringvpn/client.key";
-          source = "${privateKeyPath}/monitoringvpn/${monitoringvpnIPv4}.key";
-          owner.user = "root";
-          owner.group = "root";
-          permissions = "0400";
-          action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
-        };
-        "monitoringvpn-preshared-key" = {
-          destination = "/run/keys/monitoringvpn/preshared.key";
-          source = "${privateKeyPath}/monitoringvpn/preshared.key";
-          owner.user = "root";
-          owner.group = "root";
-          permissions = "0400";
-          action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
-        };
       };
     };
 
@@ -77,12 +54,5 @@ in {
       ristrettoSigningKeyPath = config.deployment.secrets.ristretto-signing-key.destination;
       inherit (config.grid.storage) passValue publicStoragePort;
     };
-
-    services.private-storage.monitoring.vpn.client = {
-      enable = true;
-      ip = monitoringvpnIPv4;
-      endpoint = monitoringvpnEndpoint;
-      endpointPublicKeyFile = "${publicKeyPath}/monitoringvpn/server.pub";
-    };
   };
 }

nixos/modules/default.nix

@@ -10,7 +10,11 @@
   # configuration.  If PaymentServer hasn't been enabled then the
   # configuration will just be ignored.
   imports = [
-    ./packages.nix
     ./issuer.nix
+    ./monitoring/exporters/node.nix
+    ./monitoring/exporters/tahoe.nix
+    ./monitoring/vpn/client.nix
+    ./packages.nix
+    ./private-storage.nix
   ];
 }

nixos/modules/monitoring/exporters/node.nix

@@ -11,10 +11,16 @@
 with lib;
 
 let
+  cfg = config.services.private-storage.monitoring.node;
+
   mountsFileSystemType = fsType: {} != filterAttrs (n: v: v.fsType == fsType) config.fileSystems;
 
 in {
-  config.services.prometheus.exporters.node = {
+  options.services.private-storage.monitoring.node = {
+    enable = lib.mkEnableOption "Base sytsem metrics collection";
+  };
+
+  config.services.prometheus.exporters.node = lib.mkIf cfg.enable {
     enable = true;
     openFirewall = true;
     firewallFilter = "-i monitoringvpn -p tcp -m tcp --dport 9100";

nixos/modules/monitoring/exporters/tahoe.nix

@@ -38,6 +38,15 @@ in {
 
   config =
     lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = config.services.private-storage.monitoring.node.enable;
+          message = ''
+            services.private-storage.monitoring.tahoe requires services.private-storage.monitoring.node to provide the textfile prometheus collector.
+          '';
+        }
+      ];
+
       environment.systemPackages = [ pkgs.curl ];
 
       systemd.services.tahoe-metrics-collector = {