# Similar to ``issuer.nix`` but for a "monitoring"-type system.  Holes are
# filled by ``customize-monitoring.nix``.
rec {
  deployment = {
    secrets = {
      "monitoringvpn-private-key" = {
        destination = "/run/keys/monitoringvpn/server.key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
      };
      "monitoringvpn-preshared-key" = {
        destination = "/run/keys/monitoringvpn/preshared.key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
      };
      "grafana-google-sso-secret" = {
        destination = "/run/keys/grafana-google-sso.secret";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "grafana.service"];
      };
    };
  };

  imports = [
    ../../nixos/modules/monitoring/vpn/server.nix
    ../../nixos/modules/monitoring/server/grafana.nix
    ../../nixos/modules/monitoring/server/prometheus.nix
    ../../nixos/modules/monitoring/exporters/node.nix
    # Loki 0.3.0 from Nixpkgs 19.09 is too old and does not work:
    # ../../nixos/modules/monitoring/server/loki.nix
  ];
}