modules/monitoring/: Persist all state directories

3 files changed, 39 insertions, 1 deletions

diff --git a/modules/by-name/mo/monitoring/components/grafana.nix b/modules/by-name/mo/monitoring/components/grafana.nix
index b1254e4..7b9665a 100644
--- a/modules/by-name/mo/monitoring/components/grafana.nix
+++ b/modules/by-name/mo/monitoring/components/grafana.nix
@@ -135,6 +135,16 @@ in {
 
     vhack = {
       postgresql.enable = true;
+
+      persist.directories = [
+        {
+          directory = "/var/lib/grafana/";
+          user = "grafana";
+          group = "grafana";
+          mode = "0700";
+        }
+      ];
+
       monitoring.grafana.dashboards = [
         ../dashboards/Errors.json
         ../dashboards/Performance.json
diff --git a/modules/by-name/mo/monitoring/components/loki.nix b/modules/by-name/mo/monitoring/components/loki.nix
index 30d32b3..ac9b1fa 100644
--- a/modules/by-name/mo/monitoring/components/loki.nix
+++ b/modules/by-name/mo/monitoring/components/loki.nix
@@ -17,6 +17,23 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    vhack = {
+      persist.directories = [
+        {
+          directory = "/var/lib/loki";
+          user = "loki";
+          group = "loki";
+          mode = "0700";
+        }
+        {
+          directory = "/var/lib/fluent-bit";
+          user = "fluent-bit";
+          group = "fluent-bit";
+          mode = "0700";
+        }
+      ];
+    };
+
     users = {
       groups = {
         fluent-bit = {
@@ -43,6 +60,7 @@ in {
     # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
     systemd.services.fluent-bit = {
       serviceConfig = {
+        StateDirectory = "fluent-bit";
         User = "fluent-bit";
         Group = "fluent-bit";
         DynamicUser = lib.mkForce false;
@@ -115,7 +133,7 @@ in {
                 path = "/var/log/journal";
 
                 # Database file to keep track of the journald cursor.
-                db = "/var/fluent-bit/systemd.db";
+                db = "/var/lib/fluent-bit/systemd.db";
 
                 # Start reading new entries. Skip entries already stored in journald.
                 read_from_tail = true;
diff --git a/modules/by-name/mo/monitoring/components/prometheus.nix b/modules/by-name/mo/monitoring/components/prometheus.nix
index bf95a6b..44c5952 100644
--- a/modules/by-name/mo/monitoring/components/prometheus.nix
+++ b/modules/by-name/mo/monitoring/components/prometheus.nix
@@ -42,6 +42,16 @@ in {
   config = lib.mkIf cfg.enable {
     vhack = {
       nginx.enable = true;
+
+      persist.directories = [
+        {
+          directory = "/var/lib/prometheus2";
+          user = "prometheus";
+          group = "prometheus";
+          mode = "0700";
+        }
+      ];
+
       monitoring.prometheus.sources = [
         {
           name = "node";