diff options
Diffstat (limited to '')
| -rw-r--r-- | modules/by-name/mo/monitoring/components/prometheus.nix | 272 |
1 files changed, 272 insertions, 0 deletions
diff --git a/modules/by-name/mo/monitoring/components/prometheus.nix b/modules/by-name/mo/monitoring/components/prometheus.nix new file mode 100644 index 0000000..ca947d3 --- /dev/null +++ b/modules/by-name/mo/monitoring/components/prometheus.nix @@ -0,0 +1,272 @@ +{ + lib, + config, + nixLib, + ... +}: let + cfg = config.vhack.monitoring.prometheus; + + commonLabels = { + hostname = config.networking.hostName; + }; + + prom_cfg = config.services.prometheus; +in { + options.vhack.monitoring.prometheus = { + enable = lib.mkEnableOption "prometheus"; + + port = lib.mkOption { + type = lib.types.port; + description = "Port where Prometheus listens to HTTP requests."; + default = 3001; + }; + + remoteWriteReceiver = lib.mkOption { + example = "https://prometheus.server2.vhack.eu"; + type = lib.types.nullOr lib.types.str; + default = null; + description = '' + If not null, this prometheus server will be exposed via a reverse proxy and allow + other prometheus servers to write metrics to it. + ''; + }; + remoteWriteTo = lib.mkOption { + example = "https://prometheus.server3.vhack.eu"; + type = lib.types.nullOr (lib.types.submodule { + options = { + port = lib.mkOption { + type = lib.types.nullOr lib.types.port; + default = null; + }; + url = lib.mkOption { + type = lib.types.str; + }; + }; + }); + default = null; + description = '' + If not null, this prometheus server will run in agent mode, writing all recived + metrics to the specified remote prometheus server. + ''; + }; + + sources = lib.mkOption { + type = lib.types.listOf (lib.types.submodule { + options = { + name = lib.mkOption { + type = lib.types.str; + }; + target = lib.mkOption { + type = lib.types.str; + description = "The target url to scrape from."; + }; + extra = lib.mkOption { + type = lib.types.attrsOf lib.types.anything; + }; + }; + }); + }; + }; + + config = lib.mkIf cfg.enable { + vhack = { + nginx.enable = true; + + persist.directories = [ + { + directory = "/var/lib/prometheus2"; + user = "prometheus"; + group = "prometheus"; + mode = "0700"; + } + ]; + + monitoring.prometheus.sources = [ + { + name = "node"; + target = "127.0.0.1:${toString prom_cfg.exporters.node.port}"; + } + { + name = "prometheus_internal"; + target = "127.0.0.1:${toString prom_cfg.port}"; + } + { + name = "systemd"; + target = "127.0.0.1:${toString prom_cfg.exporters.systemd.port}"; + } + ]; + }; + + services.nginx = lib.mkIf (cfg.remoteWriteReceiver != null) { + virtualHosts.${cfg.remoteWriteReceiver} = { + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.port}/api/v1/write"; + + recommendedProxySettings = true; + proxyWebsockets = true; + }; + + enableACME = true; + forceSSL = true; + }; + }; + + users = { + groups = { + node-exporter.gid = config.vhack.constants.ids.gids.node-exporter; + }; + users = { + node-exporter = { + isSystemUser = true; + group = "node-exporter"; + uid = config.vhack.constants.ids.uids.node-exporter; + }; + }; + }; + + services = { + prometheus = { + enable = true; + inherit (cfg) port; + + globalConfig = { + scrape_interval = "15s"; + }; + remoteWrite = lib.optionals (cfg.remoteWriteTo != null) [ + { + url = let + port = + if (cfg.remoteWriteTo.port != null) + then ":${toString cfg.remoteWriteTo.port}" + else ""; + in "${cfg.remoteWriteTo.url}${port}"; + # TODO: Needs RFC42 for prometheus <2026-07-19> + # protobuf_message = "io.prometheus.write.v2.Request"; + } + ]; + + enableAgentMode = cfg.remoteWriteTo != null; + extraFlags = lib.mkMerge [ + ( + lib.mkIf (cfg.remoteWriteReceiver != null) [ + "--web.enable-remote-write-receiver" + # "--web.remote-write-receiver.accepted-protobuf-messages=io.prometheus.write.v2.Request" + ] + ) + ]; + + scrapeConfigs = builtins.map (attr: + nixLib.warnMerge { + job_name = attr.name; + static_configs = [ + { + targets = [attr.target]; + labels = commonLabels; + } + ]; + } + attr.extra "prometheus scrapeConfig '${attr.name}'") + cfg.sources; + # ++ (lib.optional (builtins.length (lib.attrNames config.services.redis.servers) > 0) { + # job_name = "redis"; + # static_configs = [ + # { + # targets = ["127.0.0.1:${toString config.services.prometheus.exporters.redis.port}"]; + # } + # ]; + # }) ++ (lib.optional (builtins.length (lib.attrNames config.services.openvpn.servers) > 0) { + # job_name = "openvpn"; + # static_configs = [ + # { + # targets = ["127.0.0.1:${toString config.services.prometheus.exporters.openvpn.port}"]; + # } + # ]; + # }) + # ++ (lib.optional config.services.dnsmasq.enable { + # job_name = "dnsmasq"; + # static_configs = [ + # { + # targets = ["127.0.0.1:${toString config.services.prometheus.exporters.dnsmasq.port}"]; + # labels = commonLabels; + # } + # ]; + # }); + + exporters = { + node = { + enable = true; + # https://github.com/prometheus/node_exporter#collectors + enabledCollectors = [ + "arp" + "cpu" + "cpufreq" + "diskstats" + "dmi" + "edac" + "entropy" + "filefd" + "filesystem" + "hwmon" + "loadavg" + "meminfo" + "netclass" + "netdev" + "netstat" + "nvme" + "os" + "pressure" + "rapl" + "schedstat" + "stat" + "thermal_zone" + "time" + "uname" + "vmstat" + "zfs" + + # Disabled by default + "cgroups" + "drm" + "ethtool" + "logind" + "wifi" + ]; + port = 9112; + listenAddress = "127.0.0.1"; + }; + # services.prometheus.exporters.redis = lib.mkIf (builtins.length (lib.attrNames config.services.redis.servers) > 0) { + # enable = true; + # port = 9119; + # listenAddress = "127.0.0.1"; + # }; + # services.prometheus.exporters.openvpn = lib.mkIf (builtins.length (lib.attrNames config.services.openvpn.servers) > 0) { + # enable = true; + # port = 9121; + # listenAddress = "127.0.0.1"; + # statusPaths = lib.mapAttrsToList (name: _config: "/tmp/openvpn/${name}.status") config.services.openvpn.servers; + # }; + # dnsmasq = lib.mkIf config.services.dnsmasq.enable { + # enable = true; + # port = 9211; + # listenAddress = "127.0.0.1"; + # }; + systemd = { + enable = true; + port = 9116; + listenAddress = "127.0.0.1"; + extraFlags = [ + "--log.level=info" + "--web.disable-exporter-metrics" + # "--systemd.collector.enable-resolved" + "--systemd.collector.enable-restart-count" + # "--systemd.collector.enable-file-descriptor-size" + "--systemd.collector.enable-ip-accounting" + "--systemd.collector.unit-include=\".+\"" + "--systemd.collector.unit-exclude=\".+\\\\.(device)\"" + ]; + }; + }; + }; + }; + }; +} |