add grafana

dns/dnsconfig.js

@@ -40,6 +40,10 @@ D(
   AAAA("glitchtip", prod6),
   HTTPS("glitchtip", 1, ".", "alpn=h3"),
 
+  A("grafana", prod4),
+  AAAA("grafana", prod6),
+  HTTPS("grafana", 1, ".", "alpn=h3"),
+
   A("sandkasten", prod4),
   AAAA("sandkasten", prod6),
   HTTPS("sandkasten", 1, ".", "alpn=h3"),

env.nix

@@ -15,6 +15,7 @@
     defelo = "10.23.1.2";
     nico-p14s = "10.23.1.3";
     nico-prod = "10.23.1.4";
+    morpheus = "10.23.1.5";
 
     admins = [
       defelo

hosts/prod/default.nix

@@ -8,6 +8,7 @@
     ./docker-images.nix
     ./firewall.nix
     ./glitchtip.nix
+    ./grafana.nix
     ./morpheushelper
     ./nginx.nix
     ./restic.nix

hosts/prod/dns.nix

@@ -22,6 +22,8 @@
         "/api.bootstrap.academy/${env.host.prod}"
         "/glitchtip.bootstrap.academy/"
         "/glitchtip.bootstrap.academy/${env.host.prod}"
+        "/grafana.bootstrap.academy/"
+        "/grafana.bootstrap.academy/${env.host.prod}"
         "/sandkasten.bootstrap.academy/"
         "/sandkasten.bootstrap.academy/${env.host.prod}"
         "/prod.internal.bootstrap.academy/"

hosts/prod/grafana.nix

@@ -0,0 +1,38 @@
+{ env, config, ... }:
+
+let
+  domain = "grafana.bootstrap.academy";
+  port = 8008;
+in
+
+{
+  services.grafana = {
+    enable = true;
+    settings = {
+      server = {
+        http_addr = "127.0.0.1";
+        http_port = port;
+        root_url = "https://${domain}/";
+      };
+    };
+  };
+
+  services.postgresql = {
+    ensureUsers = [ { name = "grafana"; } ];
+    userPasswords.grafana = config.sops.secrets."grafana/postgres_password".path;
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+    allow = env.wg.admins ++ [ env.wg.morpheus ];
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString port}";
+      proxyWebsockets = true;
+    };
+  };
+
+  environment.persistence."/persistent/data".directories = [ "/var/lib/grafana" ];
+
+  sops.secrets."grafana/postgres_password" = { };
+}

hosts/prod/secrets.yml

@@ -4,6 +4,7 @@ wireguard:
         defelo: ENC[AES256_GCM,data:ddj/dmcOWPtg+hOX6rgl8fSS6sx6057b7HhT7ANcJXBca3PaI6OonQh8WUw=,iv:tzEkg6Y/sTTt2sFuVBthNaE/mDDMgSLOOsakJujYQWI=,tag:K1Dk8bQLZaLIfJkyy6VgVw==,type:str]
         nico-p14s: ENC[AES256_GCM,data:dJhJsKN3pcC1HXzxtyfPCnntLC34dVRAGRiobYl04rhlrxLxxaexVibyR9Y=,iv:S+xv1CGvW5SaFkIQMF7dhAeXDb5t1k4mDo/MTyIlKa4=,tag:MSMumSB9SHJWSNACx9lMeA==,type:str]
         nico-prod: ENC[AES256_GCM,data:+ec8uA5xa197dQjaERpDUGpcCEREJ14mzDwTAJC/HJ9BI2hLcpespiez+Fg=,iv:7iJMDTRCQhDcD5gMUURn3gqekYODqv63DTA2YJ3HBqA=,tag:cb/4UCO7nIdSDcFVPZUlLQ==,type:str]
+        morpheus: ENC[AES256_GCM,data:UjPqhdPacrojIqeKq7GwCHQvlxT1GWcAmbI4/9gLvLyUawQ4iAuCN5xESm4=,iv:vMAitnHk8MuIBjSLbTnZ3aFe0XdB88u4unuUYr2AlS0=,tag:47uV754GL6C0uj4aOdQ8gQ==,type:str]
 glitchtip:
     secret-key: ENC[AES256_GCM,data:lROEC7XIoS9qB9UmmWJgThUCQdKz67LpN2+s3gncPs71jQAG8KpzelRbl28ak7/gDS1JreTYDBRjUB9XwOfppq7qwgM2ZyikN1afdoXFSDUsst2mkxuT1lJiAL2nEQUZ8NK9TcXkS3RGQTX9Ppzx0Qu0gtYFrOXwarlfGgQhWD0=,iv:N4qfNW6r0rdtlUhqUjBSeSR5wrIZJNHmv+5nY7E7meY=,tag:l/oKHhmJ3sHF2pWDfIj0BQ==,type:str]
     smtp-password: ENC[AES256_GCM,data:JKvRVRgpbhJWsf13mSuQUQ==,iv:1N964hWVmwcg6Whe1LJ3XgXV0REnQ0rkzScRE7twVmU=,tag:h2bkPgU4rE6divagKSUvrw==,type:str]
@@ -50,11 +51,9 @@ restic:
     test: ENC[AES256_GCM,data:sFzaPY0JG8Ur9iIo1NflCId74ArBJ44ajNntEL7tMNX1VieOlkHz3rOUEUMrzR5uSuvAWYDXncBiCZ074ecaNV4YSUCaOex3gY53J/6mlbFqwCm7ao+adE7Sawgm62j5oN0LPSdC0PyDfEuWxAez+4U/1DjmCHbgyDFmKDSLfBg=,iv:PZq60NRg1EngL4VcXisbTVoi7dN08lKkCbCnv9Bjcv8=,tag:5BwkeNBLrMEfcN5VsYOGAA==,type:str]
 attic:
     jwt-secret: ENC[AES256_GCM,data:VZrzn/fVJeAgTgIC4Rb1gz91SRqVDIXTAIOG/2p8DQj5B1GZCb8SuHIAhDuynAzp4le5dwklQV7P4HWhAz+pnMXyrkqyjL7Yhb8RoQSLgVrCvuQ9NZH5jKo2xyTlnxFcb7oHySIvVmR2dgM9YKy+zWN62NUqlKq2TqrKSp1lcWE3SmziRwylIObyD9fdHshaG9jLsxgltNzOTZ/GZYAtNY4TRrKky8JDIFiGVLl1I49jN258K/88QeR5qr9mlo565Iu+05ruOKHvoQXBLxg3GccVlmzKWiKm43NliKKsr7HsDQF0ZvRT/+UnesSPyVtm21zzd/xTFZCL47sr3BIZtVAhmJmgR54IFjvU5LsQrufBm8LDPKvs7Wn8ufzuVPpcKm+Be904ZzDskC2EMIQ778fgyi1Wvl7sRJRAwwBhtRNoz3LBZqfQVdoRJVL6QDAMvdCqMmS6beWq3+NdbjaCrSvf953YRyaC5OR5cVJOdncjqqbpOFTbW5flq5JNTwXw1aoE14C7F6eXVWruHICePw/FNH44v0Tz90WEfmWknWR26PJhGX1PByMDjgm+PuTtNdg4QNVEQVwLQlOGaTAJSNPzQOfeVzAByWVHC+PTQu5n0d3C4hxJAmVjc5qI1el1g6+pCPZyyfWe8eM3qYiEvS5Ka3F1DjqTL0nBUjHJZz/xKhycFKm21GxhoQg3JgnJch2QJb5ezj776IXcDFoGitrO8Jfh4YmJAmSiex9aWS5yvXEOI8PfH1lEAFrEOnd1FmwLaVIRdlL+I8fSk1AZFYUJ9JXCh/6kTkdAfyetJzE3L237zM9VexK9fnhIR6Sqyous094HvryajjkT2hHxwKwwWDLChqsX4hzg0GEvEguzaWUfvaCVQQ4DrsML6wOL1KgrK1KgH5zBSp9KwEVKWCbvmOxWiRN4bwYOCIwa3zPaJSJKi7+WWoQmiukIMGt7UM/PwzBD0OkE3gZwDdSUB1FCOTl9hXSgQCxp3FSk9pzBADTZfnImxd8HS5GVmFYIaK36AgPJStj+Dkk5nKjwUtQ4EMBCj1A6e/nejfrbrLAgeMMv+sZ61ylcFnGGdawK1j+dVWOHMJRT92RwTWs4anDjrWuX/rDIoVjSnnh6TvZuJOsJWInLYARItFqBdwKefNhgpVj2Zft/1N165rICnUx3ssy06s1DBD06ZMNvJLOQeWzadlYSEwDrtsGOpxHnYI18Iwkistst3pHCNHMNnLpdzbNEbSyF9IbKM+HKQTHUHG6im8To5ApU72A/3pTqVYenpTbWR9Q3xhH6qDqauuHaXK4VTpVPU5HB3U6rz5E9uJpV/CVN7GD1ioiIFYusv8AV/RNuq6+yDtglHjr4YygZsP1D/OkQtzKgo36yMhMDg+27Xa5xtd0TWOqkfQ1qv+vtDdJI9KVpHTrqd9QM2Cy/GbbAcHwIjreJiZZLwzaD72q4H6SyjW59OvyEyADvpbzBdOP/CiKFCSTQYujZGNP1NysLnRBJ2Ca4T4pzklEFQkrtEtJt6EfAn7ukyQooS906iVpWszvkjekpwsWqkHfvmD96vmdOUSzqU7t1ua17m9avfBFNL1Ep9GUl2geOdEcYnSY9YgMEFNf8u3Ax1+xwkIJWzDY21pM+agC5+tb8atn8hnD2ep0FYEhqk8b671bQ0nBDD79yYO/F8qzjdCNnmJR+/ajj7koSLWF3ojxFxczopRNXZQ9EpygbCsqxS3trdSUjEaiSWpgFuBD1VgUizVS9YpqZ45IRlzzP2qd/OjHvHwJzGRfj2bei/7YvKWENUOdwqoX49kKCTgw6EEQRSWCVqGjyT7O1IHAziu4IauXYU/wdggEXURpiSzWVhi7M3dXt3XACb3M51Qi2qDtntwyqtdpptRQuLlGwijvp7La+JyoJRqjt8Ipe5VX5wyL7zkHafMygnQEMCBR59ZP91Z+2hI3vEFzEWf9Rjdb0IxkjDAQITGNAZfMUTe6+QilehgzW/6fNXR1IjSGB4u/narmxk1aztu0CJ6PzXC685Xu9xClgFJpbBn3DWWUfQGcOdOjABHlMJmnLvSN8P3YW3OtClHo32Vy4pVgDUAyQPDPG3YSLCUgTOInDu9FeJ+jc/o4iaXuG2hrboNvsxOKwikd3Jkvjbbu76p1gkIx9Pr60RnGxnKeVYTZFPtzvHuzOenBkztL10Ow358+vgT6tuoc8k68AHNg9vTweKe9QaSQEXBhF4XB82oW9Dg781nPQvMKIpGdNPKAlOPw02iDU4vp2BTdtS3UMzHCqB2Db+goMY1tXtzrXHmxVigOvXf6k0H4F4F/IE3X72wEIW518R2XdltFBPyxcFelMVm2GIkajUDJ7OZXRyFLNaQ6lbGGLoP8DVtmhWiXqBzHmjjoyeG981r2kr57DWWTZ6flk+od9A+vAJ24vJOi2tfXqQuvvhQl/khSJyhBuptWxYRe1x2K/xhAzvVGZHsk5CLIj5/McMJtZGcLc1GimlZPEWLsGeVim5zwkvcRznP74FyhN2y9B5M8WpoS7LXAwQ1EsDoA702w48rDBM+n5VVn0ngkAKcL0AWdMC2dgEyJcU41CwQFyLvEBej8y6SOsdPkOodnKLnZiL2AmAxuHvaJHkvg95ScrdV6QQm75iPv3E7iiGkAG4l3JQyEGL3GnkDfamf729VhtgPDggfAa9Vc4PoNHwU9yWykC5Fjqrrr383JPqRLT39klBknG7RHJTX9ik3mqbo9KKWdCIV+jkTKcPJ05hXi4ZfMSW1vwRMQ2MRvMLYyZ6I15dSX/Pl5qYTeUb3clGsv14fKHIbfEUDIjo1UXAXksHNlm1ioGDXW+X2HZGQQDjcGfRd2Zg0eOQ5M08zY7X3ixuhoNOrrkGvqRFqvuVI50DVlWRiwEcVlzC5NdoIA0t/PWzsPqPRg9YthFf0KA26QBAuNL4Rl0vUJTB553tTNDXJgr8Wgzikl6/dbXMLrvKwJjbPtfudHHLVknLjf4c/mlroVJ2nbIsHmubuwO3NPl/eykJ9h/5juY0VT5EKZkwma+c1ElF1leTA5VbhK0EWH7EMX1fphxbCBcYnXVoA256g98Wgqe3Cc0ISFSYIYr085ERQO2E57DX2nLmm40XF5nWvuykkwDOdlIUEjyNNxGXmmG0T+EhZANq7lw2Ht3tBwQR980Zk1Ga5hwR3E4gF/7xM2hcp13N5q7q/g7noSNw/FgSAQveQiX9P6INiXeJErbs1jpD1xrmhttKPTAedNpwgwRVgkPUrIHeTds4jRyhEbWPNzd9rVKmUwrr6QVeETKpBzCmnh5UUwsJ1D3A4kKz2lN7TXOlQZXCAF4LVamcmFu4OGUZiKfEGAV1swhdY/ZZm/qRXq9DRvLF+Lo2fjrFiBCrkYPl4NeLFNHkGf271jWWi9Stzt06pYch5vb2AHusLq6y/EVadFKyryHutrzTpw6lq6JwONQM6Hkhth0pMRAyZxVFrWf1zIg+7uz2FiucYrZ8sgjsji4jIz4wgdKgntZVhCMIcwrht5q1+ceNO8qKWRaFCe1VPTLbEy00XPufgfvisENL+NR0LztgfhdPOvUoI+t211KKUnjJCqzzhIZKdj719WKCZhffzLFvvMg3tS5+FzBGL0PuojGNu2yfzL3J25IND0wnC4yOKJZW8vIMVcLT0zdVYj0lQfnkug8LH5NN1z25EZ+/NZWKTy10if2ShJhCOAXmYJBFrjpYhHpIhe1VdHQcmIkyN4PJNO0JLiSwoik9H4LQiGohTJUuTaMuJub07hiDNn6vdDpyUWlJnoP7+4gaDndtaaC8Dnm1ZVXuA87+M9y0lV6cj6or+q3oVgpY/AfVnBYCd0JA3B0fwqmFDpL6IlcNXiVbZt1CoOqhPj+E2h6JmjBeNqkULLRLeHrk8eHedjfTpZcSJyky/yef25SgYjQl/WSDG3oYkEsJr5gFe/yYt1fTW1UFIaP6DvahG9T+s5V98Fpj7OcmdVZTWdovlQqVE74TKoN5pLReTtx6+f2ZUbZB9PimTB6Oua7y6j6I6rz8d7/N/+/BGgqPODF0elxbfwR+sL+0dnRk2o5WzsYutwbmzg3BXMPT1lRuf6+PJ+1GDugFbtWu3i2i7Xivn9yHeesLNJH34Jl3ckjp3TMeZnzxBhjTP2kStOc/DFYCE8g8Xx43GMhWe48GUD3vGFNvGDBldeRjQaqkgtnDJqIvOdwjGLkZWYT8bG7pzONLFcoqg4tUYShi7s7OEgaraD3Cte4zYN1Zzt+CIma8G7TKN4EG00fTQPgg28l+BvYVLIOaXxANS/hW5XUF3DkkPfErdJwzPdXkBTBIkU3r+w4LfSvIWcf9E3qI3g82LDGsCBMGz5ehCvkSu1X5PZR34fOB3DU7zrRqscKl796x/uANGWdbOwSs1wmFqPxkVJAFnFAgQGw3LMQ5BDT7uYe8RKQqJAl0MyMfWJ/8NATN6DNfVcbU0zRmebfnn3r4SLI63OHOs2ETMo4rVLjyy7bxUmfWlJsmfu8fmkXB7LKccUIyMtySu0oXYhleWlbGkhWaH7PjlAjj1Xcnip6nG8OVVFiurb8YCP42suDUiuk+N6zNrJI9mAiZYkT/2kFpOQex5yOfeA6/f6rMDKJI5F5ytEUnZI3HWJMaM78cHDiF3ERCyJLU6QNkAvN3jikmJ/5OwJheg6lGEZk/Az7NlasZxAkqNMImcQzgOAkGRIPBxFTs4ClUdqNmuiuTakKsvkFMKPjHCqwTJS8ZBTNpnrF79T4SrkP8CrHJqLqEo8w2rbAie84QVK8dZnlJK1g0BqU3RKCPCK2CiRfgqEaauA8UvoZqqFis501RBXrT5WAE6YoD4ZkmTfvw0sdvKZQchquuEG4JPpTMYFhlLWyUhXU4J52iZUh9dZJhxZZ3OnhVTTIu2cWqjVha68FbviBcMnBLEXjGvXvR76ofAsyUcW5qcRObteZ18MT+jIbsJiA1D6E8tFmUQMz1xwNkQjXj9BkDwri015M9ccWGF5xgvMUkM/AzYBR4SV6V3bVWYY9FJ3kiJJIMNYDbbXi1oP2ATeHaJ/wTN1pVS1mrFKzmZ17w5kUg0WJZXH3dvF89zRBl2WnUUyelEJsjOwtSQNaBfnneJJGKbvCyDoZPfkTvXpry4gpVg1IP4YY+miGi19RX4I22NJPjR96Z2ve5/wlhnk+aqrdDmSd8SitSO1xm5uwPY8iNVYK+URc3cLVMN9QXz3TkCLjAjSM36mLt7GivhU5wXyx2Hs6B/iWHoXXKjDhOY9Y5yELXDVpXYwPwV2yzaXyNNqQVgeSMKA7J86N+gaoQQIZVW1Z+aB8C8WWAvkNbaIBXxc/Wrowxnoo+ZPkibSXAiqRL8Q/g3gRdMwqIUOxWVm5md/RH9XfBRv5tr/c5rKDlKdgedbQItKpvjj12W4JILIZ5G4Tdzojb5IDSKJjBX/e2fX9lIeNOj1kyr7G0LGs4F7WzzLcLDYNHhDBensVbxj/iyCJzKw57zg7igV8IHqAKnTb2bPTn5sbERwHcHFmzQfYtFh3rvsuPgKjC6w+HOZXfR5tc6o6266Y3xAWE5hy1n+LAletewBUCiMaL4xLsMoBflAJl+qTW2U4ARrzJSfoL8PnQcH5Uy0JFZ98SlZpu0e/LY+mPsWikwDxr4hjrXUM2mGziZ0YXeEimkqLlEswevpiPoURDNltuqgWSTLuxnqB944ihXio9ufKTCN/P7iNSjGqPD02OqIqFST6WFB4WeBVn82suiEWoEcKdFHqgA==,iv:nnrMZ6pihxxKjBu7wtPZpVd7EyXO/FimOVHmzaqJ4/k=,tag:kY1W1Gx2vWf+QOv9buH34g==,type:str]
+grafana:
+    postgres_password: ENC[AES256_GCM,data:a9vC1Hc4cVbIOMTbub+57hri6gTSKY3tByCz6wlpub2KB0mAxTHtKWuARM2h3muaWRcFUPkT+cR7IJjFwKckFg==,iv:iUwPq89O7OnG6Zfuj9dgHyBbt5iXtL/nt9/N3B36j5s=,tag:dtfGbx1ZZOiycx96w3pJew==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age13r2hmarqllghyaavnu57w8rtcsf5qgnvr65smw50fkd2c4gvrgfshhwj3n
           enc: |
@@ -65,8 +64,8 @@ sops:
             Tk96anAyOEFGd1plUlp4SU5LbE5TT1UK6SPKztdzU5K1FjQ5sFjUnF4HK8cAFqh1
             YR7o5tur1y/bLMESGS7/j7ofST96NuyU+EVgs/lt0Rd0Voh1Q8aKKQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-01T19:45:15Z"
-    mac: ENC[AES256_GCM,data:h8se0ZIryxyF0RE5pAiSy7Ht0h/Oa8iYLokyI2YarZlAEsrye/aN8iOM6KlyCGngFIS5blCuwhX91kTNC1VbH3qUxsquuagnf3Hg1l6u/C361A74uMuP4ERiwqLFgpzVntdvem++Yd7l8S7diBViNQwDTu/0fwKVoLNGiOoiy84=,iv:SUfLpEv0yUbl+1GjSeJs3YLfQv09n4JAeubgOnxrZDE=,tag:9dIU0QyqvHLV1FN3dWKJKA==,type:str]
+    lastmodified: "2025-10-30T16:47:09Z"
+    mac: ENC[AES256_GCM,data:8mY1KOUCiCoI64dtsNL9CsYvyJjzih2UbNLPDVU0sNTZ4VR0KfVJjRLXUzQs3Vtkb7llHKT9t7dtbVMzyFdidE8oyvy8QVzRsCOK8NhrJ3UVYWk7sb4NTW9UuZhULj71SI46+RR+rfGJx4c+jAHuHVZ/LTdCe3HbGNBanjI/iMk=,iv:QbgA1oFVo31wfQuKVNwiioMQhy0lppMSp+KvEUd5ljc=,tag:GLiZQRpz4Up0d18OlPKqLg==,type:str]
     pgp:
         - created_at: "2024-09-09T14:34:26Z"
           enc: |-
@@ -92,4 +91,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 0797D2389769CA1E57B72ED92BA7811687C90DE4
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.11.0

hosts/prod/wireguard.nix

@@ -11,6 +11,7 @@ let
     defelo = "m247NX1GQVhM0+H/TNtZ7shEMy+nC1Z7C/NFYBjNFn4=";
     nico-p14s = "EtC01X70ExI7Kvrp5tzE8wWlcbKD/QHg6wIvUB5ewQI=";
     nico-prod = "PrSCG2vuAiHKnB3AJm1ii6T2LHaB8ZRu8GinjPGfXEc=";
+    morpheus = "9KenEdGlpX3kmlNRSk4tUgAwQjokbsGDI7Oglw40JT8=";
   };
 in