{ config, pkgs, lib, ... }: let yaml = pkgs.formats.yaml { }; in { services.prometheus = { exporters = { # Periodically check domain registration status domain = { enable = true; listenAddress = "127.0.0.1"; extraFlags = let conf.domains = [ "tlater.net" "tlater.com" ]; in [ "--config=${yaml.generate "domains.yml" conf}" ]; }; # System statistics node = { enable = true; listenAddress = "127.0.0.1"; }; systemd = { enable = true; listenAddress = "127.0.0.1"; extraFlags = [ # Disabled by default because only supported from systemd 235+ "--systemd.collector.enable-restart-count" "--systemd.collector.enable-ip-accounting" ]; }; # Various nginx metrics nginx = { enable = true; listenAddress = "127.0.0.1"; }; nginxlog = { enable = true; listenAddress = "127.0.0.1"; group = "nginx"; settings.namespaces = lib.mapAttrsToList (name: virtualHost: { inherit name; metrics_override.prefix = "nginxlog"; namespace_label = "vhost"; format = lib.concatStringsSep " " [ "$remote_addr - $remote_user [$time_local]" ''"$request" $status $body_bytes_sent'' ''"$http_referer" "$http_user_agent"'' ''rt=$request_time uct="$upstream_connect_time"'' ''uht="$upstream_header_time" urt="$upstream_response_time"'' ]; source.files = [ "/var/log/nginx/${name}/access.log" ]; }) config.services.nginx.virtualHosts; }; }; extraExporters = { fail2ban = let cfg = config.services.prometheus.extraExporters.fail2ban; in { port = 9191; serviceOpts = { after = [ "fail2ban.service" ]; requires = [ "fail2ban.service" ]; serviceConfig = { Group = "fail2ban"; RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; ExecStart = lib.concatStringsSep " " [ "${pkgs.local.prometheus-fail2ban-exporter}/bin/fail2ban-prometheus-exporter" "--collector.f2b.socket=/var/run/fail2ban/fail2ban.sock" "--web.listen-address='${cfg.listenAddress}:${toString cfg.port}'" "--collector.f2b.exit-on-socket-connection-error=true" ]; }; }; }; }; # TODO(tlater): # - wireguard (?) # - postgres (?) # - blackbox (?) (curl to see if http and similar is up) # - ssl_exporter (?) }; }