Get inventory to manage monitoring connections

This makes it so you can define the monitoring in the inventory and
tacitus will automatically, pick it up.

1 files changed, 116 insertions, 69 deletions

diff --git a/modules/prometheus.nix b/modules/prometheus.nix
index 63b761f..83eda86 100644
--- a/modules/prometheus.nix
+++ b/modules/prometheus.nix
@@ -1,11 +1,18 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  inventory,
+  self_name,
+  options,
+  ...
+}:
 let
   cfg = config.wilkuu.services.prometheus;
+  mon = inventory.${self_name}.monitoring;
   inherit (lib)
     mkEnableOption
     mkIf
     mkMerge
-    mkDefault
     ;
 in
 {
@@ -15,16 +22,45 @@ in
   };
 
   config = mkMerge [
-    (mkIf cfg.enableExporters {
-      services.prometheus.exporters = {
-        wireguard.enable = mkDefault config.networking.wireguard.enable;
-        fail2ban.enable = mkDefault config.services.fail2ban.enable;
-        node = {
+    (mkIf cfg.enableExporters (
+      let
+        data = lib.mapAttrs (
+          _name: mn:
+          let
+            default = (builtins.filter (a: builtins.isString a) mn);
+            custom = (builtins.filter (a: builtins.isAttrs a) mn);
+          in
+          {
+            ports =
+              builtins.map (n: options.services.prometheus.exporters.value.${n}.port) default
+              ++ (builtins.map (a: a.port) custom);
+            custom_port_mappings = builtins.listToAttrs (
+              map ({ name, port, ... }: {
+                inherit name;
+                value = port;
+              }) custom
+            );
+            exporter_services =
+              default
+              ++ (builtins.map (a: a.name) (builtins.filter ((a: !(a.skipExporterConfig or false))) custom));
+          }
+        ) mon;
+        data_all = (lib.foldl lib.recursiveUpdate { } (lib.attrValues data));
+      in
+      {
+        # Enable all the exporters outlined in the inventory
+        services.prometheus.exporters = lib.genAttrs data_all.exporter_services (name: {
           enable = true;
-        };
-      };
+          port = lib.mkIf (data_all.custom_port_mappings ? name) data_all.custom_port_mappings.${name};
+
+        });
+        # Let all the exporters export on all layers
+        wilkuu.firewall.layers = lib.mapAttrs (_n: a: {
+          allowedTCPPorts = a.ports;
+        }) data;
+      }
+    ))
 
-    })
     (mkIf cfg.enableScraper {
       sops.secrets = {
         "prometheus/stalwart-pass" = {
@@ -52,76 +88,87 @@ in
 
       services.prometheus =
         let
-          omega-relay-ip = "192.168.80.100";
+          nets_in_layer = inv: layer: lib.filterAttrs (_n: ifi: (ifi.layer or "") == layer) inv.interfaces;
+          dests_in_layer =
+            inv: layer: port:
+            (map (net: "${net.ip}:${toString port}") (lib.attrValues (nets_in_layer inv layer)));
+
+          job_destinations = (
+            builtins.foldl'
+              (
+                acc: perHost:
+                (builtins.foldl' (
+                  acc2: hostMonitorName:
+                  let
+                    current = acc2.${hostMonitorName} or [ ];
+                    new = perHost.${hostMonitorName};
+                  in
+                  acc2 // { ${hostMonitorName} = current ++ new; }
+                ) acc (lib.attrNames perHost))
+              )
+              { }
+              (
+                lib.mapAttrsToList (
+                  _host: inv:
+                  (lib.foldl' (a: b: a // b) { } (
+                    lib.mapAttrsToList (
+
+                      layer: lst:
+                      (lib.listToAttrs (
+                        builtins.map (
+                          a:
+                          let
+                            ifSimple =
+                              a: t: f:
+                              if builtins.isString a then t else f;
+                            name = ifSimple a a a.name;
+                            port = ifSimple a options.services.prometheus.exporters.value.${a}.port (
+                              a.port or options.services.prometheus.exporters.${a.name}.port.default
+                            );
+                          in
+                          {
+                            inherit name;
+                            value = (dests_in_layer inv layer port);
+                          }
+                        ) lst
+                      ))
+                    ) inv.monitoring
+                  ))
+                ) inventory
+              )
+          );
+
         in
         {
           enable = true;
           globalConfig = {
             scrape_interval = "10s";
           };
-          scrapeConfigs = [
-            {
-              job_name = "node";
-              static_configs =
-                let
-                  port = toString config.services.prometheus.exporters.node.port;
-                in
-                [
-                  {
-                    targets = [
-                      "localhost:${port}"
-                      "${omega-relay-ip}:${port}"
-                    ];
-                  }
-                ];
-            }
-            {
-              job_name = "wireguard";
-              static_configs =
-                let
-                  port = toString config.services.prometheus.exporters.wireguard.port;
-                in
-                [
-                  { targets = [ "${omega-relay-ip}:${port}" ]; }
-                ];
-            }
-            {
-              job_name = "fail2ban";
-              static_configs =
-                let
-                  port = toString config.services.prometheus.exporters.fail2ban.port;
-                in
-                [
-                  { targets = [ "${omega-relay-ip}:${port}" ]; }
-                ];
-
-            }
-            {
-              job_name = "stalwart";
-              metrics_path = "/metrics/prometheus";
-              scheme = "https";
-              basic_auth = {
-                username = "prometheus_wilkuu";
-                password_file = config.sops.secrets."prometheus/stalwart-pass".path;
-              };
+          scrapeConfigs =
+            (lib.mapAttrsToList (name: dests: {
+              job_name = name;
               static_configs = [
                 {
-                  targets = [ "mail.wilkuu.xyz:443" ];
+                  targets = dests;
                 }
               ];
-            }
-            {
-              job_name = "mikrotik";
-              static_configs =
-                let
-                  port = toString config.services.prometheus.exporters.mikrotik.port;
-                in
-                [
-                  { targets = [ "localhost:${port}" ]; }
+            }) job_destinations)
+            ++ [
+              {
+                job_name = "stalwart";
+                metrics_path = "/metrics/prometheus";
+                scheme = "https";
+                basic_auth = {
+                  username = "prometheus_wilkuu";
+                  password_file = config.sops.secrets."prometheus/stalwart-pass".path;
+                };
+                static_configs = [
+                  {
+                    targets = [ "mail.wilkuu.xyz:443" ];
+                  }
                 ];
-
-            }
-          ];
+              }
+            ];
         };
     })
   ];