5 files changed, 93 insertions, 1 deletions

diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 29cd96db..ee67d254 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -119,5 +119,36 @@
 
       cpuFreqGovernor = "schedutil";
     };
+
+    services.nginx = {
+      enable = true;
+      upstreams.grafana = {
+        servers = { "unix:${config.services.grafana.socket}" = {}; };
+      };
+      virtualHosts = {
+        ${config.services.grafana.domain} = {
+          locations."/" = {
+            proxyPass = "http://grafana";
+            proxyWebsockets = true;
+          };
+        };
+      };
+    };
+    services.grafana = {
+      enable = true;
+      analytics.reporting.enable = false;
+      domain = "grafana.vidhar.yggdrasil";
+      security.adminPasswordFile = config.sops.secrets."grafana-admin-password".path;
+      security.secretKeyFile = config.sops.secrets."grafana-secret-key".path;
+      protocol = "socket";
+    };
+    sops.secrets."grafana-admin-password" = {
+      format = "binary";
+      sopsFile = ./grafana-admin-password;
+    };
+    sops.secrets."grafana-secret-key" = {
+      format = "binary";
+      sopsFile = ./grafana-secret-key;
+    };
   };
 }
diff --git a/hosts/vidhar/grafana-admin-password b/hosts/vidhar/grafana-admin-password
new file mode 100644
index 00000000..56a69070
--- /dev/null
+++ b/hosts/vidhar/grafana-admin-password
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:HHEQGFQxEfyuQZIHjvS4kw==,iv:04dLr3xnha39cObi9LXjzhbfxIcy13tgNm510e/WQfw=,tag:SnVtPyjmtcfjdc4fsDEMpg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2021-12-31T15:57:51Z",
+                "mac": "ENC[AES256_GCM,data:Dqp4zA7D/hV5FQsp0czjym4MOjusC1CkmsitIHsD2XE87PN0LdAKTL/8tYSH+UGRdoSAnjyPYL5EastF5l4ubWNibom0R/it+TotvFBfaD27DWquZ3zvrwgjBXjaswGPYD5YbRocUmi1kOmZQtjegb6KTGpKicxwKbxg0xU/oHk=,iv:oHCqnCCSmwz23FItsThtNZC2J4doebMNVdhNkGv5+UM=,tag:u3owTxS9FHCZtG7YmDGbuw==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2021-12-31T15:57:38Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DbYDvGI0HDr0SAQdAQzuwBJzuzxQRohpEqMZtMaJo3c7FWAxJ1BrC0zOAJCQw\nzLfsrjUWCsxqBJkbK4h84Iun8OdulMHyAbg2knSGNWOQoe7ec1cGl06gFhuxkXzy\n0l4BEW/pamCejbYKw+OISBBB6atjs4b3aOzSbnJSBjauommsCnn8aJtZt1ZfctiY\nNo6tawcodNzYCzVmVDjfBM1270yrIP3W0hsttoyO/DQeZn2vB9YiFI59xnVqhrE7\n=tNlA\n-----END PGP MESSAGE-----\n",
+                                "fp": "A1C7C95E6CAF0A965CB47277BCF50A89C1B1F362"
+                        },
+                        {
+                                "created_at": "2021-12-31T15:57:38Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA10EukKZpWrIMHrNrhbGBjKMvpco+UusoYebYNuSi9RAw\nc+UuuxmshOxq0n0RTjNBZvhixPcj7P9t12ldk1V1NYlHOocMFf5te1wPbkMoqZKz\n0l4Bl93nSz43RQYjeoQWleUSrBchNQ/WOs7Wr4DKgoZ5nC3q+Pn6qQ/yYayhDjpW\nHR+06wk41uF3lnoa1vhu43eK/7CbaqzUZPInBrYbkat7MvE33Mq9rcoXBomNT4eO\n=dSyp\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
\ No newline at end of file
diff --git a/hosts/vidhar/grafana-secret-key b/hosts/vidhar/grafana-secret-key
new file mode 100644
index 00000000..aea7a8b6
--- /dev/null
+++ b/hosts/vidhar/grafana-secret-key
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:wX0eku+X3z11qszRjbzANkpnzb0UPA==,iv:vDFM+mK0ylbzsm8bqUfByAylxJW36AM4O96ThbPVEps=,tag:fu2hHRhNCO4AAmXswWOr+w==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2021-12-31T15:58:23Z",
+                "mac": "ENC[AES256_GCM,data:6UhUWxJ1IAgM4tubK0dD1bTQwmJZCZ6KkLTlkPRkbVRpN6zQAK/RT665Ok2lGpxEZ2yYrAMUMGs4Kvpii7NwEd6vj2Ad+4rKZygJ1V2hnmSCN0AUC/EdzGorFheMy+yjqJSJIZTc+ZIpQ7n/mtdPe6SyxJfzJOLXIZ6xFlteAhQ=,iv:3Xwa0pBwieGDmPTCD1i8qavRI5oa1Bm8AIz+EA/l2X4=,tag:X0s9WfxtlaR6GKtnmnFvDg==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2021-12-31T15:57:56Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DbYDvGI0HDr0SAQdA9CYiNCA1h7DNMvPg4qeFT1Yg1v3HdQRgUEj48QIYrDAw\navNJMsqFby1udTs4j80eY7hUm6FbD98MIr/Od0Pb1RznrLPcmTWYbSM6dHKLUjav\n0l4BJkl3Q8AiLsSWMfg9YQ7s5kBpzWmdajRJnV41lbMBKph0tRzzf/DvGjm9dDe2\nUS+rzi7WzWlmQS1ekMwNKAzz3ip4yJA4J591JOhtt96SqmQAHV8ww2q9IE6bOw6k\n=LmRs\n-----END PGP MESSAGE-----\n",
+                                "fp": "A1C7C95E6CAF0A965CB47277BCF50A89C1B1F362"
+                        },
+                        {
+                                "created_at": "2021-12-31T15:57:56Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAQbyLmRaWWln+lPYj5lAtbcQ4KQ7ntPyJJIsMl2kkBFYw\nIedaJ+SpExs2kXTlAWxa5B74RFmAPRlCq+ByErWDorovhn1uYI2ljeYIHKvrcgbY\n0l4B7XQlAV3pz3v/ZwUhB20zatPCprUWdJH+3Gd8xQr46djdHGK9WQSetxxEuL8j\nyfENUOu/jnPlfMVyDwRHbweq7Ar60GXVfs2UrjsL7yRjr0FpMNu3Ho4O4kO9HBn6\n=B+g2\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
\ No newline at end of file
diff --git a/hosts/vidhar/zfs.nix b/hosts/vidhar/zfs.nix
index 38c3a4e8..53ba5120 100644
--- a/hosts/vidhar/zfs.nix
+++ b/hosts/vidhar/zfs.nix
@@ -83,6 +83,12 @@ in {
           options = [ "zfsutil" ];
         };
 
+      "/var/lib/grafana" =
+        { device = "ssd-raid1/local/var-lib-grafana";
+          fsType = "zfs";
+          options = [ "zfsutil" ];
+        };
+
       "/var/log" =
         { device = "ssd-raid1/local/var-log";
           fsType = "zfs";
diff --git a/modules/yggdrasil-wg/default.nix b/modules/yggdrasil-wg/default.nix
index 3690964f..16f8d3a9 100644
--- a/modules/yggdrasil-wg/default.nix
+++ b/modules/yggdrasil-wg/default.nix
@@ -77,6 +77,9 @@ let
     sif = ["${batSubnet}:2::/${toString batHostLength}"];
   };
   routers = [ "surtr" ];
+  hostNames = {
+    vidhar = [ "grafana.vidhar.yggdrasil" ];
+  };
 
   mkPublicKeyPath = family: host: ./hosts + "/${family}" + "/${host}.pub";
   mkPrivateKeyPath = family: host: ./hosts + "/${family}" + "/${host}.priv";
@@ -241,7 +244,7 @@ in {
 
     sops.secrets = listToAttrs (map familyToSopsSecret hostFamilies);
 
-    networking.hosts = mkIf inNetwork (listToAttrs (concatMap ({name, value}: map (ip: nameValuePair (stripSubnet ip) ["${name}.yggdrasil"]) value) (mapAttrsToList nameValuePair batHostIPs)));
+    networking.hosts = mkIf inNetwork (listToAttrs (concatMap ({name, value}: map (ip: nameValuePair (stripSubnet ip) (["${name}.yggdrasil"] ++ (hostNames.${name} or []))) value) (mapAttrsToList nameValuePair batHostIPs)));
 
     boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard ++ [kernel.batman_adv];
     environment.systemPackages = with pkgs; [ wireguard-tools batctl ];