feat: enable vault metrics

services/vault/default.nix

@@ -56,6 +56,10 @@ in
       storageBackend = "raft";
       listenerExtraConfig = ''
         cluster_address = "${wanAddress}:8201"
+
+        telemetry {
+          unauthenticated_metrics_access = true
+        }
       '';
       storageConfig = ''
         node_id = "${config.networking.fqdn}"
@@ -66,7 +70,19 @@ in
       extraConfig = ''
         cluster_addr = "http://${config.networking.fqdn}:8201"
         api_addr = "https://${config.networking.fqdn}"
+
+        telemetry {
+          prometheus_retention_time = "60s"
+        }
       '';
     };
+
+    bagel.monitoring.grafana-agent.exporters.vault = {
+      port = 8200;
+      scrapeConfig = {
+        metrics_path = "/v1/sys/metrics";
+        params.format = ["prometheus"];
+      };
+    };
   };
 }