grafana-agent: make bagel.monitoring.grafana-agent.exporters an attrset

This allows us to use multiple jobs, one for each additional exporter,
and set their `job_name` accordingly.

`job_name` is exported as `job` label on the resulting metrics.
This allows us to quickly get an understanding what metrics of an
exporter are actually available by simply filtering all metrics by
`{job="$jobname"}`

.gitignore

@@ -3,3 +3,4 @@ result
 config.tf.json
 .direnv
 .terraform
+.terraform.lock.hcl

flake.nix

@@ -34,6 +34,7 @@
       modules = [
         ./terraform
         {
+          bagel.gandi.enable = true;
           bagel.hydra.enable = true;
         }
       ];
@@ -41,38 +42,16 @@
   in
   {
     apps.${system} = {
-      apply = {
+      tf = {
         type = "app";
-        program = toString (pkgs.writers.writeBash "apply" ''
+        program = toString (pkgs.writers.writeBash "tf" ''
             set -eo pipefail
-            rm -f config.tf.json
+            ln -snf ${terraformCfg} config.tf.json
-            cp ${terraformCfg} config.tf.json
+            exec ${lib.getExe terraform} "$@"
-            ${lib.getExe terraform} init
-            ${lib.getExe terraform} apply
           '');
-        };
+      };
-      plan = {
-        type = "app";
-        program = toString (pkgs.writers.writeBash "plan" ''
-            set -eo pipefail
-            rm -f config.tf.json
-            cp ${terraformCfg} config.tf.json
-            ${lib.getExe terraform} init
-            ${lib.getExe terraform} plan
-          '');
-        };
-      # nix run ".#destroy"
-      destroy = {
-        type = "app";
-        program = toString (pkgs.writers.writeBash "destroy" ''
-          set -eo pipefail
-          ln -snf ${terraformCfg} config.tf.json
-          ${lib.getExe terraform} init
-          ${lib.getExe terraform} destroy
-        '');
-        };
 
-      default = self.apps.${system}.apply;
+      default = self.apps.${system}.tf;
     };
 
     devShells.${system}.default = pkgs.mkShell {

hosts/bagel-box/default.nix

@@ -42,9 +42,9 @@
   };
 
   security.acme.acceptTerms = true;
-  security.acme.defaults.email = "bagel@delroth.net";
+  security.acme.defaults.email = "infra@forkos.org";
 
   services.openssh.enable = true;
 
-  deployment.targetHost = "bagel-box.delroth.net";
+  deployment.targetHost = "bagel-box.infra.forkos.org";
 }

services/hydra/default.nix

@@ -42,10 +42,10 @@ in {
       port = port;
       dbi = cfg.dbi;
 
-      hydraURL = "https://hydra.bagel.delroth.net";
+      hydraURL = "https://hydra.forkos.org";
       useSubstitutes = false;
 
-      notificationSender = "bagel@delroth.net";
+      notificationSender = "hydra@forkos.org";
 
       # XXX: hydra overlay sets pkgs.hydra, but hydra's nixos module uses
       # pkgs.hydra_unstable...
@@ -108,7 +108,7 @@ in {
         worker_processes auto;
       '';
 
-      virtualHosts."hydra.bagel.delroth.net" = {
+      virtualHosts."hydra.forkos.org" = {
         forceSSL = true;
         enableACME = true;
 

terraform/common.nix

@@ -0,0 +1,7 @@
+{
+  # Until we get some kind of KMS operational, store secrets in the state file.
+  terraform.required_providers.secret = {
+    version = "~> 1.2.1";
+    source = "numtide/secret";
+  };
+}

terraform/default.nix

@@ -1,5 +1,7 @@
 {
   imports = [
+    ./common.nix
+    ./gandi.nix
     ./hydra.nix
     ./state.nix
   ];

terraform/gandi.nix

@@ -0,0 +1,67 @@
+{ lib, config, ... }:
+let
+  inherit (lib) mkEnableOption mkIf tf;
+  cfg = config.bagel.gandi;
+in
+{
+  options.bagel.gandi = {
+    enable = mkEnableOption "the Gandi DNS configuration";
+  };
+
+  config = mkIf cfg.enable {
+    terraform.required_providers.gandi = {
+      version = "~> 2.3.0";
+      source = "go-gandi/gandi";
+    };
+
+    resource.secret_resource.gandi_pat.lifecycle.prevent_destroy = true;
+
+    provider.gandi = {
+      personal_access_token = tf.ref "resource.secret_resource.gandi_pat.value";
+    };
+
+    resource.gandi_livedns_domain.forkos_org = {
+      name = "forkos.org";
+    };
+
+    resource.gandi_livedns_record = let
+      record = name: ttl: type: values: {
+        inherit name ttl type values;
+      };
+
+      # TODO: make less fragile and have actual unique and stable names
+      canonicalName = record: let
+        name = builtins.replaceStrings ["."] ["_"] record.name;
+      in
+        "forkos_org_${record.type}_${name}";
+
+      forkosRecords = records:
+        builtins.listToAttrs (map (record: {
+          name = canonicalName record;
+          value = record // {
+            zone = tf.ref "resource.gandi_livedns_domain.forkos_org.id";
+          };
+        }) records);
+
+    in forkosRecords [
+      (record "cl" 3600 "A" ["163.172.69.160"])
+      (record "cl" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])
+
+      (record "fodwatch" 3600 "A" ["163.172.69.160"])
+      (record "fodwatch" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])
+
+      (record "netbox" 3600 "A" ["163.172.69.160"])
+      (record "netbox" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
+
+      (record "bagel-box.infra" 3600 "AAAA" ["2001:bc8:38ee:100:100::1"])
+      (record "gerrit01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::10"])
+      (record "fodwatch.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::30"])
+      (record "meta01.infra" 3600 "AAAA" ["2001:bc8:38ee:100:1000::20"])
+
+      (record "grafana" 3600 "CNAME" ["netbox"])
+      (record "hydra" 3600 "CNAME" ["bagel-box.infra"])
+      (record "loki" 3600 "CNAME" ["meta01.infra"])
+      (record "mimir" 3600 "CNAME" ["grafana"])
+    ];
+  };
+}

terraform/hydra.nix

@@ -1,6 +1,6 @@
 { lib, config, ... }:
 let
-  inherit (lib) mkEnableOption mkIf types mkOption;
+  inherit (lib) mkEnableOption mkIf types mkOption tf;
   cfg = config.bagel.hydra;
 in
 {
@@ -14,9 +14,12 @@ in
       source = "DeterminateSystems/hydra";
     };
 
+    resource.secret_resource.hydra_password.lifecycle.prevent_destroy = true;
+
     provider.hydra = {
-      host = "https://hydra.bagel.delroth.net";
+      host = "https://hydra.forkos.org";
-      # username/password are provided via HYDRA_USERNAME/HYDRA_PASSWORD
+      username = "terraform";
+      password = tf.ref "resource.secret_resource.hydra_password.value";
     };
 
     resource.hydra_project.forkos = {
@@ -24,7 +27,7 @@ in
       display_name = "ForkOS";
       description = "ForkOS packages collection";
       homepage = "https://cl.forkos.org";
-      owner = "raito";
+      owner = "terraform";
       enabled = true;
       visible = true;
     };