monitor kestra with prometheus alerts

hosts/AZ-PRM-1/services/monitoring/prometheus.nix

@@ -1,6 +1,7 @@
 {config, ...}: let
   prometheusPort = config.m3ta.ports.get "prometheus";
   nodeExporterPort = config.m3ta.ports.get "node-exporter";
+  kestraMetricsPort = config.m3ta.ports.get "kestra-metrics";
 in {
   services.prometheus = {
     enable = true;
@@ -20,6 +21,20 @@ in {
           }
         ];
       }
+      {
+        job_name = "kestra";
+        metrics_path = "/prometheus";
+        scrape_interval = "15s";
+        static_configs = [
+          {
+            targets = ["localhost:${toString kestraMetricsPort}"];
+            labels = {
+              instance = "AZ-PRM-1";
+              service = "kestra";
+            };
+          }
+        ];
+      }
       # Phase 2: add AZ-CLD-1 node target (scrape over netbird 100.x).
       # Phase 2: add blackbox_exporter, podman/cadvisor targets.
       # Phase 2: enable remote-write receiver (extraFlags) for Windows clients.