fix: litellm -> grafana

hosts/AZ-PRM-1/services/monitoring/cld-scrape.nix

@@ -1,7 +1,23 @@
-{config, ...}: let
+{
+  config,
+  lib,
+  ...
+}: let
   nodeExporterPort = config.m3ta.ports.get "node-exporter";
+  litellmPort = config.m3ta.ports.get "litellm";
   cldNetbirdIP = "100.91.203.184";
+  litellmPrometheusBearerSecretAvailable = builtins.hasAttr "litellm-prometheus-bearer" config.age.secrets;
+  litellmPrometheusAuthorization = lib.optionalAttrs litellmPrometheusBearerSecretAvailable {
+    authorization = {
+      type = "Bearer";
+      credentials_file = config.age.secrets."litellm-prometheus-bearer".path;
+    };
+  };
 in {
+  # Prometheus' config checker validates credentials_file paths at build time,
+  # but agenix secrets only exist at runtime under /run/agenix.
+  services.prometheus.checkConfig = lib.mkIf litellmPrometheusBearerSecretAvailable false;
+
   services.prometheus.scrapeConfigs = [
     {
       job_name = "node-cld";
@@ -14,11 +30,26 @@ in {
         }
       ];
     }
+    ({
+        job_name = "litellm";
+        metrics_path = "/metrics/";
+        scrape_interval = "15s";
+        static_configs = [
+          {
+            targets = ["${cldNetbirdIP}:${toString litellmPort}"];
+            labels = {
+              instance = "AZ-CLD-1";
+              service = "litellm";
+            };
+          }
+        ];
+      }
+      // litellmPrometheusAuthorization)
   ];
 
-  # Allow CLD to reach PRM prometheus scrapes (prometheus initiates connection TO CLD exporter)
+  # Allow CLD to reach PRM prometheus scrapes (prometheus initiates connection TO CLD exporters)
   networking.firewall.extraCommands = ''
-    # No PRM-side firewall change needed: PRM scrapes outbound to CLD:9100.
+    # No PRM-side firewall change needed: PRM scrapes outbound to CLD:9100/4000.
     # CLD-side must allow inbound from 100.91.49.26 (PRM netbird IP) — see CLD config.
   '';
 }