{config, ...}: let
  prometheusPort = config.m3ta.ports.get "prometheus";
  nodeExporterPort = config.m3ta.ports.get "node-exporter";
  kestraMetricsPort = config.m3ta.ports.get "kestra-metrics";
in {
  services.prometheus = {
    enable = true;
    port = prometheusPort;
    listenAddress = "127.0.0.1";
    retentionTime = "30d";

    scrapeConfigs = [
      {
        job_name = "node";
        static_configs = [
          {
            targets = ["localhost:${toString nodeExporterPort}"];
            labels = {
              instance = "AZ-PRM-1";
            };
          }
        ];
      }
      {
        job_name = "kestra";
        metrics_path = "/prometheus";
        scrape_interval = "15s";
        static_configs = [
          {
            targets = ["localhost:${toString kestraMetricsPort}"];
            labels = {
              instance = "AZ-PRM-1";
              service = "kestra";
            };
          }
        ];
      }
      # Phase 2: add AZ-CLD-1 node target (scrape over netbird 100.x).
      # Phase 2: add blackbox_exporter, podman/cadvisor targets.
      # Phase 2: enable remote-write receiver (extraFlags) for Windows clients.
    ];
  };
}