{config, ...}: let
  nodeExporterPort = config.m3ta.ports.get "node-exporter";
  cldNetbirdIP = "100.91.203.184";
in {
  services.prometheus.scrapeConfigs = [
    {
      job_name = "node-cld";
      static_configs = [
        {
          targets = ["${cldNetbirdIP}:${toString nodeExporterPort}"];
          labels = {
            instance = "AZ-CLD-1";
          };
        }
      ];
    }
  ];

  # Allow CLD to reach PRM prometheus scrapes (prometheus initiates connection TO CLD exporter)
  networking.firewall.extraCommands = ''
    # No PRM-side firewall change needed: PRM scrapes outbound to CLD:9100.
    # CLD-side must allow inbound from 100.91.49.26 (PRM netbird IP) — see CLD config.
  '';
}