{
  config,
  lib,
  ...
}: let
  nodeExporterPort = config.m3ta.ports.get "node-exporter";
  litellmPort = config.m3ta.ports.get "litellm";
  cldNetbirdIP = "100.91.203.184";
  litellmPrometheusBearerSecretAvailable = builtins.hasAttr "litellm-prometheus-bearer" config.age.secrets;
  litellmPrometheusAuthorization = lib.optionalAttrs litellmPrometheusBearerSecretAvailable {
    authorization = {
      type = "Bearer";
      credentials_file = config.age.secrets."litellm-prometheus-bearer".path;
    };
  };
in {
  # Prometheus' config checker validates credentials_file paths at build time,
  # but agenix secrets only exist at runtime under /run/agenix.
  services.prometheus.checkConfig = lib.mkIf litellmPrometheusBearerSecretAvailable false;

  services.prometheus.scrapeConfigs = [
    {
      job_name = "node-cld";
      static_configs = [
        {
          targets = ["${cldNetbirdIP}:${toString nodeExporterPort}"];
          labels = {
            instance = "AZ-CLD-1";
          };
        }
      ];
    }
    ({
        job_name = "litellm";
        metrics_path = "/metrics/";
        scrape_interval = "15s";
        static_configs = [
          {
            targets = ["${cldNetbirdIP}:${toString litellmPort}"];
            labels = {
              instance = "AZ-CLD-1";
              service = "litellm";
            };
          }
        ];
      }
      // litellmPrometheusAuthorization)
  ];

  # Allow CLD to reach PRM prometheus scrapes (prometheus initiates connection TO CLD exporters)
  networking.firewall.extraCommands = ''
    # No PRM-side firewall change needed: PRM scrapes outbound to CLD:9100/4000.
    # CLD-side must allow inbound from 100.91.49.26 (PRM netbird IP) — see CLD config.
  '';
}