56 lines
1.7 KiB
Nix
56 lines
1.7 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}: let
|
|
nodeExporterPort = config.m3ta.ports.get "node-exporter";
|
|
litellmPort = config.m3ta.ports.get "litellm";
|
|
cldNetbirdIP = "100.91.203.184";
|
|
litellmPrometheusBearerSecretAvailable = builtins.hasAttr "litellm-prometheus-bearer" config.age.secrets;
|
|
litellmPrometheusAuthorization = lib.optionalAttrs litellmPrometheusBearerSecretAvailable {
|
|
authorization = {
|
|
type = "Bearer";
|
|
credentials_file = config.age.secrets."litellm-prometheus-bearer".path;
|
|
};
|
|
};
|
|
in {
|
|
# Prometheus' config checker validates credentials_file paths at build time,
|
|
# but agenix secrets only exist at runtime under /run/agenix.
|
|
services.prometheus.checkConfig = lib.mkIf litellmPrometheusBearerSecretAvailable false;
|
|
|
|
services.prometheus.scrapeConfigs = [
|
|
{
|
|
job_name = "node-cld";
|
|
static_configs = [
|
|
{
|
|
targets = ["${cldNetbirdIP}:${toString nodeExporterPort}"];
|
|
labels = {
|
|
instance = "AZ-CLD-1";
|
|
};
|
|
}
|
|
];
|
|
}
|
|
({
|
|
job_name = "litellm";
|
|
metrics_path = "/metrics/";
|
|
scrape_interval = "15s";
|
|
static_configs = [
|
|
{
|
|
targets = ["${cldNetbirdIP}:${toString litellmPort}"];
|
|
labels = {
|
|
instance = "AZ-CLD-1";
|
|
service = "litellm";
|
|
};
|
|
}
|
|
];
|
|
}
|
|
// litellmPrometheusAuthorization)
|
|
];
|
|
|
|
# Allow CLD to reach PRM prometheus scrapes (prometheus initiates connection TO CLD exporters)
|
|
networking.firewall.extraCommands = ''
|
|
# No PRM-side firewall change needed: PRM scrapes outbound to CLD:9100/4000.
|
|
# CLD-side must allow inbound from 100.91.49.26 (PRM netbird IP) — see CLD config.
|
|
'';
|
|
}
|