modules/prometheus: add basic auth

2024-11-30 17:35:46 +08:00 · 2024-11-30 17:35:46 +08:00 · 74b67e1854
commit 74b67e1854
parent 97fcdefc2b
10 changed files with 184 additions and 194 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -10,6 +10,13 @@ keys:
  - &host-biotite age1v5h946jfke6ae8pcgz52mhj26cacqcpl9dmmrrkf37x55rnq2v3szqctvv
  - &host-thorite age12ng08vjx5jde5ncqutwkd5vm4ygfwy33mzhzwe0lkxzglulgpqusc89r96
 creation_rules:
+  - path_regex: machines/secrets.yaml
+    key_groups:
+    - age:
+      - *xin
+      - *host-calcite
+      - *host-massicot
+      - *host-thorite
  - path_regex: machines/calcite/secrets.yaml
    key_groups:
    - age:
@ -58,15 +65,6 @@ creation_rules:
    - age:
      - *xin
      - *host-weilite
-  - path_regex: machines/secrets.yaml
-    key_groups:
-    - age:
-      - *xin
-      - *host-calcite
-      - *host-raspite
-      - *host-la-00
-      - *host-hk-00
-      - *host-massicot
  - path_regex: home/xin/secrets.yaml
    key_groups:
    - age:
--- a/machines/netdrives.nix
+++ b/machines/netdrives.nix
@ -1,22 +0,0 @@
-{ pkgs, config, ... }:
-{
-  sops.secrets = {
-    autofs-nas = {
-      owner = "davfs2";
-    };
-    autofs-nas-secret = {
-      path = "/etc/davfs2/secrets";
-    };
-  };
-  fileSystems."/media/nas" = {
-    device = "https://home.xinyang.life:5244/dav";
-    fsType = "davfs";
-    options = [
-      "uid=1000"
-      "gid=1000"
-      "rw"
-      "_netdev"
-    ];
-
-  };
-}
--- a/machines/secrets.yaml
+++ b/machines/secrets.yaml
@ -1,14 +1,6 @@
-clash_subscription_link: ENC[AES256_GCM,data:uDaX2BE/qRdfXVtckX0VKpu0LN3j0YaxVIPbQt3tGAfdfqFqlp0IzFgNiZBIEcIltYkeEyqFSA0QnttoMb0QYe9f2rtgjztwk10SOGViGaeFWPfkdlHP04qhm5OOOddi3OwT5rUNwvBU79AdCnLJ9QwqMbOaNm/JTtbkcjf8huxc2UcYAQcY/YNJ7aTEhWIw98Ab85aih+w=,iv:pZ189IPPCBjscXzEdgQCRdFlls3TniwDfNCd+H1FFaQ=,tag:dMmGZvppWtkc82b5dTnJwg==,type:str]
-autofs-nas: ENC[AES256_GCM,data:LnCKGKARx6Vd99VwAX/6PXOJwo+a7GP8fNmM9yuuC2xITGxtWCsDdOZL1+IA5LS/gbOYINgQWDzWirJF3LCP27BQeLwXYpD7/UAwwVI=,iv:QJzsS5a6vWeoBxkB13yXdVbyn0tt2QTvqj0LaHn6S2g=,tag:D/JKXQIw1EzIh3wjGhHgHg==,type:str]
-autofs-nas-secret: ENC[AES256_GCM,data:gbOizRZAvh79HlJWIWeKTk79Ux311XGL1eIswc0P2U2huCibD/ji3kOlSjZXENG+fJQKNz2AlDTk3g2cQQ==,iv:UCaGeE8j4RqJzA0xhu3oB2xvzombzQD3fjLKCWd5fDg=,tag:II4eEMr7f2TDUl1qUcDYXA==,type:str]
-github_public_token: ENC[AES256_GCM,data:6Gt+oJcCRHeoLK7CRndMMbszTXSEbnN0nQzsVOnl/+zB4hxbEPD5k/vkkl+cZ/qmxdxFXV0OOsYvktn44Yv1DMUE3mkB0hcAdoyPwLuYM7W3RpOoW3OktH8DRCUi6msvFp3ykpdmIl9WyjVhc/lMwTaYJQyRh1ue,iv:PJSFtJBelyc3rzd6hqjMp+ciU2Q3FTOEXsiq5F2KKTY=,tag:Y/stRg6kwyjjIFZCXS/peg==,type:str]
-singbox_sg_server: ENC[AES256_GCM,data:SF2ja6W4TwThwoug5x2KTA==,iv:Vx9wNTdVHkReux4YeQY+0VkC1Wqg/CRkY7frVY/3e50=,tag:7XA9KSoR0GA6FoYRhCv4BQ==,type:str]
-singbox_jp_server: ENC[AES256_GCM,data:S3Bs5yVMzyz6vD51GYElOM5h,iv:nXetY339YuOi2jFEb3xkPTglHRMk/quIrQL4ko+8MxY=,tag:o9d55cZuWmX4NDYexWjvYQ==,type:str]
-sing-box:
-    password: ENC[AES256_GCM,data:xyqmoJEDI5959zHPTVelln/iThtoeDwS,iv:rLyqJsE/4JDf08RlMLLPh+MKJkba9bL0z8jx6bTEfgc=,tag:cgLHdeLIyPvLhRNaVcQ0TQ==,type:str]
-    uuid: ENC[AES256_GCM,data:lWBCM5wyz6BcUUHdvynkn5y166Kk15jO0EhWUDuhXXhrve5l,iv:RmDJYFnYqIEIShLn25sf4h8AO2E3+3Xa2U9Mff+Xk2w=,tag:SN0DUdwZXKO/VEnozrr5mA==,type:str]
-grafana_cloud_api: ENC[AES256_GCM,data:eEvPAwtThK1FMhbrnmSo89+GlWZAF+LQRMLXA2C6f1vR7ZPlXJZGWzjYwDcPlnpiC737/cG14M4kZqvPGBuNub5A83rBS/+FeebvGDIF59L5PC1Ys1jWBB9YRI/L9EU0tvwTTUCvLRA9j28n7Jw7wR6mWXm63XA+OMu8/UbTwbeV/WUQn8vnwqadSUdCnNKJXMsAY+q9t/st0DPm5+aNxA==,iv:cHvbeCmLFmJPNKsl1BBYx9WJP7ZJWi+8c9yHZWc6FTs=,tag:87C+0FVvzDIowE0+QpY1zA==,type:str]
-private_dns_address: ENC[AES256_GCM,data:YJxNOH4hsZHResvANEqJRTANhnL4PLp/Pmi/PhgtSTbTKiJKPqudhTEkNg==,iv:8+qG5rQXAKfrykEjt9qrbtyNaBuKvi7EaIWouRqEipY=,tag:VH0w5ZbXcWFGZ9GLavm7/w==,type:str]
+prometheus:
+    metrics_username: ENC[AES256_GCM,data:/CQfOA==,iv:BjhB+uLfjmYHdgpc/+tDJXJ8C1EK9kngQWbo4NleOmE=,tag:JCdqyqGLRh09T25vmufiZw==,type:str]
+    metrics_password: ENC[AES256_GCM,data:q/xMPuNtlcUFewMdVu6w2Q==,iv:xLohdb5tdxevYFckZoacjSJp2rZ53QKLxK6u3mc3mDw=,tag:B4LrObH1DsnnD5CcuOPOyg==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -18,77 +10,41 @@ sops:
        - recipient: age1uw059wcwfvd9xuj0hpqzqpeg7qemecspjrsatg37wc7rs2pumfdsgken0c
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiRzZVNGFocUN2VzZLTmJz
-            WlJnUmxhZS92citDRkVZVnJZQU9YWVZORlNjCkgzeWl5dTl1YmpjZGt2anF3dGgr
-            K1hOSTRmakNrZ2JoNit3NDIzK1FCcWMKLS0tIEdqY3VvR3gxd1JoQlhPR3JvcXBF
-            K2g4VFpqUEF5RTQ3cmpUSG0xajN2bUUKMuwx5cO1nHokV1NOloXfl9wTBN/+/Rlq
-            UJKP/qaI23tpyMXN1U40iF20ecO1U5Ad8wAQ61C/tldSVULizDihpw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvRTNjSmw3WkgxMGtVSW9C
+            ZzFDdWUwY3FLOEZHUmtGdWkwYkd5NXI4S3dvCk1WdUx6Qk1sbzkxQU5TQU53c2lx
+            bWtNZ0U3cGVnWWd3VGczNmhuVEFTMDgKLS0tIDU4T0EvZzF6d0dJaWoyN0dqOVJl
+            RDRRS0RYNnI0OEtXNTFrL1R1aVczd28KqVk9onzsphU0pHwqhjpKVQ8hOjdcIRJ0
+            3dsI05nKRGjx/1yZBgGNbOR7LE+w63zR7KBoHYa49FEpWGiy54j2ZQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1ytwfqfeez3dqtazyjltn7mznccwx3ua8djhned7n8mxqhw4p6e5s97skfa
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMYXlwdytVSm1SQzRubHdX
-            dHhrTWxyamo3OFRraEVRQ3plK1cwUWt0a1JRCkdqaVRTQ0NaTkdoMlpDT3Yyallq
-            eTd0bDViVTgwZGRTUmlYTzR0Y09iWWcKLS0tIEFlQnFPVFRVNlAxdExMekJ2b295
-            UUJkUUZCNUZnbkNFZHVBYXNHQklOL2MKujgh6REuAKu6ZLVA7atiWUqhnvYJnQjb
-            WsxCa9ZXZRgfbhcNlZ3qIKJpWWI/RMS17+Nm5yIl+2cSqe2UJMjZdg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1nugzw24upk8pz5lyz2z89qk8se4gpcsg3ypcs58nykncr56sevrsm8qpvj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHNXQ4RVVRd3RYRkhUVExG
-            SHJON0hwSmJtUkYrd1dldHJRN2tPKzBsNlNjCi9xYVhaanF5TDU2Q0xadXNWR2tN
-            dHhQVkpRREFlRm5MM2pwVytEaGhHT0EKLS0tIE9sRUtLako3cnAxNm82RDhiWEVM
-            ZW1IMXkzYkhqbW1ZdVRabUlkK2oxSTgKHC22uQqMq+cJ7vrONkGgoH8snxGef6Ft
-            QbtoJziERjAhK6B7TOY8AJ3WVRpCzZN70HjLNYa+bMMNOvmlsVxfZg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age13s6rwd3wjk2x5wkn69tdczhl3l5d7mfmlv90efsv4q67jne43qss9tcakx
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSmZ5YUpFdzRNdWZVNmxJ
-            bm5ucUhVeTV2TkE4ZElkZ1N3aXc2eVEwMlRNCmxXRElPb2pGYzJFVnUxQkRtMlNF
-            cjgwUzh5UWNLTk01U0h2bHNpaXVzZkkKLS0tIDczUkkwTG8rL1V3UU9lenk4V2tl
-            TUxDd2huTllMRG9MZTJZdzRwaWxqUVEKLA3y+heUA8cK31LZzv5A1wtgf+sauuwE
-            7SGU3uYU650tJM3e6Lveo+JOAD7Z1jrAomT5Bub+jjSHnpeFC9yMbA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1t5nw2jx4dw67jkf72uxcxt72j7lq3xyj35lvl09f8kala90h2g2s2a5yvj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4enA2bnlrV3ViY1RHaTVS
-            Ym5VV005NFlXZUl2NDNXYXBoOHh0SGQ0YVNnCm1KdHBSeE9lQzZEM2hFZUwzRitS
-            K3BEWGhtWmxKc2RJd0FTMEs2b1ArOUkKLS0tIG5kaWc3U0o4SG9teXk5dVZWWjkz
-            cS9VMU5YbEl3UE5mODJ1THNLVEdVblEKNQF0b9r1XPD819Z6Uy0b9hT4Uek2tNWU
-            3z3H7V/UiB1TMW+qgs6BC6bDkDf7oG//qmZEdYF+lDXcNSwai25xyg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1fw2sqaa5s9c8ml6ncsexkj8ar4288387ju92ytjys4awf9aw6smqqz94dh
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBreHJNRXlpOEh6YUxaSmJj
-            ZDlVdHh2b1p6aEs3eDAvbkk4WExxWmE5bDM0CkZzT2l1K09UbmNFNEpZUVY2NVlB
-            dVFYbnpvTjlUcTdZejMrelpscXRJQzAKLS0tIEVIaVByVmp0aUU1ZWJLajBhcjRk
-            QVZMRXBRVVhaY3JKZEJjMTdEeEVqcWMKT+DoevNQAxCrty2VkRDLWGFzs9GsW3F7
-            txz73tAceAIiocC1z7IV2TaYULYf7Z75HAje/SOTlGHBIDiVZ0vyLw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWlk1QWFERzNaZEo2NDhl
+            cmF6VGNzYnprYXU4ZUsrRnEwK1R0WjFvOEdJCnRQdXExOTVoYlZkSFJqeGQ2QWNQ
+            T2pkTHdmMDlQczVrd290a0s2MWsvQjQKLS0tIFJVRStURG1vaUFFV2U2THFaazlX
+            THZPclpjL3FuSlplOUorQVVQYWt4ZTgKla/Ibk00Pz9m3p/E3qVyTWC/6yWzGC0j
+            bILtkm8rzGx2akXcC/9pIE1+g6Y+x9c7gBJ3aitO7DF7TVgW4DQYUQ==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1jle2auermhswqtehww9gqada8car5aczrx43ztzqf9wtcld0sfmqzaecta
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEZEJHQlJqMWxob1lxOUFK
-            dDZIN3FaNWR1L0gyN3I1MXVXZlpzdlpQUHpjCmIwTWhRamZvSTF3cHZMNk9YUlRv
-            U2tOK3E5MFBFNERsUHVzVnhsUDFRd00KLS0tIFd1MUpaaFU0bWdVRjJ6NjFwcFZt
-            bkJGWFFWanFBK1drZlBNcHo0c3Bjc00K/vPBLocRhtcJ3snGYFr+H7qhbg6iSSPP
-            OSH8WnaM5JmmA9IQlm5uGiG74PHi5sg5d+bwG8pPQtMKN+Ndxh7JIA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPQ1lLcFZTcld3UVpiTWZU
+            aDZaSFAwN1Nzdlhmam8xTUZNSnpWSHRHM25NCklEUGVUUEg1emVJUHB2TENqY2R1
+            Z1ZKNUl4QXd0bGU5bk82Z2YzTnpCWTAKLS0tIFJrWkRvMGxEOWFlQ29rUSs3bkgw
+            QjJ6V2czTnM0WFFvOGUza0dBalFMdXMKDh65zI+4C/M5u5L8F7ditFxIeAHmNoqu
+            mAehEmA+iPcnc/+q7aMVnTxsLgbRwrmPpvGKvUaLtPr1pOLpHtvuUw==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1w3x5mz2g8jc9aq8cajdpg62f8n5p4qr6jgjlxw9seagyw0t0fsuqvkmym0
+        - recipient: age12ng08vjx5jde5ncqutwkd5vm4ygfwy33mzhzwe0lkxzglulgpqusc89r96
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlN291MzZOaU4zazhEeXBh
-            WlhoYmh2ZDBsZmc3cEthdW5paWpXbXQvUG1FCjBLZ0FPVWR3T2pVWTZrRmkxSWUr
-            MHhkUFFPK1Z0b2t1Z1J0VjlER1JvcGMKLS0tIE45YndxVW4vak1wcEJoZzhHQ0E0
-            NzA1cy80ZW5vUFplQzVMZ0txSmVkMUEKFUvgmJNdo9sV33gOx7LVUSCYvIqCNwaP
-            u+XoWTfg4kp9f4KVTy/8huPsVLhZBUaf6jI10mV2z4QwaLHje4JiHw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrQ1NicHlhZFU1eDBqZXVk
+            SGhma1hSTlpKaEdXNnluK1Z6YkdaNnBvREdVClR6NmpRMFNqYlk2RXEyaWlDejFw
+            UHR3Q0ZFbGpXOFpDdkRsSytkNDJieEUKLS0tIHpMdGVDWjJPaXpvN2FHZ0VTRUF0
+            NmF1a3E5djlXK3MyanRaQUhBc1kyaE0KDAk83Aug7BtVcyzo//EWmN/FYD6pQzSE
+            0J5tE5dqkI6VzBrSGzosRsXMhuGcRx6r2XBKJWFINwom9Td87aVCcQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-22T05:48:59Z"
-    mac: ENC[AES256_GCM,data:In/gSIYnXKbbv1lzS/nmSESCHBcBv/TtkvhzdNiIn73N4kP9aJ+1JE8Npix8zNItzk46DX+nHBk8Kwgl6uq26YtL+sMTBKh5K8Ny0H8ivlgS+olXswv3Y9h1cYD7FBHUKzbMuiJd0ppjC0ZIn20rRpb4d57rwUbvY0KstyQW4JA=,iv:DcdTAimbXXpKhhiB9rriS75+XGNOCcScqi/804+Xx6g=,tag:NHW+UViRmbUDHb0gTd9TDg==,type:str]
+    lastmodified: "2024-11-30T06:31:42Z"
+    mac: ENC[AES256_GCM,data:xh8x9IrQ01ZzdcCTIfBrifIGduMYVmSSP52BkTyr/bx7AgQAz2WeA7LFrccxIayCGHrQKfMQDLUKJ/EBamG/6p8AX6QqZBTfqFD688ZhmRfxgpj7fYR9jPYnhb/9XHI9R2jTaJWwrorXvu3pa+Gy/hWB3Kb+WZc3fslmIuKuLH0=,iv:GDrHSFZxPbpACdusVDPHXEjeEusYfk53N/KGHtdvrYo=,tag:ap38sCSTZVDQ0ZazXM3vlg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.1
--- a/machines/sops.nix
+++ b/machines/sops.nix
@ -10,20 +10,9 @@
      # TODO: How to generate this key when bootstrap?
      age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
      secrets = {
-        github_public_token = {
-          owner = "root";
-        };
-        singbox_sg_server = {
-          owner = "root";
-        };
-        singbox_jp_server = {
-          owner = "root";
-        };
-        private_dns_address = {
-          owner = "root";
-        };
+        "prometheus/metrics_username" = { };
+        "prometheus/metrics_password" = { };
      };
-      secrets.grafana_cloud_api = lib.mkIf config.services.prometheus.enable { owner = "prometheus"; };
    };
  };
 }
--- a/machines/thorite/default.nix
+++ b/machines/thorite/default.nix
@ -30,7 +30,6 @@

    commonSettings = {
      auth.enable = true;
-      autoupgrade.enable = true;
    };

    nixpkgs.system = "x86_64-linux";
--- a/machines/thorite/monitoring.nix
+++ b/machines/thorite/monitoring.nix
@ -41,6 +41,7 @@ with my-lib;
          "45.142.178.32:22"
          "home.xinyang.life:8000"
        ];
+        passwordFile = config.sops.secrets."prometheus/metrics_password".path;
      in
      (mkScrapes [
        {
@ -50,18 +51,22 @@ with my-lib;
          port = 8082;
        }
        {
+          inherit passwordFile;
          name = "gotosocial";
          address = "xinyang.life";
        }
        {
+          inherit passwordFile;
          name = "miniflux";
          address = "rss.xinyang.life";
        }
        {
+          inherit passwordFile;
          name = "ntfy";
          address = "ntfy.xinyang.life";
        }
        {
+          inherit passwordFile;
          name = "grafana-eu";
          address = "grafana.xinyang.life";
        }
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@ -7,7 +7,7 @@
    ./disk-partitions
    ./restic.nix
    ./vaultwarden.nix
-    ./prometheus
+    ./monitor
    ./hedgedoc.nix
    ./sing-box.nix
    ./kanidm-client.nix
--- a/modules/nixos/monitor/default.nix
+++ b/modules/nixos/monitor/default.nix
@ -8,6 +8,7 @@ let
    mkEnableOption
    mkOption
    mkIf
+    mkMerge
    types
    ;
  cfg = config.custom.prometheus;
@ -58,91 +59,113 @@ in
    };
  };

-  config = mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      permitCertUid = config.services.caddy.user;
-      openFirewall = true;
-    };
+  config = mkMerge [
+    {
+      sops.secrets = {
+        "prometheus/metrics_username" = {
+          sopsFile = ../../../machines/secrets.yaml;
+          group = "prometheus-auth";
+          mode = "0440";
+        };

-    services.caddy = {
-      enable = true;
-      virtualHosts."${config.networking.hostName}.coho-tet.ts.net".extraConfig = ''
-        reverse_proxy 127.0.0.1:${toString config.services.prometheus.port}
-      '';
-    };
-    services.prometheus = mkIf cfg.enable {
-      enable = true;
-      port = 9091;
-      globalConfig.external_labels = {
-        hostname = config.networking.hostName;
-      };
-
-      scrapeConfigs = [
-        {
-          job_name = "prometheus";
-          static_configs = [ { targets = [ "localhost:${toString config.services.prometheus.port}" ]; } ];
-        }
-      ];
-
-      alertmanager = {
-        enable = true;
-        listenAddress = "127.0.0.1";
-        logLevel = "debug";
-        configuration = {
-          route = {
-            receiver = "ntfy";
-          };
-          receivers = [
-            {
-              name = "ntfy";
-              webhook_configs = [
-                {
-                  url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
-                    Alert {{.status}}
-                    {{range .alerts}}-----{{range $k,$v := .labels}}
-                    {{$k}}={{$v}}{{end}}
-                    {{end}}
-                  ''}";
-                  send_resolved = true;
-                }
-              ];
-            }
-          ];
+        "prometheus/metrics_password" = {
+          sopsFile = ../../../machines/secrets.yaml;
+          group = "prometheus-auth";
+          mode = "0440";
        };
      };

-      alertmanagers = [
+      users.groups.prometheus-auth.members = [
+        "prometheus"
+      ];
+    }
+    (mkIf cfg.enable {
+
+      services.tailscale = {
+        enable = true;
+        permitCertUid = config.services.caddy.user;
+        openFirewall = true;
+      };
+
+      services.caddy = {
+        enable = true;
+        virtualHosts."${config.networking.hostName}.coho-tet.ts.net".extraConfig = ''
+          reverse_proxy 127.0.0.1:${toString config.services.prometheus.port}
+        '';
+      };
+      services.prometheus = mkIf cfg.enable {
+        enable = true;
+        port = 9091;
+        globalConfig.external_labels = {
+          hostname = config.networking.hostName;
+        };
+
+        scrapeConfigs = [
+          {
+            job_name = "prometheus";
+            static_configs = [ { targets = [ "localhost:${toString config.services.prometheus.port}" ]; } ];
+          }
+        ];
+
+        alertmanager = {
+          enable = true;
+          listenAddress = "127.0.0.1";
+          logLevel = "debug";
+          configuration = {
+            route = {
+              receiver = "ntfy";
+            };
+            receivers = [
+              {
+                name = "ntfy";
+                webhook_configs = [
+                  {
+                    url = "https://ntfy.xinyang.life/prometheus-alerts?tpl=yes&m=${lib.escapeURL ''
+                      Alert {{.status}}
+                      {{range .alerts}}-----{{range $k,$v := .labels}}
+                      {{$k}}={{$v}}{{end}}
+                      {{end}}
+                    ''}";
+                    send_resolved = true;
+                  }
+                ];
+              }
+            ];
+          };
+        };
+
+        alertmanagers = [
+          {
+            scheme = "http";
+            static_configs = [
+              {
+                targets = [
+                  "${config.services.prometheus.alertmanager.listenAddress}:${toString config.services.prometheus.alertmanager.port}"
+                ];
+              }
+            ];
+          }
+        ];
+        rules = [ (lib.generators.toYAML { } { groups = cfg.ruleModules; }) ];
+      };
+      custom.prometheus.ruleModules = [
        {
-          scheme = "http";
-          static_configs = [
+          name = "prometheus_alerts";
+          rules = [
            {
-              targets = [
-                "${config.services.prometheus.alertmanager.listenAddress}:${toString config.services.prometheus.alertmanager.port}"
-              ];
+              alert = "JobDown";
+              expr = "up == 0";
+              for = "1m";
+              labels = {
+                severity = "critical";
+              };
+              annotations = {
+                summary = "Job {{ $labels.job }} down for 1m.";
+              };
            }
          ];
        }
      ];
-      rules = [ (lib.generators.toYAML { } { groups = cfg.ruleModules; }) ];
-    };
-    custom.prometheus.ruleModules = [
-      {
-        name = "prometheus_alerts";
-        rules = [
-          {
-            alert = "JobDown";
-            expr = "up == 0";
-            for = "1m";
-            labels = {
-              severity = "critical";
-            };
-            annotations = {
-              summary = "Job {{ $labels.job }} down for 1m.";
-            };
-          }
-        ];
-      }
-    ];
-  };
+    })
+  ];
 }
--- a/modules/nixos/monitor/exporters.nix
+++ b/modules/nixos/monitor/exporters.nix
@ -46,6 +46,21 @@ in
      );
    };

+    # gotosocial
+    sops.templates."gotosocial_metrics.env" = {
+      content = ''
+        GTS_METRICS_AUTH_ENABLED=true
+        GTS_METRICS_AUTH_USERNAME=${config.sops.placeholder."prometheus/metrics_username"}
+        GTS_METRICS_AUTH_PASSWORD=${config.sops.placeholder."prometheus/metrics_password"}
+      '';
+      group = "prometheus-auth";
+      mode = "0440";
+    };
+    systemd.services.gotosocial.serviceConfig = {
+      EnvironmentFile = [ config.sops.templates."gotosocial_metrics.env".path ];
+      SupplementaryGroups = [ "prometheus-auth" ];
+    };
+
    services.gotosocial.settings = {
      metrics-enabled = true;
    };
@ -55,7 +70,24 @@ in
    };

    services.restic.server.prometheus = true;
-    systemd.services.miniflux.environment.METRICS_COLLECTOR = "1";
+
+    # miniflux 
+    sops.templates."miniflux_metrics_env" = {
+      content = ''
+        METRICS_COLLECTOR=1
+        LOG_LEVEL=debug
+        METRICS_USERNAME=${config.sops.placeholder."prometheus/metrics_username"}
+        METRICS_PASSWORD=${config.sops.placeholder."prometheus/metrics_password"}
+      '';
+      group = "prometheus-auth";
+      mode = "0440";
+    };
+
+    systemd.services.miniflux.serviceConfig = {
+      EnvironmentFile = [ config.sops.templates."miniflux_metrics_env".path ];
+      SupplementaryGroups = [ "prometheus-auth" ];
+    };
+
    services.ntfy-sh.settings.enable-metrics = true;

    services.caddy.globalConfig = ''
--- a/overlays/my-lib/prometheus.nix
+++ b/overlays/my-lib/prometheus.nix
@ -7,6 +7,7 @@ in
    {
      name,
      address,
+      passwordFile ? null,
      port ? 443,
      scheme ? "https",
      ...
@ -16,6 +17,15 @@ in
      scheme = scheme;
      static_configs = [ { targets = [ "${address}${mkPort port}" ]; } ];
    }
+    // (
+      if isNull null then
+        { }
+      else
+        {
+          basic_auth.username = "prom";
+          basic_auth.password_file = passwordFile;
+        }
+    )
  );

  mkCaddyScrapes = mkFunction (