run grafana inmemory

modules/nix/ld.nix

@@ -83,6 +83,9 @@ in
       # TriOS
       harfbuzz
       libepoxy
+      # android
+      libpng
+      libbsd
     ];
   };
 }

modules/services/grafana.nix

@@ -7,7 +7,7 @@
 let
   useHttps = config.services.step-ca.enable;
   fqdn = "grafana.home.arpa";
-  base = "/mnt/250ssd";
+  base = "/mnt/tmpfs";
 in
 {
   age.secrets.grafana-contact-points = {
@@ -16,18 +16,49 @@ in
     file = ../../secrets/grafana-contact-points.age;
   };
 
+  age.secrets.grafana-pw = {
+    owner = "grafana";
+    file = ../../secrets/grafana-pw.age;
+  };
+
+  fileSystems = {
+    "${base}" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = [
+        "size=1G"
+        "mode=1777"
+      ];
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "d ${base} 0755 grafana grafana -"
+    "d ${base}/grafana 0750 grafana grafana -"
+    "d ${base}/loki 0750 loki grafana -"
+    "d ${base}/prometheus 0750 prometheus grafana -"
+    #"d ${base}/prometheus/data 0750 prometheus grafana -"
+    "L+ /var/lib/prometheus2 - - - - ${base}/prometheus"
+    #"L+ /var/lib/${config.services.prometheus.stateDir}/data - - - - /${base}/prometheus/data"
+  ];
+
   services.grafana = {
     enable = true;
     dataDir = "${base}/grafana";
-    settings.server = {
+    settings = {
+      server = {
         domain = fqdn;
         http_port = 2342;
         http_addr = "127.0.0.1";
       };
-    settings.log = {
+      log = {
         mode = "console";
         level = "warn";
       };
+      database = {
+        high_availability = false;
+      };
+      security.admin_password = "$__file{${config.age.secrets.grafana-pw.path}}";
+    };
 
     provision.alerting.contactPoints.path = config.age.secrets.grafana-contact-points.path;
     provision.alerting.policies.path = ./grafana/notification-policies.yml;
@@ -57,8 +88,26 @@ in
     ];
   };
 
-  systemd.services.grafana = {
+  systemd.services = {
-    after = [ "step-ca.service" ];
+    loki = {
+      after = [
+        "mnt-tmpfs.mount"
+      ];
+    };
+    prometheus = {
+      after = [
+        "mnt-tmpfs.mount"
+      ];
+      serviceConfig = {
+        StateDirectory = lib.mkForce "${base}/prometheus";
+        WorkingDirectory = lib.mkForce "${base}/prometheus";
+      };
+    };
+    grafana = {
+      after = [
+        "step-ca.service"
+      ];
+    };
   };
 
   security.acme.certs."${fqdn}".server = "https://127.0.0.1:8443/acme/kop-acme/directory";

modules/services/grafana/loki.yml

@@ -14,7 +14,7 @@ common:
     kvstore:
       store: inmemory
   replication_factor: 1
-  path_prefix: /mnt/250ssd/loki/common
+  path_prefix: /mnt/tmpfs/loki/common
 
 schema_config:
   configs:

secrets/secrets.nix

@@ -92,6 +92,10 @@ in
     server-vm
     kop
   ];
+  "grafana-pw.age".publicKeys = [
+    server-vm
+    kop
+  ];
   "fileshelter-conf.age".publicKeys = [
     server-vm
     kop

systems/amd-server-vm/configuration.nix

@@ -18,6 +18,7 @@
     ../../modules/services/duckdns.nix
     ../../modules/services/samba.nix
     ../../modules/services/ddclient-cloudflare.nix
+    ../../modules/services/grafana.nix
     ./disk-config.nix
     ./mail.nix
     (modulesPath + "/installer/scan/not-detected.nix")
@@ -41,6 +42,7 @@
   mainUser.layout = "de";
   mainUser.variant = "us";
   custom = {
+    tmpfs.enable = true;
     static-ip = {
       enable = true;
       ip = "192.168.0.10";

systems/pc/configuration.nix

@@ -86,7 +86,7 @@
       audio.enable = true;
       code = {
         enable = true;
-        android.enable = false;
+        android.enable = true;
       };
       #emulators.enable = true;
       games = {