{ config, ... }:

let
  host = "prometheus.hackens.org";
  port = 9091;
in

{
  services.prometheus = {
    enable = true;

    inherit port;

    checkConfig = "syntax-only";
    enableReload = true;

    listenAddress = "127.0.0.1";

    webConfigFile = config.age.secrets."prometheus-webconf".path;

    webExternalUrl = "https://${host}";

    retentionTime = "5y";

    extraFlags = [ "--storage.tsdb.retention.size=2GB" ];

    rules = [
      ''
        groups:
          - name: Chrony
            rules:
              - record: instance:chrony_clock_error_seconds:abs
                expr: >
                  abs(chrony_tracking_last_offset_seconds)
                  +
                  chrony_tracking_root_dispersion_seconds
                  +
                  (0.5 * chrony_tracking_root_delay_seconds)
      ''
    ];

    scrapeConfigs = [
      {
        job_name = "prometheus";
        static_configs = [ { targets = [ "localhost:9090" ]; } ];
      }
      {
        job_name = "chrony";
        static_configs = [ { targets = [ "10.10.10.3:9123" ]; } ];
      }
      {
        job_name = "kfet";
        static_configs = [ { targets = [ "127.0.0.1:9802" ]; } ];
      }
    ];
  };

  services.nginx.virtualHosts.${host} = {
    enableACME = true;
    forceSSL = true;

    locations."/" = {
      proxyPass = "http://127.0.0.1:${builtins.toString port}";
      proxyWebsockets = true;
      recommendedProxySettings = true;
    };
  };
}