From ea9be6fb8ad761533b0fc402c0443c1fc633d7ae Mon Sep 17 00:00:00 2001
From: luna <luna@git.mgaction.town>
Date: Sun, 23 Aug 2026 00:55:07 +0000
Subject: [PATCH] mars: add VictoriaMetrics monitoring

---
 hosts/mars/configuration.nix            |  1 +
 services/monitoring/victoriametrics.nix | 58 +++++++++++++++++++++++++
 2 files changed, 59 insertions(+)
 create mode 100644 services/monitoring/victoriametrics.nix

diff --git a/hosts/mars/configuration.nix b/hosts/mars/configuration.nix
index 13a0d3f..5379921 100644
--- a/hosts/mars/configuration.nix
+++ b/hosts/mars/configuration.nix
@@ -12,6 +12,7 @@
     ../../services/containers.nix
     ../../services/vpn/tailscale.nix
     ../../services/monitoring/node-exporter.nix
+    ../../services/monitoring/victoriametrics.nix
   ];
 
   networking.hostName = "mars";
diff --git a/services/monitoring/victoriametrics.nix b/services/monitoring/victoriametrics.nix
new file mode 100644
index 0000000..6e377d5
--- /dev/null
+++ b/services/monitoring/victoriametrics.nix
@@ -0,0 +1,58 @@
+{ ... }:
+
+# VictoriaMetrics single-node store for the homelab dashboard. It listens on
+# all interfaces, but tailscale.nix makes tailscale0 the only trusted ingress;
+# the host firewall therefore keeps :8428 off the LAN and public interfaces.
+#
+# The scrape targets are the node_exporter instances enabled by
+# services/monitoring/node-exporter.nix on every real host. MagicDNS names use
+# the tailnet's orbit.sol suffix (see services/vpn/headscale.nix).
+{
+  services.victoriametrics = {
+    enable = true;
+    retentionPeriod = "30d";
+    listenAddress = ":8428";
+
+    prometheusConfig = {
+      global.scrape_interval = "60s";
+
+      scrape_configs = [
+        {
+          job_name = "node-exporter";
+          static_configs = [
+            {
+              targets = [ "127.0.0.1:9100" ];
+              labels.host = "mars";
+            }
+            {
+              targets = [ "jupiter.orbit.sol:9100" ];
+              labels.host = "jupiter";
+            }
+            {
+              targets = [ "neptun.orbit.sol:9100" ];
+              labels.host = "neptun";
+            }
+            {
+              targets = [ "mercury.orbit.sol:9100" ];
+              labels.host = "mercury";
+            }
+          ];
+        }
+        {
+          job_name = "victoriametrics";
+          static_configs = [
+            {
+              targets = [ "127.0.0.1:8428" ];
+              labels.host = "mars";
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  # Start after Tailscale has had a chance to establish MagicDNS. This is only
+  # ordering, not a hard dependency: VictoriaMetrics still starts locally if
+  # another host or the tailnet is temporarily unavailable.
+  systemd.services.victoriametrics.after = [ "tailscaled-autoconnect.service" ];
+}