mars: add VictoriaMetrics monitoring

hosts/mars/configuration.nix

@@ -12,6 +12,7 @@
     ../../services/containers.nix
     ../../services/vpn/tailscale.nix
     ../../services/monitoring/node-exporter.nix
+    ../../services/monitoring/victoriametrics.nix
   ];
 
   networking.hostName = "mars";

services/monitoring/victoriametrics.nix

@@ -0,0 +1,58 @@
+{ ... }:
+
+# VictoriaMetrics single-node store for the homelab dashboard. It listens on
+# all interfaces, but tailscale.nix makes tailscale0 the only trusted ingress;
+# the host firewall therefore keeps :8428 off the LAN and public interfaces.
+#
+# The scrape targets are the node_exporter instances enabled by
+# services/monitoring/node-exporter.nix on every real host. MagicDNS names use
+# the tailnet's orbit.sol suffix (see services/vpn/headscale.nix).
+{
+  services.victoriametrics = {
+    enable = true;
+    retentionPeriod = "30d";
+    listenAddress = ":8428";
+
+    prometheusConfig = {
+      global.scrape_interval = "60s";
+
+      scrape_configs = [
+        {
+          job_name = "node-exporter";
+          static_configs = [
+            {
+              targets = [ "127.0.0.1:9100" ];
+              labels.host = "mars";
+            }
+            {
+              targets = [ "jupiter.orbit.sol:9100" ];
+              labels.host = "jupiter";
+            }
+            {
+              targets = [ "neptun.orbit.sol:9100" ];
+              labels.host = "neptun";
+            }
+            {
+              targets = [ "mercury.orbit.sol:9100" ];
+              labels.host = "mercury";
+            }
+          ];
+        }
+        {
+          job_name = "victoriametrics";
+          static_configs = [
+            {
+              targets = [ "127.0.0.1:8428" ];
+              labels.host = "mars";
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  # Start after Tailscale has had a chance to establish MagicDNS. This is only
+  # ordering, not a hard dependency: VictoriaMetrics still starts locally if
+  # another host or the tailnet is temporarily unavailable.
+  systemd.services.victoriametrics.after = [ "tailscaled-autoconnect.service" ];
+}