Commit 2ce946d

@@ -30,6 +30,11 @@
         domain = "navidrome.net.trin.one";
       };
 
+      services.victoriametrics = {
+        address = "127.0.0.1";
+        port = 8428;
+      };
+
       services.woodpecker.agent.agents = {
         codeberg = {
           server = "grpc.ci.codeberg.org:443";
@@ -51,6 +56,7 @@
     services.forgejo.runner
     services.navidrome
     services.node-exporter
+    services.victoriametrics
     services.woodpecker.agent
   ];
 }

@@ -0,0 +1,70 @@
+{
+  den,
+  lib,
+  ...
+}: {
+  den.aspects.services.victoriametrics = {
+    settings.host = {
+      address = lib.mkOption {
+        type = lib.types.str;
+        default = "127.0.0.1";
+      };
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 8428;
+      };
+    };
+
+    persist = {
+      directories = [
+        {
+          directory = "/var/lib/private/victoriametrics";
+          user = "nobody";
+          group = "nogroup";
+          mode = "0700";
+        }
+      ];
+    };
+
+    nixos = {
+      host,
+      lib,
+      ...
+    }: let
+      cfg = host.settings.services.victoriametrics;
+
+      nodeExporterTargets =
+        lib.mapAttrsToList (
+          name: nodeExporterHost: let
+            exporter = nodeExporterHost.settings.services.node-exporter;
+          in {
+            targets = ["${exporter.address}:${toString exporter.port}"];
+            labels.instance = name;
+          }
+        ) (lib.filterAttrs
+          (_: {hasAspect, ...}: hasAspect den.aspects.services.node-exporter)
+          (lib.mergeAttrsList (lib.attrValues den.hosts)));
+    in {
+      services.victoriametrics = {
+        enable = true;
+        listenAddress = "${cfg.address}:${toString cfg.port}";
+        checkConfig = false; # Disable it because env `CREDENTIALS_DIRECTORY` not loaded in check
+        extraOptions = [
+          "-memory.allowedPercent=30"
+        ];
+        prometheusConfig = {
+          global = {
+            scrape_interval = "30s";
+            scrape_timeout = "10s";
+          };
+          scrape_configs = [
+            {
+              job_name = "node-exporter";
+              static_configs = nodeExporterTargets;
+            }
+          ];
+        };
+      };
+    };
+  };
+}

@@ -1,4 +1,8 @@
-{lib, ...}: {
+{
+  den,
+  lib,
+  ...
+}: {
   den.aspects.services.node-exporter = {
     settings.host = {host, ...}: {
       address = lib.mkOption {
@@ -28,7 +32,23 @@
 
     tailscaleGrant = {host, ...}: [
       {
-        src = ["autogroup:member"];
+        src = let
+          vmIPsList = lib.pipe den.hosts [
+            lib.attrValues
+            lib.mergeAttrsList
+            (lib.filterAttrs (_: {hasAspect, ...}: hasAspect den.aspects.services.victoriametrics))
+            (lib.mapAttrsToList (
+              _: {address, ...}: let
+                v4 = address.ipv4.tailscale;
+                v6 = address.ipv6.tailscale;
+              in
+                lib.optionals (v4 != null) [v4] ++ lib.optionals (v6 != null) [v6]
+            ))
+          ];
+        in
+          if vmIPsList != []
+          then vmIPsList
+          else ["autogroup:member"];
         ip = ["tcp:${toString host.settings.services.node-exporter.port}"];
       }
     ];