From 004de0330843d27062010ac98da52185aa1892b6 Mon Sep 17 00:00:00 2001
From: soraefir <soraefir+git@helcel>
Date: Sat, 6 Jun 2026 21:31:33 +0200
Subject: [PATCH] grafana setup

---
 modules/server/containers/apps/influx.nix | 61 ++++++++++++++++++++++-
 modules/server/sops/server.yaml           |  6 +--
 2 files changed, 63 insertions(+), 4 deletions(-)

diff --git a/modules/server/containers/apps/influx.nix b/modules/server/containers/apps/influx.nix
index 2735393..99df36b 100644
--- a/modules/server/containers/apps/influx.nix
+++ b/modules/server/containers/apps/influx.nix
@@ -3,6 +3,27 @@ let
   serverCfg = config.syscfg.server;
   version = "latest";
 
+  influxSource = pkgs.writers.writeYAML "influx.yaml" {
+  apiVersion = 1;
+  datasources = [
+    {
+      name = "InfluxDB 3 SQL";
+      type = "influxdb";
+      access = "proxy";
+      url = "http://influx-db";
+      jsonData = {
+        version = "SQL";
+        dbName = "telegraf";
+        httpMode = "POST";
+      };
+      secureJsonData = {
+        token = "\${INFLUXDB_TOKEN}"; 
+      };
+      isDefault = true;
+      editable = true;
+    }
+  ];
+};
 
 in {
   requires = {
@@ -41,7 +62,7 @@ in {
         };
       };
 
-      ui = builder.mkContainer {
+      ui = if(containerCfg.extra?explorer) then builder.mkContainer {
         tmpfs = true;
         authentik = true;
         subdomain = containerCfg.subdomain;
@@ -59,6 +80,44 @@ in {
             "${serverCfg.path.config}/influxdb/:/app-root/config:rw"
           ];
         };
+      } else {
+        tmpfs = true;
+        authentik = true;
+        subdomain = containerCfg.subdomain;
+        image = "grafana/grafana:${version}";
+        port = 3000;
+        extraEnv = {
+          GF_DEFAULT_INSTANCE_NAME = serverCfg.domain;
+          GF_SECURITY_ADMIN_USER = "\${DEFAULT_ADMIN_USERNAME}"; 
+          GF_SECURITY_ADMIN_PASSWORD = "\${DEFAULT_ADMIN_PASSWORD}";
+          GF_SECURITY_ADMIN_EMAIL = "\${DEFAULT_ADMIN_EMAIL}";
+          GF_SECURITY_COOKIE_SECURE = "true";
+          GF_USERS_ALLOW_SIGN_UP = "false";
+          GF_USERS_AUTO_ASSIGN_ORG = "true";
+          GF_USERS_AUTO_ASSIGN_ORG_ROLE = "true";
+          GF_AUTH_PROXY_ENABLED = "true";
+          GF_AUTH_PROXY_HEADER_NAME = "X-authentik-username";
+          GF_AUTH_PROXY_HEADER_PROPERTY = "username";
+          GF_AUTH_PROXY_AUTO_SIGN_UP = "true";
+          GF_DATABASE_TYPE = "postgres";
+          GF_DATABASE_HOST = "${builder.host}";
+          GF_DATABASE_NAME = "influx_db";
+          GF_DATABASE_USER = "influx_user";
+          GF_ANALYTICS_REPORTING_ENABLED = "false";
+          GF_CHECK_FOR_UPDATED = "false";
+          GF_LIVE_HA_ENGINE = "redis";
+          GF_LIVE_HA_ENGINE_ADRESS = "${builder.host}:6379";
+    
+          DEFAULT_INFLUX_SERVER = "http://${builder.host}:8181";
+        };
+        overrides = { 
+          environmentFiles =  [ config.sops.secrets."INFLUX".path config.sops.secrets."CUSTOM".path ] ;
+        
+          volumes = [
+            "${serverCfg.path.data}/influxdb/ui:/var/lib/grafana:rw"
+            "${influxSource}:/etc/grafana/provisioning/datasources/influx.yaml:ro"
+          ];
+        };
       };
     };
 
diff --git a/modules/server/sops/server.yaml b/modules/server/sops/server.yaml
index b9016f7..0f53259 100644
--- a/modules/server/sops/server.yaml
+++ b/modules/server/sops/server.yaml
@@ -11,7 +11,7 @@ UMAMI: ENC[AES256_GCM,data:onB/uXLajaRLmeQMGNHFsjREzPih9ha+cogGRw+nRomERSRrbBv+6
 IMMICH: ENC[AES256_GCM,data:1y78yeawkRjUXLWPyFdMB5HCDQhb1PoxEMfHmKSZfv0CWloOrQWT735dlH+W9yC6ljZjqVD9Fwq/9GqqKQMTFMCpr8wVRwSHEuqmaG3UgKzbLA3aWZ1SIB0AiJi+eUunzHj2vikUJx9dMRjC+iNXrsVWh2HqMrOyFCWetZoIfxNiAgsgNKPgYYsHLv6OAZs9XT7V3veqe0zc0nyw7ghWSXne/yNhQESyyGlMAdagrJRNimvXIp/AoAUKl2WUJm2MBl7lb6K1YeJ1XW8OjAHzV8isBiUwU8ZD81VJog0fgTGjbUa+HO7jEo+9YwmDIMx3f5z9N4A=,iv:pboITW2rr7+w8VNZM6uYMMEFZ1S/JtqjNOVthpYJ2tQ=,tag:0dgrJ191sB4MLJHMoQBlCg==,type:str]
 INVIDIOUS: ENC[AES256_GCM,data:ZfgU5UFMmG9Cx9UaR0xnKr9VPebG3kut0difTFZmoqOSs+stG6YJfV82OOhj1RQLVJlPr/scydYy1+3LytwvP1BT7tLe0jII7XupbkL0w3n79KBaiIzAPdicqLxeqjKH45I0NjHra4djdnO2Ff4T8CTiFDlPn1rMuiw=,iv:UaDmOKJ4bFPGCaIePLXkWot9E6sTu2nhaVs83sI38G0=,tag:spTjxWEmLfPc8BZl2GglBA==,type:str]
 SERVARR: ENC[AES256_GCM,data:757WdthmToCGr2boph7iW1ycs3tQyGgD3lhYOcX/X3hjs9dLLPCWGI2zt5axp72IGJ/sVYEop2rqsRLxdPn3VIyQLvQ+3MYdo8Z/yOuMy7DAlnITQQQUI2ylZKHVmFAt39/xBpwsVjh3m/hBQvn/LbCDtR2s4qa+8fQDfeZXksTtnf7YZbVygTF7jWZ+0oVvkvNO1ZUejvP+uHL+jHwgMEwQnR22hOYWEKZ1s7PI+EZHujqyOhnwXB4jRG+XD7R4N6AhC5Z+nmkFpy3ffszCJ0/H,iv:NrNbkL6GWN4r+uzxNYrhoECD1APbRsRBcMBbVHD3DwM=,tag:YK1O50wV+lHAQa6TX9huUw==,type:str]
-INFLUX: ENC[AES256_GCM,data:ZfnJrhi1cWnrIqWaxieUPsKDtJXOwTQXRaIoBjDSeq3PKq1HyDQ8RaDeDBnL6wDDRBrcUzxp0PORvICaRbZ9Ve4LVk4XerpOmR3vHBci6cyYtjhVgUa61G5hDCQ8m1NljDC83X4MjXq2KFaPDaSOrAAJX4IhmUn8Ag==,iv:3agEIIs0YHqr0wU8f9Y63ErU/TmDkeKLu/0kOOmn3B4=,tag:1X+6mcZ3THO0XE1mmVieZA==,type:str]
+INFLUX: ENC[AES256_GCM,data:lLn/cSYWtjxeHafHUku9QnGV/pVPvx1WFSC6vgJP7w1XfL+7mk54M56cGr1VXGsM993ynjzrWDrxO8WtQPh1F9BOMH15ZY6B10rw0hLxsJyIapPrhp1/1HtryhmL8eNTU7N7UnPKdzeN/XFwjqqlktka4H9FcMg8A8STns8vNa6it4hx+IxKj3Dukdq2DSS7w9s1/+j08vZMwIULBRR+ZcGOGUppIS8umZ4/4yzPO03w4A9RNMIXhWdwbU64Xj49hOlxuqNoRcxw7dDp/GpHRXijsKdhPOegKo1tRQII,iv:Y9G/cXYzn3H91c/JLWglrtokUi7jjQxPgVgz4xUtoug=,tag:LvpuWeIzpHScnwjzz1J56A==,type:str]
 FRESHRSS: ENC[AES256_GCM,data:M5C76yVyi0Uw28FWj+IvQJbP1hdxxBGWfp30egjlv8Eu4tSZjHyfni+OLwgziDeQQyvRbn2OHwKtztEu4N2C7iU0UaotB0jCOc2BKuwfSWrxWfmkTDrY1YBfbGgLWEKQ1ddafI/Dn99n4HFbGpMZ8Fbe+sRKKGgpAPj9bMkUjoP3eXw4HUWhu84b6LWu3x8DwArhNDOkHJnDL+Rlif7hILg7+eI/IUB0XakKCMIKHZn9djk4yjgXMQGF5EFRlPVWgQ==,iv:2Kb916TksnVhby/GORx9nzir6A7GiRNL9S0wrbc8yDQ=,tag:v2Nhj61qd4f/YV1HcF0v5Q==,type:str]
 SUWAYOMI: ENC[AES256_GCM,data:xVzuIWdEZLeFtkVew/Jbt0U+ouOjA+U/flhSAsWHPQHWgp7+6uvdBYIxcyQ+firHAu9qcAO/HahDgnr0lhcQx/n5XgEhCchiGxCNBcAi/AD+FE9/PgSJf2DvjCp0ckCWvPChGsy+TD8uNi1bg0lqSrbDExRS28f3FVPrbrJJ1vj/V9Gk4PABg/UcdvycgCpf266aFMMzNuPJGyaRuQEnyFNvQgs53R7t9D9hC9GSc4MkEGt7g0GeX1MTRTzjjISgCdzZxjUiJGSuFTBemQggcWOAJNdYFq1vuh5X3zBvlF+zz75g3cin9S58CQ==,iv:/zlNBdu5SuzC8+t4zOYVga3hLWnxlNUALi6BS4MjNog=,tag:DfeC0X7uX9/qhltFl2D2hg==,type:str]
 CALIBRE: ENC[AES256_GCM,data:Uxz/5H4q/ugmW49a6oIQsG450w+SS1H58gOMXDVX/JQ8OCGxWQ8DRNmSGBZLgGsJ9UA1rxYRS4+pDuDL+iQsNVOmZzFRAuWJwUhEiF72B/Ah0IyXpnPIups8S2Nq,iv:rK274zWuvguY/DPHXxG174j+Ne11SB7ZCQLxO6Tvvg4=,tag:7wJyt94jRvRCZxgHWotzVA==,type:str]
@@ -36,8 +36,8 @@ sops:
             d4RrlLP9NSozwVsPYI4ntygvMSApbT4v0YvoO7gV90lkGWEvW1YDfA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3
-    lastmodified: "2026-06-05T17:57:03Z"
-    mac: ENC[AES256_GCM,data:za59zOWR7vsdFDwzLQNQB3oaXQocQqTqOcOhkwSfZbIZJ8Nu/n0Jdn3L7it8FohEaAGATYImYTIdtwc4ThhtJZYsRK6bAU/cR95UIU1fp5/XyHefb3N2Nt5Pgf28urVkYLJdzShFpF6IxwS+/iY3MRUMhr2OJsaIKakjtNkPCks=,iv:lZhMnkVhbxqJqKb3dCa+Lsbfj3aeeHgUqBKLywomldA=,tag:t3pNvS10HTqF9REzt/qrng==,type:str]
+    lastmodified: "2026-06-06T19:05:55Z"
+    mac: ENC[AES256_GCM,data:Qi14yxgLfSqQrFgemT80pwBEfQde06/17DOhjUrUSkJbdMy278a+VXZrCrG61z0QSMXtZutAdQTIJ7KPGot7pmTY9mHNl6zRyDqzC2Jfy2HALG8hWmpOFQepq03RaYO36mwWaMHEB3u4AwhFlKi6OSxIj3RhS1N4xpOwAZxWaGM=,iv:73h8YUYDkCjTVD81VEfFLuby61PQaxz28dw4tcOvx4c=,tag:3eujXdrYqSXTDYbYqo6DSw==,type:str]
     pgp:
         - created_at: "2026-05-05T23:46:27Z"
           enc: |-