grafana

systems/x86_64-linux/jallen-nas/sops.nix

@@ -140,7 +140,7 @@ in
         group = "keys";
         restartUnits = [
           "nextcloud.service"
-          "prometheus-nextcloud-exporter.service"
+          "prometheus-nextcloud-exporter.service" # actual systemd unit name
         ];
       };
       "jallen-nas/nextcloud/smtp_settings" = {
@@ -285,6 +285,21 @@ in
         sopsFile = defaultSops;
         restartUnits = [ "podman-authenticRac.service" ];
       };
+
+      # ------------------------------
+      # Grafana
+      # ------------------------------
+      # secret_key was previously the upstream default "SW2YcwTIb9zpOOhoPsMm".
+      # It is stored here so Grafana can read it via the file provider without
+      # embedding it in the world-readable Nix store.
+      # To rotate: use https://github.com/erooke/grafana-secretkey-rotation-tool
+      "jallen-nas/grafana/secret-key" = {
+        sopsFile = defaultSops;
+        owner = "grafana";
+        group = "grafana";
+        mode = "0400";
+        restartUnits = [ "grafana.service" ];
+      };
     };
 
     # ------------------------------