{ config, pkgs, lib, ... }: {

  sops.secrets.hass_long_term_token = { };

  services.nginx = {
    enable = true;
    statusPage = true;
    virtualHosts = {
      "prometheus.pepe.private" = {
        extraConfig = ''
          allow ${config.tinc.private.subnet};
          deny all;
        '';
        locations."/" = { proxyPass = "http://localhost:${toString config.services.prometheus.port}"; };
      };
    };
  };

  services.prometheus = {
    checkConfig = "syntax-only";
    enable = true;
    # keep data for 30 days
    extraFlags = [ "--storage.tsdb.retention.time=30d" ];

    exporters = {
      node = {
        enable = true;
        enabledCollectors = [ "systemd" ];
        port = 9002;
      };
    };

    scrapeConfigs = [
      {
        job_name = "netdata";
        metrics_path = "/api/v1/allmetrics";
        params.format = [ "prometheus" ];
        scrape_interval = "5s";
        static_configs = [
          {
            targets = [ "localhost:19999" ];
            labels = {
              service = "netdata";
              server = "pepe";
            };
          }
        ];
      }
      {
        job_name = "systemd";
        static_configs = [{
          targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
        }];
      }
      {
        # see https://www.home-assistant.io/integrations/prometheus/
        job_name = "home-assistant";
        scrape_interval = "60s";
        metrics_path = "/api/prometheus";
        bearer_token_file = toString config.sops.secrets.hass_long_term_token.path;
        static_configs = [{
          targets = [ "localhost:8123" ];
          labels = {
            service = "hass";
            server = "pepe";
          };
        }];
      }
    ];
  };
}