{ config, pkgs, lib, ... }: {

  sops.secrets.hass_long_term_token.owner = "prometheus";

  services.nginx = {
    enable = true;
    statusPage = true;
    virtualHosts = {
      "prometheus.pepe.private" = {
        extraConfig = ''
          allow ${config.tinc.private.subnet};
          deny all;
        '';
        locations."/" = { proxyPass = "http://localhost:${toString config.services.prometheus.port}"; };
      };
    };
  };

  services.prometheus = {
    checkConfig = "syntax-only";
    enable = true;
    # keep data for 30 days
    extraFlags = [ "--storage.tsdb.retention.time=30d" ];

    ruleFiles = [
      (pkgs.writeText "prometheus-rules.yml" (builtins.toJSON {
        groups = [
          {
            name = "core";
            rules = [
              {
                alert = "InstanceDown";
                expr = "up == 0";
                for = "5m";
                labels.severity = "page";
                annotations = {
                  summary = "Instance {{ $labels.instance }} down";
                  description = "{{ $labels.instance }} of job {{ $labels.job }} has been down for more than 5 minutes.";
                };
              }
            ];
          }
        ];
      }))
    ];




    #alertmanager = {
    #  enable = true;
    #  configuration = {
    #};
    #};

    exporters = {
      systemd.enable = true;
      node = {
        enable = true;
        enabledCollectors = [ "systemd" ];
        port = 9002;
      };
    };

    scrapeConfigs = [
      {
        job_name = "netdata";
        metrics_path = "/api/v1/allmetrics";
        params.format = [ "prometheus" ];
        scrape_interval = "5s";
        static_configs = [
          {
            targets = [ "localhost:19999" ];
            labels = {
              service = "netdata";
              server = "pepe";
            };
          }
        ];
      }
      {
        job_name = "systemd";
        static_configs = [{
          targets = [ "localhost:${toString config.services.prometheus.exporters.systemd.port}" ];
          labels = {
            service = "systemd-exporter";
            server = "pepe";
          };
        }];
      }
      {
        job_name = "node";
        static_configs = [{
          targets = [ "localhost:${toString config.services.prometheus.exporters.node.port}" ];
          labels = {
            service = "node-exporter";
            server = "pepe";
          };
        }];
      }
      {
        # see https://www.home-assistant.io/integrations/prometheus/
        job_name = "home-assistant";
        scrape_interval = "60s";
        metrics_path = "/api/prometheus";
        bearer_token_file = toString config.sops.secrets.hass_long_term_token.path;
        static_configs = [{
          targets = [ "localhost:8123" ];
          labels = {
            service = "hass";
            server = "pepe";
          };
        }];
      }
    ];
  };
}