Add prometheus monitoring

system/default.nix

@@ -3,5 +3,6 @@
     ./sops.nix
     ./root-user.nix
     ./sshd.nix
+    ./monitoring.nix
   ];
 }

system/monitoring.nix

@@ -0,0 +1,33 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = with pkgs; [
+    prometheus-node-exporter
+    prometheus-systemd-exporter
+  ];
+
+  systemd.services."node-exporter" = {
+    enable = true;
+    unitConfig = {
+      Description = "Prometheus Node Exporter";
+      After = [ "network.target" ];
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.prometheus-node-exporter}/bin/node_exporter";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  systemd.services."systemd-exporter" = {
+    enable = true;
+    unitConfig = {
+      Description = "Prometheus Systemd Exporter";
+      After = [ "network.target" ];
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.prometheus-systemd-exporter}/bin/systemd_exporter";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ 9100 9558 8989 ];
+}