monitoring: add exportarr for radarr/sonarr metrics

Add prometheus exportarr exporters for Radarr and Sonarr media
services. Runs on monitoring01, queries remote APIs.

- Radarr exporter on port 9708
- Sonarr exporter on port 9709
- API keys fetched from Vault

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

services/monitoring/default.nix

@@ -5,6 +5,7 @@
     ./grafana.nix
     ./prometheus.nix
     ./blackbox.nix
+    ./exportarr.nix
     ./pve.nix
     ./alerttonotify.nix
     ./pyroscope.nix

services/monitoring/exportarr.nix

@@ -0,0 +1,47 @@
+{ config, ... }:
+{
+  # Vault secrets for API keys
+  vault.secrets.radarr-api-key = {
+    secretPath = "services/exportarr/radarr";
+    extractKey = "api_key";
+    services = [ "prometheus-exportarr-radarr-exporter" ];
+  };
+
+  vault.secrets.sonarr-api-key = {
+    secretPath = "services/exportarr/sonarr";
+    extractKey = "api_key";
+    services = [ "prometheus-exportarr-sonarr-exporter" ];
+  };
+
+  # Radarr exporter
+  services.prometheus.exporters.exportarr-radarr = {
+    enable = true;
+    url = "http://radarr-jail.home.2rjus.net:7878";
+    apiKeyFile = config.vault.secrets.radarr-api-key.outputDir;
+    port = 9708;
+  };
+
+  # Sonarr exporter
+  services.prometheus.exporters.exportarr-sonarr = {
+    enable = true;
+    url = "http://sonarr-jail.home.2rjus.net:8989";
+    apiKeyFile = config.vault.secrets.sonarr-api-key.outputDir;
+    port = 9709;
+  };
+
+  # Scrape configs
+  services.prometheus.scrapeConfigs = [
+    {
+      job_name = "radarr";
+      static_configs = [{
+        targets = [ "localhost:9708" ];
+      }];
+    }
+    {
+      job_name = "sonarr";
+      static_configs = [{
+        targets = [ "localhost:9709" ];
+      }];
+    }
+  ];
+}