From 4c9e01e7547942e6d21df1a483ae85ac95c1b07f Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Sun, 8 Feb 2026 12:36:38 +0100
Subject: [PATCH] improve postgres

---
 hosts/sql/{postgres.nix => postgresql.nix} |  19 +++++++++++++++++++
 secrets/postgres-grafana.age               | Bin 0 -> 937 bytes
 services/postgres.nix                      |  21 ---------------------
 3 files changed, 19 insertions(+), 21 deletions(-)
 rename hosts/sql/{postgres.nix => postgresql.nix} (81%)
 create mode 100644 secrets/postgres-grafana.age
 delete mode 100644 services/postgres.nix

diff --git a/hosts/sql/postgres.nix b/hosts/sql/postgresql.nix
similarity index 81%
rename from hosts/sql/postgres.nix
rename to hosts/sql/postgresql.nix
index 61f3af8..0060db2 100644
--- a/hosts/sql/postgres.nix
+++ b/hosts/sql/postgresql.nix
@@ -7,6 +7,7 @@ let
   entries = [
     (mkEntry "matrix-synapse" 25) # matrix.berlin.ccc.de
     (mkEntry "hedgedoc" 26) # md.berlin.ccc.de
+    (mkEntry "grafana" 255) # mon.berlin.ccc.de
   ];
   mkEntry = name: octet: {
     user = {
@@ -47,6 +48,14 @@ in
     #  };
     #};
     postgresql = {
+      enable = true;
+      package = pkgs.postgresql_18;
+      enableJIT = true;
+      initdbArgs = [
+        "--locale=C"
+        "--encoding=UTF8"
+      ];
+      settings.listen_addresses = "*";
       enableTCPIP = true;
       #settings = {
       #  ssl = "on";
@@ -58,6 +67,16 @@ in
       ensureDatabases = map (e: e.database) entries;
       authentication = "${builtins.concatStringsSep "\n" (map (e: e.auth) entries)}";
     };
+    postgresqlBackup = {
+      enable = true;
+      startAt = "@daily";
+      compression = "zstd";
+    };
+    prometheus.exporters.postgres = {
+      enable = true;
+      openFirewall = true;
+      firewallRules = services.prometheus.exporters.node.firewallRules;
+    }:
   };
   systemd.services.postgresql.postStart = ''
     ${config.services.postgresql.package}/bin/psql \
diff --git a/secrets/postgres-grafana.age b/secrets/postgres-grafana.age
new file mode 100644
index 0000000000000000000000000000000000000000..874dca2484851d8afdd738eefb0a5e242a774328
GIT binary patch
literal 937
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELTYPtSSg7
z@%A>&3oLNTO7U<tcQ*|8DD%#8cg#=qOmWXhG%zR$GRiQmvfwhZEGe$A%=D@9G0`@2
zG%<=wPcw6MON=TAbkDVLEG;!Qw=B(e@%Bv#^hCGKwah0eyj-CwHNrE;rNqzF(<L-Z
zKiAPYyg1w-$;;i<Kf=<>GqSL>D%&k1yxgQbBbzJO!Xqlw%+<u)D8n<^Eyq77tjIX3
zxU9m}&&|c9s-&bOUpv&>&m+($ITGEr6kqK$pFjnlvdk=($bfwPT#qO>mx4;ma?|XH
z?0jECqr|MrvP8qgFy|cCa{mkumu#-|qIBahBbN-9<Un8NVtv;v$3kZlGsnoh0JD_D
zFgMGJg52~Rqio|qb60fRvMR!TjRF<IE3?gljq`oA)BFk|10(e_T?#|POHwR7B7H1^
zk_@~;%yYu^{UW`?U9!0>4Ye&R0*hS}!~9ZBe2mS@$^%Su^pnF<^bIXMid@6}Tufba
z3ln{_0|L=))30<6bxv0Zi!?LSkMj0S@ySi~$TxIJ@yslaa4Ywy2=zBIG>`Cbbg%Ra
z&2+L%2`T4tF7pm8%MI5~%<wk%v8c2N^C-x4a?40|Ns0{2@$<?`G%s_{Om$B5$nZtC
z&CR{Q)G%G4JR`|Jz%frd&!Vaz)XXU(JjdHHxzZ=h)z`(d&{@0GFx9hEzof!2Dx#b#
zz$hmqu{hGjBQVs|JtfS;*dx=!ps>g<I6T+6!aKtwx!j^6H9Mr-$if8OHcunBWT!xd
zY-9iYq}<3%%c9a`OAl|~(y-(bzi@-dDDA9Z=Q4}riWI*P({f+SpzJ^{ZKpJ+q|~Ui
zWH%2Bi|}06#BhsjFJJv23&-4?%8VfGd_xNl<07*(XP<N~U0q!TZ6jaHLN||OZ(px8
zcem2CDpymtP~UuQ<C4<Ee2-%P2=9#WOvl_{Z$}d@w<WxrToNaVnSVLs)bCOB;^wM%
z99gqI+?#yZchA-@p)Cuv6-A9Ey@=Kh@;v9-af;!<IzCQ@+crynef}RO7$Omodr`}I
j5m&$B;T4{TzVCU|&wO}qMdrMTlFXi^OTRPTJJk&U0SY%7

literal 0
HcmV?d00001

diff --git a/services/postgres.nix b/services/postgres.nix
deleted file mode 100644
index e50f232..0000000
--- a/services/postgres.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ pkgs, ... }:
-
-{
-  services = {
-    postgresql = {
-      enable = true;
-      package = pkgs.postgresql_18;
-      enableJIT = true;
-      initdbArgs = [
-        "--locale=C"
-        "--encoding=UTF8"
-      ];
-      settings.listen_addresses = "*";
-    };
-    postgresqlBackup = {
-      enable = true;
-      startAt = "@daily";
-      compression = "zstd";
-    };
-  };
-}