{ config, pkgs, lib, ... }:
{
  services.grafana = {
    enable = true;
    settings = {
      server = {
        http_addr = "127.0.0.1";
        http_port = 3000;
        domain = "grafana.noisebridge.net";
        root_url = "https://grafana.noisebridge.net";
      };
      security = {
        admin_user = "admin";
        admin_password = "$__file{${config.age.secrets.grafana-admin.path}}";
        disable_gravatar = true;
      };
      analytics.reporting_enabled = false;
      "auth.anonymous".enabled = false;
      users.allow_sign_up = false;
    };

    provision = {
      enable = true;
      datasources.settings.datasources = [
        {
          name = "Prometheus";
          type = "prometheus";
          url = "http://127.0.0.1:9090";
          isDefault = true;
          editable = false;
        }
      ];
    };
  };

  age.secrets.grafana-admin = {
    file = ../../secrets/grafana-admin.age;
    owner = "grafana";
    group = "grafana";
  };
}