bicep: enable mysql

hosts/bicep/configuration.nix

@@ -9,6 +9,7 @@
 
     ./services/mysql.nix
     ./services/postgres.nix
+    ./services/mysql.nix
 
     ./services/matrix
   ];

hosts/bicep/services/mysql.nix

@@ -10,10 +10,21 @@
         max_connect_errors = 10000;
       };
     };
+
+    # Note: This user also has MAX_USER_CONNECTIONS set to 3, and
+    #       a password which can be found in /secrets/ildkule/ildkule.yaml
+    ensureUsers = [{
+      name = "prometheus_mysqld_exporter";
+      ensurePermissions = {
+	"*.*" = "PROCESS, REPLICATION CLIENT, SELECT";
+      };
+    }];
   };
 
   services.mysqlBackup = {
     enable = true;
     location = "/var/lib/mysql/backups";
   };
+
+  networking.firewall.allowedTCPPorts = [ 3306 ];
 }

values.nix

@@ -10,6 +10,9 @@ in rec {
     postgres = {
       inherit (hosts.bicep) ipv4 ipv6;
     };
+    mysql = {
+      inherit (hosts.bicep) ipv4 ipv6;
+    };
     # Also on bicep
     turn = {
       ipv4 = pvv-ipv4 213;