From aef9ee02898114670af90a2a6a49b0b0396c8daa Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Sat, 25 Jul 2026 22:00:33 +0900
Subject: [PATCH] bekkalokk/prometheus-phpfpm-exporter: init

---
 hosts/bekkalokk/configuration.nix             |  1 +
 .../services/prometheus-phpfpm-exporter.nix   | 49 +++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 hosts/bekkalokk/services/prometheus-phpfpm-exporter.nix

diff --git a/hosts/bekkalokk/configuration.nix b/hosts/bekkalokk/configuration.nix
index 8e92bef..948c289 100644
--- a/hosts/bekkalokk/configuration.nix
+++ b/hosts/bekkalokk/configuration.nix
@@ -13,6 +13,7 @@
     ./services/mediawiki
     ./services/nginx.nix
     ./services/phpfpm.nix
+    ./services/prometheus-phpfpm-exporter.nix
     ./services/vaultwarden.nix
     ./services/webmail
     ./services/website
diff --git a/hosts/bekkalokk/services/prometheus-phpfpm-exporter.nix b/hosts/bekkalokk/services/prometheus-phpfpm-exporter.nix
new file mode 100644
index 0000000..3cb348a
--- /dev/null
+++ b/hosts/bekkalokk/services/prometheus-phpfpm-exporter.nix
@@ -0,0 +1,49 @@
+{ config, lib, values, ... }:
+let
+  cfg = config.services.prometheus.exporters.php-fpm;
+  pools = [
+    "idp"
+    "mediawiki"
+    "pvv-nettsiden"
+    "roundcube"
+    "snappymail"
+  ];
+in
+{
+  services.phpfpm.pools = lib.genAttrs pools (_: {
+    settings."pm.status_path" = "/status";
+  });
+
+  services.prometheus.exporters.php-fpm = {
+    enable = true;
+    listenAddress = "127.0.0.1";
+    extraFlags = map
+      (name: "--phpfpm.scrape-uri=unix://${config.services.phpfpm.pools.${name}.socket};/status")
+      pools;
+  };
+
+  systemd.services.prometheus-php-fpm-exporter.serviceConfig = {
+    Slice = "system-monitoring.slice";
+    SupplementaryGroups = [ config.services.nginx.group ];
+  };
+
+  services.nginx = lib.mkIf cfg.enable {
+    virtualHosts."www.pvv.ntnu.no" = lib.mkIf config.services.nginx.enable {
+      forceSSL = true;
+      enableACME = true;
+      kTLS = true;
+
+      locations."/prometheus-php-fpm-exporter/metrics" = {
+        proxyPass = "http://localhost:${toString cfg.port}/metrics";
+
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow ::1;
+          allow ${values.hosts.ildkule.ipv4};
+          allow ${values.hosts.ildkule.ipv6};
+          deny all;
+        '';
+      };
+    };
+  };
+}