ildkule: switch grafana db from sqlite to postgres

hosts/ildkule/services/metrics/grafana.nix

@@ -1,15 +1,41 @@
-{ config, pkgs, ... }:
-
-let
+{ config, pkgs, values, ... }: let
   cfg = config.services.grafana;
 in {
+  sops.secrets = let
+    owner = "grafana";
+    group = "grafana";
+  in {
+    "keys/grafana/secret_key" = { inherit owner group; };
+    "keys/grafana/admin_password" = { inherit owner group; };
+    "keys/postgres/grafana" = { inherit owner group; };
+  };
+
   services.grafana = {
     enable = true;
-    settings.server = {
-      domain = "ildkule.pvv.ntnu.no";
-      http_port = 2342;
-      http_addr = "127.0.0.1";
+
+    settings = let
+      # See https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider
+      secretFile = path: "$__file{${path}}";
+    in {
+      server = {
+        domain = "ildkule.pvv.ntnu.no";
+        http_port = 2342;
+        http_addr = "127.0.0.1";
+      };
+
+      security = {
+        secret_key = secretFile config.sops.secrets."keys/grafana/secret_key".path;
+        admin_password = secretFile config.sops.secrets."keys/grafana/admin_password".path;
+      };
+
+      database = {
+        type = "postgres";
+        user = "grafana";
+        host = "${values.hosts.bicep.ipv4}:5432";
+        password = secretFile config.sops.secrets."keys/postgres/grafana".path;
+      };
     };
+
     provision = {
       enable = true;
       datasources.settings.datasources = [