monitoring: Add HTTP basic authentication on Prometheus dashboard

roles/monitoring/default.nix

@@ -71,6 +71,11 @@ in {
       owner = "grafana";
     };
 
+    age.secrets.prometheus-dashboard-htpassword = {
+      file = ../../secrets/prometheus-dashboard-htpassword.age;
+      owner = "nginx";
+    };
+
     services.prometheus = rec {
       enable = true;
 
@@ -151,7 +156,16 @@ in {
       declarativePlugins = [ grafana-clickhouse-datasource ];
     };
 
-    my.http.vhosts."prom.dolphin-emu.org".proxyLocalPort = promPort;
+    my.http.vhosts."prom.dolphin-emu.org".cfg = {
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString promPort}";
+        extraConfig = ''
+          client_max_body_size 0;
+          auth_basic "prom.dolphin-emu.org";
+          auth_basic_user_file "${config.age.secrets.prometheus-dashboard-htpassword.path}";
+         '';
+      };
+    };
     my.http.vhosts."mon.dolphin-emu.org".cfg = {
       locations."/" = {
         proxyPass = "http://127.0.0.1:${toString grafanaPort}";

secrets/prometheus-dashboard-htpassword.age

@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-ed25519 QNIwVA 736umxtkWuf+CKEy5tia31PqhQyF2l21fvs3W0SHXQE
+DatQywPbGAltrfm0U4ydrgBONzu3hRQkkg3p9uZaX/0
+-> ssh-ed25519 X6Z9SA kC4F1qhXSNxEmrmH4utAw6o2WMweDJK84wOksPSdqmw
+TCJALIEIN47XETZr7p0kXhXsMNp+NJbXDzHUhL0v00c
+-> ssh-ed25519 nDu9FA l1qsYHveAx3ebDVm2jYn2NTBuY0vLd2Mx59UZtCY1T0
+LFwvdAjqLolehbvDiuw3cA932Br4TZPgRebHyYczY3A
+-> ssh-ed25519 tX+N9g XpeO7Y6iIrtdnajT2Z7lfDrnmbUS8pep9vidMz+Ar2M
+y9dXrGFZbr+OpQJj/6Cd5WJ1cCntSe2uo6MjJFbpc9U
+-> ssh-ed25519 nE7g2A ZJWcjZhPmJME9kIJpjZBJZ6un0/Ks6uu9r9L0JTI6Gs
+kV2OljC8kJltcQJK0PZqIQ7MvYR3dH5rkOOJArDDhYg
+-> ssh-ed25519 eddTNw MHGNW1QNHRW0G1b3tm5sCCHyBojVT9G4nOf+TSfvVwc
+uCGv8VqPB8ob2P/D75eOnBMTmVrva3jmMnI1ttOe7fI
+--- xhmWwq5faYVV8WyuIoBXoFOtAbO7yOznC7g4qxyaM+w
+<EFBFBD><EFBFBD>^1E1<>遒\<5C>.a9f<39><66><EFBFBD><EFBFBD>}<7D>:<3A><><EFBFBD>EG<1C><><EFBFBD><EFBFBD>@3<>=…Ȳ<C285><C8B2><EFBFBD>	<1F>x΢fG<47>G<EFBFBD>O̹f<CCB9><66>Ѽ?*<2A>iG

secrets/secrets.nix

@@ -56,6 +56,7 @@ let
     "nas-credentials.age"
     "oci-registry-htpasswd.age"
     "oci-registry-password.age"
+    "prometheus-dashboard-htpassword.age"
     "update-signing-key.age"
     "wiki-bot-password.age"
   ];