refactor

modules/capabilities/services/vps-insights.nix

@@ -1,13 +1,20 @@
 { ... }:
 {
   flake.modules.nixos.vps-insights =
-    { config, pkgs, ... }:
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
     let
       localAddress = "127.0.0.1";
       grafanaDataDir = config.services.grafana.dataDir;
       lokiDataDir = config.services.loki.dataDir;
       lokiUrl = "http://${localAddress}:3100";
       prometheusUrl = "http://${localAddress}:9090";
+      hasCaddy = config.services.caddy.enable;
+      hasOpenSSH = config.services.openssh.enable;
     in
     {
       environment = {
@@ -64,21 +71,17 @@
         # Detect and block common attacks against SSH and Caddy.
         crowdsec = {
           enable = true;
-          hub.collections = [
-            "crowdsecurity/linux"
-            "crowdsecurity/caddy"
-          ];
-          localConfig.acquisitions = [
-            {
+          hub.collections = [ "crowdsecurity/linux" ] ++ lib.optional hasCaddy "crowdsecurity/caddy";
+          localConfig.acquisitions =
+            lib.optional hasOpenSSH {
               source = "journalctl";
               journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
               labels.type = "syslog";
             }
-            {
+            ++ lib.optional hasCaddy {
               filenames = [ "/var/log/caddy/*.log" ];
               labels.type = "caddy";
-            }
-          ];
+            };
         };
 
         crowdsec-firewall-bouncer = {
@@ -86,11 +89,15 @@
           registerBouncer.bouncerName = "${config.networking.hostName}-firewall-bouncer";
         };
 
-        # Grafana defaults to 127.0.0.1:3000; add secrets and datasources only.
+        # Keep Grafana local and separate from Actual's port.
         grafana = {
           enable = true;
           settings = {
             analytics.reporting_enabled = false;
+            server = {
+              http_addr = localAddress;
+              http_port = 3002;
+            };
             security = {
               admin_password = "$__file{${grafanaDataDir}/admin-password}";
               secret_key = "$__file{${grafanaDataDir}/secret-key}";