feat(metrics): disable metrics on hosts without its config; refactor enable conditions to require top-level enable flag

Author: DaRacci

hosts/server/nixauth/default.nix

@@ -7,6 +7,11 @@ let
     ;
 in
 {
+  services.metrics = {
+    upgradeStatus.enable = false;
+    hacompanion.enable = false;
+  };
+
   sops.secrets =
     let
       acmePermissions = {

hosts/server/nixdb/default.nix

@@ -22,7 +22,10 @@ let
     );
 in
 {
-  core.sops.hostSecretsFile = ./secrets.yaml;
+  services.metrics = {
+    upgradeStatus.enable = false;
+    hacompanion.enable = false;
+  };
 
   server = {
     database.postgres.postgres = { };

hosts/server/nixstor/default.nix

@@ -8,4 +8,9 @@ _: {
       };
     };
   };
+
+  services.metrics = {
+    upgradeStatus.enable = false;
+    hacompanion.enable = false;
+  };
 }

hosts/server/secrets.yaml

@@ -1,79 +1,79 @@
-IO_GUARDIAN_PSK: ENC[AES256_GCM,data:2XFPhOwoWNNCVWWt7wYb9CR0aagsC1H+WwAEdbbfjDrD9USk2ZL1DhlPl/NVYEzp8BdswEgP/wKX/LW3BGXL/Q==,iv:j4dszscxPlhk6znkobmEj3/iMm0OCPUGBOJRpOCOdNk=,tag:AWoYWzJJ0ycxcN3ETBLqJg==,type:str]
+DB_GUARDIAN_PSK: ENC[AES256_GCM,data:IWQFA+ck1AInX+HdplFSKYSo4DVHVswOaakQotseku5pf1snsLMDgUvEwJIvpuMo8BfCgFrcHHJdNVxLuEzJzg==,iv:wq5Apjcp8oZ65F1Netn7aPPEjf+XB/JANvAe2H3aBH0=,tag:2BDq3GnVeLMxo5RxisTYRQ==,type:str]
 sops:
     age:
-        - recipient: age187xlhmks2tcymsnw32jzzxr6lryejma4602e3v0jlrsra5u64pdsxal44a
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtVk52ZGNoUnllQ0w5N2w4
             T3plUVJsOVRVeUZDc0JXVkIyTWVFMFZZblJFCmFUcm9jczRpeFk1UnB1V3FlZkNy
             QzJMVVdhb3MvdzBnRHhlVURuL2pKNDAKLS0tIFloYTFPTjdvZzd4NCtwYzBaVFVu
             Y3JXVkdGdHROdXoxRE11dGRVWlFuUk0KGF1GIEufvFyjv7IogTRwv+pfvKMYonyJ
             MZMaIllsabSh+VfVcFsN3D/WtovmyfvGO1miIMBIfBgCZRYTgcjmMQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1vn626zvqf9hhnwur37fzww0xqts5jp45uuhetk2caggx75wp4umshj235u
-          enc: |
+          recipient: age187xlhmks2tcymsnw32jzzxr6lryejma4602e3v0jlrsra5u64pdsxal44a
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhZ0VDZnVuOE82UWhCeWR0
             V1FaS2lhTEc3Z2dmUFVLdG5YZFRwdDRLdHpNCjJQNlJDL3FPQmJLWmh0WVp6Mlpj
             M205aFJ3d0ZLMHpnaXZrUFdZQ01CTHMKLS0tIGE1RmxqWklicGpVYkhMdzhZMlVN
             Y2FzNE5xNkJNN2xjcllYRVlwNVNEZEEKpA24m9iFUuaNpKoYn4k5ieg3NrXmI0mx
             u0COyE63LQNYNW2i+MUfMwKMHzV4aHYZYErUJeaNxxDmKKTmLBWIlg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1zeu2cj6mt0nllar0myzhlsgwp0xk2px83vskplu0s2ul87g9634svuhjpw
-          enc: |
+          recipient: age1vn626zvqf9hhnwur37fzww0xqts5jp45uuhetk2caggx75wp4umshj235u
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEdmdlZWRMbmZ1SzZNbHVp
             cU0yQ2lOK3piRTFyTkFXU1o2c29PRjZOa0E0CjBpNnhwb0taSWw4WTdpcmEyWmw0
             c2txWllqVisvQnY2LzhOWDJtUWhNM2cKLS0tIHVSU2tPbmFiaWNwTWVUbzBwc0Mz
             MDRkUTZkVEVTNEFpODVLbXloVy9OMUUKPvyIHZ36avVLAtuBr/tz4UCuKTelyQnD
             Vu8hYOREUPF0Turq/xyc3pY1orK4LOEiYO4J5fhZR/90kiaJ3GqrNQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1azcacxqvwankaf5ma98jk7swwpn6uxmwvdz0azq5fnulrlwk747sr9x2z9
-          enc: |
+          recipient: age1zeu2cj6mt0nllar0myzhlsgwp0xk2px83vskplu0s2ul87g9634svuhjpw
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpTmlOdGY4MG5YS0FTTFox
             cS9lRnVlMDBSUWk5MWV1d0E5aFZiT1I4cVE4CkQ2cUxKeTAzYjl3NG1FckFVT2gz
             QXRwWmVGU1RXcjBPMTNJaUZ4a0xDWjgKLS0tIEtJaHg4bmpQUElTMmJJS2d2d1Fl
             R3lJTzJ0R3JRaGtjT2pwdHhUeUVYbmcKtCXEapJpp5ZvH2ro1cH5eQcQj7w4bYSN
             qAvzznqFjwi8fzmXxF1/jKXsN4d3kV8DZ6w/gWybHhA6gMmfsIPucg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hepu4nkwau3p0z2sf40xq0pzzss0wl263m5uey7lfj7usnr7sfeskdkeg4
-          enc: |
+          recipient: age1azcacxqvwankaf5ma98jk7swwpn6uxmwvdz0azq5fnulrlwk747sr9x2z9
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqeGM1T2gvWkkyUThhRWhi
             NndmUnBwamU5V3pFcW9nYWNlOGV3YkFZVEQwCmdwdlFKazlRTHM4djB1b2FjaVpD
             NS9lOVJ2K1NBUDBsaE05cWo1NzFWamsKLS0tIHkrZ3UyQ015RU9EaGVXakZKelE3
             SGlyOUZCaFhCNnF0RzIxNGhDRkVVTGMKFeXkulpUJtemwIzS5L0We/m1sgFoP0hN
             ulEZnPr5bNKRQOyqb3SGhxg/LLxOp1951LHoMrVFJGcwIQorknjMPA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1xct06gxt774vj3ug8j7z7j3vtnvwe29z92nh5al2xqa4uy2kxqjs67j5ay
-          enc: |
+          recipient: age1hepu4nkwau3p0z2sf40xq0pzzss0wl263m5uey7lfj7usnr7sfeskdkeg4
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKYlZLOGgrVEhiaGVFd09s
             cWh4MVZ6SzZjWi9SR1d4NFhYMVkrYnNVOURvCnpYSlUrYjlPSDg5aW5SaysrMkUx
             RUdEYmRuM3R0WUtRZlNXem9GMk9HaG8KLS0tIHZsQTIxZ3gvTWRXZXlDbDlpUVZX
             WE1HSG5GL2tZK081aDMwbExTcU5PeWMKkDgFcgHLY9+NTqyK94x3zZ7Wvozp/IKU
             YCSdU1VrIGA4XgyIzeKmfQeZsp+Jt1aEWL9KaxV0Giqek+pY1UnB/Q==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1qlkycz667c4dzzhywgp94ek5zs9u5xmp4dfd8fh48h58c4253seqajrk49
-          enc: |
+          recipient: age1xct06gxt774vj3ug8j7z7j3vtnvwe29z92nh5al2xqa4uy2kxqjs67j5ay
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyS2hXOXF3UDk2eGFET005
             RjZ2UHh6eXpaY09FY2hOYUI1SU9xK0NTcDFJCjVCSjIrb1ZYNHdrakJVZGRFSjFl
             NlcrMy90QnpDVmFLeXNBNFBYbmFPS2MKLS0tIDYvczdqZUZDcXlZb2dIMGt6YkpC
             MUcwRkIwRTBEK1VUdk1MekRjR2kyM2cKkPhP4wEzfCmAWpXmwcL6PyGFjLQd5Q+7
             jCYvVQ3ErM+eUQGYpLZ6D41XLDBoE3IEPzAlo33ZgiSiglwk2hnVuw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age10emng003r0p06xudhz8w3846vr9dl6sw4pl8hflpd7p3sejv75ds8rnf2a
-          enc: |
+          recipient: age1qlkycz667c4dzzhywgp94ek5zs9u5xmp4dfd8fh48h58c4253seqajrk49
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5SjhBbHJPUE5ZY21PYXZY
             MHFvL0FhcVMzSmV5b3g5NzUvRElCYlRPSmtFCm9obGQ4Z0lma2lFZVdQdlBCUWpl
             dTVrb3Z6NlhEUVU5cGZabWhWeDI3UUkKLS0tIFRhZUFEZm4xNkhPZXRyUkwrbUw2
             UFNhaEZFMmVyTFFwTGp0SXRWMzBpMGMKm0X7+jNC9v7NgLh2alb9sMBHfwpD7n/p
             rK2FcwOem+VeJSdHT2uBJmYRbQu63J+7WtnqK+iYeexQGNAn2HEpvA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-21T04:43:43Z"
-    mac: ENC[AES256_GCM,data:aQFKMtZZfZa/dmN/tMU0Xmk4BIw+qATOcyZuOYglLaIfInAPKxsfwjmmuzCgttztCwRKDETiOdgktAGS7Lh1HDxHIjAh3dS7lt0OlbP4lDmix3RDG8dhCLyk0OnNbdYtk/1rFaALbxr4urH62CaCvX3png6DKJux1CqQpFkyH5U=,iv:NyPj222+8JxLUurtBpT6fPOOjIPEjf2gJ4BbasrdKBY=,tag:/WIbkctVdZmpp8N7HFNLIg==,type:str]
+          recipient: age10emng003r0p06xudhz8w3846vr9dl6sw4pl8hflpd7p3sejv75ds8rnf2a
+    lastmodified: "2026-08-22T08:08:41Z"
+    mac: ENC[AES256_GCM,data:qTxyxEZGn8jlgcqyrUHFX1EgCq2/cwyFEaVr/E5ZCUiSWU30LGM37uedBDkvrQxmnWtlSRBSUaaw5/4eoRMmSg0W1wGGOHAmd+2EbRD8QlplLDALOSVu1/7a+RdFgDjydEczPOR/pWvY/cFkek54DoGAfVkhKdAieQJiXG6DFc8=,iv:2ir8D4uWP8Nw6f1Z9XBZ89CuEZYciUmMu3zPAhcvQw4=,tag:GBYZXjiZBxPkrEWWpcjseA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.11.0
+    version: 3.13.3

hosts/server/shared/default.nix

@@ -1,7 +1,11 @@
 {
   modulesPath,
+  lib,
   ...
 }:
+let
+  inherit (lib) mkDefault;
+in
 {
   imports = [
     "${modulesPath}/virtualisation/proxmox-lxc.nix"
@@ -14,13 +18,13 @@
     getty.autologinUser = "root";
 
     metrics = {
-      enable = true;
+      enable = mkDefault true;
       upgradeStatus = {
-        enable = true;
-        uptimeKuma.enable = true;
+        enable = mkDefault true;
+        uptimeKuma.enable = mkDefault true;
       };
       hacompanion = {
-        enable = true;
+        enable = mkDefault true;
         sensor = {
           cpu_usage.enable = true;
           uptime.enable = true;

modules/nixos/server/database/guardian.nix

@@ -123,9 +123,6 @@ in
     {
       sops.secrets."DB_GUARDIAN_PSK" = {
         sopsFile = "${self}/hosts/server/secrets.yaml";
-        # Compatibility shim: SOPS file still carries old key name IO_GUARDIAN_PSK.
-        # Remove this and rename DB_GUARDIAN_PSK → IO_GUARDIAN_PSK in secrets.yaml when rotated.
-        key = "DB_GUARDIAN_PSK";
       };
     }
 

modules/nixos/server/proxy/options.nix

@@ -31,6 +31,8 @@ in
   options.server.proxy = {
     domain = mkOption {
       type = str;
+      default = getIOPrimaryHostAttr "server.proxy.domain";
+      defaultText = literalExpression "getIOPrimaryHostAttr \"server.proxy.domain\"";
       description = "The base domain for all virtual hosts.";
     };
 

modules/nixos/services/metrics.nix

@@ -12,7 +12,6 @@ let
     flatten
     getExe
     listToAttrs
-    literalExpression
     mapAttrs
     mapAttrsToList
     mkEnableOption
@@ -25,7 +24,6 @@ let
     ;
 
   inherit (lib.types)
-    anything
     attrsOf
     enum
     nullOr
@@ -210,12 +208,6 @@ in
         )
         |> listToAttrs;
 
-      test = mkOption {
-        type = anything;
-        default = hacompanionConfig;
-        defaultText = literalExpression "hacompanionConfig";
-      };
-
       script = mkOption {
         type = attrsOf (submodule {
           options = {
@@ -345,7 +337,7 @@ in
   };
 
   config = mkMerge [
-    (mkIf cfg.hacompanion.enable {
+    (mkIf (cfg.enable && cfg.hacompanion.enable) {
       sops.secrets.HACOMPANION_ENV = {
         sopsFile = "${self}/hosts/secrets.yaml";
       };
@@ -392,7 +384,7 @@ in
 
     })
 
-    (mkIf cfg.upgradeStatus.enable {
+    (mkIf (cfg.enable && cfg.upgradeStatus.enable) {
       services.metrics.hacompanion.script.upgrade_status = {
         name = "NixOS Upgrade Status";
         icon = "mdi:update";
@@ -442,7 +434,7 @@ in
       };
     })
 
-    (mkIf cfg.upgradeStatus.uptimeKuma.enable {
+    (mkIf (cfg.enable && cfg.upgradeStatus.enable && cfg.upgradeStatus.uptimeKuma.enable) {
       sops.secrets.UPGRADE_STATUS_ID = { };
 
       systemd = {