From 0df6c52026a2adc58e1adff0baedbfc35c818f2b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 13 Oct 2022 10:28:29 +0200
Subject: [PATCH] nixos/grafana: ensure that declarative prometheus
 data-sources don't use direct access

Support for that was permanently dropped in Grafana 9.2.0, see also
https://github.com/grafana/grafana/commit/f30795b0884dd3485423a12d7d7d0860453967a7
---
 nixos/modules/services/monitoring/grafana.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index fd3418b8f6bd..15ca11a2e164 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -720,6 +720,12 @@ in {
         assertion = cfg.smtp.password != opt.smtp.password.default -> cfg.smtp.passwordFile == null;
         message = "Cannot set both password and passwordFile";
       }
+      {
+        assertion = all
+          ({ type, access, ... }: type == "prometheus" -> access != "direct")
+          cfg.provision.datasources;
+        message = "For datasources of type `prometheus`, the `direct` access mode is not supported anymore (since Grafana 9.2.0)";
+      }
     ];
 
     systemd.services.grafana = {