From 72857eab9f577157ca606015cec5861ba104b63f Mon Sep 17 00:00:00 2001
From: "PAEPCKE, Michael" <git@paepcke.de>
Date: Fri, 4 Apr 2025 07:19:56 +0000
Subject: [PATCH] prometheus-tibber-exporter: init tibber nixos module
 integration

---
 .../monitoring/prometheus/exporters.nix       |  1 +
 .../prometheus/exporters/tibber.nix           | 44 +++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 nixos/modules/services/monitoring/prometheus/exporters/tibber.nix

diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index caf7afcc1e07..fd3a66b0eac4 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -122,6 +122,7 @@ let
         "statsd"
         "surfboard"
         "systemd"
+        "tibber"
         "unbound"
         "unpoller"
         "v2ray"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/tibber.nix b/nixos/modules/services/monitoring/prometheus/exporters/tibber.nix
new file mode 100644
index 000000000000..670f23a54d20
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/tibber.nix
@@ -0,0 +1,44 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.prometheus.exporters.tibber;
+  inherit (lib) mkOption types concatStringsSep;
+in
+{
+  port = 9489;
+  extraOpts = {
+    apiTokenPath = mkOption {
+      type = types.path;
+      default = null;
+      description = ''
+        Add here the path to your personal Tibber API Token ('Bearer Token') File.
+        Get your personal Tibber API Token here: https://developer.tibber.com
+        Do not share your personal plaintext Tibber API Token via github. (see: ryantm/agenix, mic92/sops)
+      '';
+    };
+  };
+  serviceOpts = {
+    script = ''
+      export TIBBER_TOKEN="$(cat ${toString cfg.apiTokenPath})"
+      exec ${pkgs.prometheus-tibber-exporter}/bin/tibber-exporter --listen-address ${cfg.listenAddress}:${toString cfg.port} ${concatStringsSep " \\\n  " cfg.extraFlags}
+    '';
+    serviceConfig = {
+      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      ProtectSystem = "strict";
+      Restart = "on-failure";
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+      ];
+      RestrictNamespaces = true;
+      User = "prometheus"; # context needed to runtime access encrypted token and secrets
+    };
+  };
+}