From ae2f6dde41d5ec27f734192e648f6d1efebef94f Mon Sep 17 00:00:00 2001
From: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
Date: Thu, 12 Jun 2025 13:25:43 +0200
Subject: [PATCH] Enable jungle robot emails for Grafana in tent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Aleix Boné <abonerib@bsc.es>
Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es>
---
 m/tent/monitoring.nix             |  16 ++++++++++++++++
 secrets/jungle-robot-password.age | Bin 587 -> 697 bytes
 secrets/secrets.nix               |   2 +-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/m/tent/monitoring.nix b/m/tent/monitoring.nix
index 1bc0208f..e2ffd025 100644
--- a/m/tent/monitoring.nix
+++ b/m/tent/monitoring.nix
@@ -6,6 +6,12 @@
     ../module/upc-qaire-exporter.nix
   ];
 
+  age.secrets.grafanaJungleRobotPassword = {
+    file = ../../secrets/jungle-robot-password.age;
+    owner = "grafana";
+    mode = "400";
+  };
+
   services.grafana = {
     enable = true;
     settings = {
@@ -16,6 +22,16 @@
         http_port = 2342;
         http_addr = "127.0.0.1";
       };
+      smtp = {
+        enabled = true;
+        from_address = "jungle-robot@bsc.es";
+        user = "jungle-robot";
+        # Read the password from a file, which is only readable by grafana user
+        # https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#file-provider
+        password = "$__file{${config.age.secrets.grafanaJungleRobotPassword.path}}";
+        host = "mail.bsc.es:465";
+        startTLS_policy = "NoStartTLS";
+      };
       feature_toggles.publicDashboards = true;
       "auth.anonymous".enabled = true;
       log.level = "warn";
diff --git a/secrets/jungle-robot-password.age b/secrets/jungle-robot-password.age
index af68a1b2dbc1f8ac9bb13b277a4174375cfdf0ea..a25102e933510c475bfb6ad9eef0c05adad3e44c 100644
GIT binary patch
delta 626
zcmX@jvXga!PQ5`%fpe5;rKhp6WkGs?w|j=MhnGciUUr6ej&FWtWTtnJVQ#)*a#?n+
z0heo7Sb>*CUS+v{xTTYsX-K)LrDv9xvuQw*Noin&sgHYJRX}o@enx1q0hg|wLUD11
zZfc5=si~o*g1f0tglV}#WTK0scdDafX<mMAZn#;YS-o~fNLEo+Vq!|JlcBl4yM<+m
zp-Y8+h-sAxSBY0dN^)kVQ%IF%n6^P)nqjfKW41|IaE^a^TB>V$k#~`HzKfT>Nn&L&
zx^>Qu;qE4Z3Yq%J1-{AtiBSa}=81*n#X<UMQJG;rmd-_~K9(uj*`{u$roome5k-Mc
zkzA#r7Vf5o1->2z29@QBo?(&Nj#XI&nT1t}d7+U7d6tfTL5WGF>A?|6t`k3shr5Ji
zMik~bR~c6MrC0itScH}3`DcguxRj?Q8WegJggOP5TlyC37kYR&a+P~$1xH5uhq`)Y
z2V@pkgqZpIg&U^kM`mklyE+#Y8)hb1mbykp6gvh+PL5|3ulLF=^D1_&2oDH1Niqux
zF*C}oG6^qEt}u5ku5<|qOS3d|v@9sL)Gp5O<uWtRii*su@G1y&%*YE0&kOO7DAsl^
zH8C+w334uQsq%DpFEFf#EOj$3=F-*GRS3*YDXR)H4=fA{s0cPp^GLQR3epd7iK_6k
zDAjff^L7j?3v;zd_VvjqOy>I0!nFIptNW~adG0@fHa}nd>R#%dvqh3ER7Y^_lb@fW
zb@%Q$v`cCQyG>~FtknLd&41qZyqI_5^X4{9wuXzWPurBz)}Nks>xJaDs6*<`09cFL
Ad;kCd

delta 496
zcmdnVdYWZ|PPkWKrg3FvRbFC-yP=0+WwC{6P>MlbdcM1HK~+&jiBooYd8T%xv$lJ1
zI#-xSdSXUJMW%mNZkl0bx_(NQNn}Y>fqSt@dO(Otv7w23hGB?)WT~%r<iwBS;V!}9
zhNh_oMX4USmU(6dMWJ5qMc#%P+J=#48383uM%k%li3Z7)X0EP|T!zNMx!#5)$!VrZ
z1*U}&KG{azuI`RWQAGh!1<BfxWnRHqRfXmzktN|4lj9l1!-K-IEkeS*ipxCnw9P|J
z%1w+StK3rkj7^NZ1KmO+63fgDoh&?qbNwSMxJr{O&B_AJf{b!1^)oD!BaCxg1DyiQ
zsv>hki%a#h%|dd`%p6Su-AzpmCZA;#uQy8!D2vST3GoSc4=cAc%gZqd3^z?QHuOlW
zN(`{@%rDDMO-ZZB3-PZ^<}x>qtnkS7^f2(PD$x$kFe}LkD|0qC%y!Oq3-R>NPA<zf
zcT9CQiSP>b<<iyFRY)z(D^CpzO>_5ita9-&$SHOV^bIL6%y4lkFif+EOw7&q4fA#`
z$}BO9%;%c$rs<g2r#TEcX{)N1DKz?@J`rGW>dB^^emnabr5U}QPG2_k(Nsw`-#+nk
n%mx!{UBg4(9X)#=D6i9$X`H6Iu2ypLFVPYu5tr)tQ^qd<Rxzwk

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 9f2b8832..450c8282 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -12,7 +12,7 @@ in
   "gitlab-runner-shell-token.age".publicKeys = hut;
   "gitlab-bsc-docker-token.age".publicKeys = hut;
   "nix-serve.age".publicKeys = mon;
-  "jungle-robot-password.age".publicKeys = hut;
+  "jungle-robot-password.age".publicKeys = mon;
   "ipmi.yml.age".publicKeys = mon;
 
   "ceph-user.age".publicKeys = safe;