nixos/prometheus-exporters/yace: init

Assisted-by: Claude Code (Claude Opus 4.8)

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -110,6 +110,8 @@
 
 - [Rundeck](https://www.rundeck.com), Self-Service Operations [services.rundeck](#opt-services.rundeck.enable).
 
+- [yet-another-cloudwatch-exporter](https://github.com/prometheus-community/yet-another-cloudwatch-exporter), a Prometheus exporter for AWS CloudWatch metrics. Available as [services.prometheus.exporters.yace](#opt-services.prometheus.exporters.yace.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -135,6 +135,7 @@ let
         "varnish"
         "wireguard"
         "xray"
+        "yace"
         "zfs-siebenmann"
         "zfs"
       ]

nixos/modules/services/monitoring/prometheus/exporters/yace.nix

@@ -0,0 +1,59 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.yace;
+  inherit (lib)
+    mkIf
+    mkOption
+    types
+    escapeShellArg
+    concatStringsSep
+    getExe
+    ;
+in
+{
+  port = 5000;
+  extraOpts = {
+    configFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to the YACE configuration file, defining which CloudWatch
+        metrics to scrape. See
+        <https://github.com/prometheus-community/yet-another-cloudwatch-exporter#configuration>
+        for the format. AWS credentials are supplied separately via the
+        environment (see {option}`environmentFile`, an IMDS instance role,
+        or the usual `AWS_*` variables).
+      '';
+    };
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/yace.env";
+      description = ''
+        Path to an environment file, as defined in {manpage}`systemd.exec(5)`,
+        used to pass AWS credentials (e.g. `AWS_ACCESS_KEY_ID`,
+        `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`) to the exporter without exposing
+        them in the world-readable Nix store. Not needed on EC2 with an IMDS
+        instance role.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+      ExecStart = concatStringsSep " " (
+        [
+          (getExe pkgs.yet-another-cloudwatch-exporter)
+          "--config.file ${escapeShellArg cfg.configFile}"
+          "--listen-address ${cfg.listenAddress}:${toString cfg.port}"
+        ]
+        ++ cfg.extraFlags
+      );
+    };
+  };
+}

nixos/tests/prometheus-exporters.nix

@@ -2141,6 +2141,30 @@ let
         '';
       };
 
+    yace =
+      { pkgs, ... }:
+      {
+        exporterConfig = {
+          enable = true;
+          configFile = pkgs.writeText "yace-config.yml" ''
+            apiVersion: v1alpha1
+            sts-region: us-east-1
+            discovery:
+              jobs:
+                - type: AWS/EC2
+                  regions: [us-east-1]
+                  metrics:
+                    - name: CPUUtilization
+                      statistics: [Average]
+          '';
+        };
+        exporterTest = ''
+          wait_for_unit("prometheus-yace-exporter.service")
+          wait_for_open_port(5000)
+          succeed("curl -sSf http://localhost:5000/metrics")
+        '';
+      };
+
     zfs =
       { ... }:
       {