feat(monitoring): scrape the restic rest-server

Expose /metrics on the loopback-bound server, scrape it with
victoriametrics, and block /metrics on the public vhost.

hosts/12kingdoms-youko/default.nix

@@ -73,6 +73,10 @@ in
     dataDir = "/data/backups/rest-server";
     privateRepos = true;
     "htpasswd-file" = config.age.secrets."restic-rest-htpasswd".path;
+    # expose /metrics for victoriametrics; unauthenticated is fine because the
+    # server only listens on loopback
+    prometheus = true;
+    extraFlags = [ "--prometheus-no-auth" ];
   };
 
   # repositories live on the HDD, which has to be mounted first

hosts/12kingdoms-youko/homelab-services/caddy.nix

@@ -66,6 +66,9 @@ in
     # the restic REST server the backup clients push to
     virtualHosts."restic.writefor.fun".extraConfig = ''
       ${hostCommonConfig}
+      # metrics are scraped over loopback only, never through this vhost
+      @metrics path /metrics
+      respond @metrics 403
       reverse_proxy http://localhost:8000
     '';
     # Every other name is not a service on this host: answer 404 instead of

hosts/12kingdoms-youko/homelab-services/monitoring/victoriametrics.nix

@@ -77,6 +77,22 @@ in
           }
         */
 
+        {
+          job_name = "restic-rest-server";
+          scrape_interval = "60s";
+          metrics_path = "/metrics";
+          static_configs = [
+            {
+              # same-host rest-server bound to loopback (127.0.0.1:8000)
+              targets = [ "127.0.0.1:8000" ];
+              labels.type = "app";
+              labels.app = "restic";
+              labels.host = "youko";
+              labels.env = "homelab";
+              labels.cluster = "homelab";
+            }
+          ];
+        }
         {
           job_name = "v2ray-exporter";
           scrape_interval = "30s";