From d78f6badd402ee99f56a080c6fc85f1e1dd32e07 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Sat, 19 Sep 2026 12:11:07 +0800
Subject: [PATCH] fix(aquamarine): repair monitoring config

Load both *.yml and *.yaml alert rule files: the Loki rules were named .yaml while only *.yml was loaded, so they silently never ran. Fix the Grafana domain typo (writefo.fun -> writefor.fun). Comment out the postgres-playground datasource, which used the Grafana admin password for a role that has no password and could never authenticate.
---
 .../idols-aquamarine/grafana/datasources.nix  | 56 ++++++++++---------
 hosts/idols-aquamarine/grafana/default.nix    |  2 +-
 hosts/idols-aquamarine/monitoring/alert.nix   |  2 +
 3 files changed, 34 insertions(+), 26 deletions(-)

diff --git a/hosts/idols-aquamarine/grafana/datasources.nix b/hosts/idols-aquamarine/grafana/datasources.nix
index 2f70fc19..0451baf7 100644
--- a/hosts/idols-aquamarine/grafana/datasources.nix
+++ b/hosts/idols-aquamarine/grafana/datasources.nix
@@ -88,31 +88,37 @@
         };
         editable = false;
       }
-      {
-        # https://grafana.com/docs/grafana/latest/datasources/postgres/configure/
-        name = "postgres-playground";
-        type = "postgres";
-        url = "postgres.writefor.fun:5432";
-        user = "playground";
-        secureJsonData = {
-          password = "$__file{${config.age.secrets."grafana-admin-password".path}}";
-        };
-        jsonData = {
-          database = "playground";
-          sslmode = "verify-full"; # disable/require/verify-ca/verify-full
-          maxOpenConns = 50;
-          maxIdleConns = 250;
-          maxIdleConnsAuto = true;
-          connMaxLifetime = 14400;
-          timeInterval = "1m";
-          timescaledb = false;
-          postgresVersion = 1500; # 15.xx
-          # tls
-          tlsConfigurationMethod = "file-path";
-          sslRootCertFile = ../../../certs/ecc-ca.crt;
-        };
-        editable = false;
-      }
+      # Disabled: the `playground` role has no password and remote logins
+      # require scram-sha-256, so this datasource could never authenticate.
+      # Re-enable once a `playground` DB password is provisioned
+      # (docs/system-audit-2026-09-19.md, item 1.5).
+      /*
+        {
+          # https://grafana.com/docs/grafana/latest/datasources/postgres/configure/
+          name = "postgres-playground";
+          type = "postgres";
+          url = "postgres.writefor.fun:5432";
+          user = "playground";
+          secureJsonData = {
+            password = "$__file{${config.age.secrets."postgres-playground-password".path}}";
+          };
+          jsonData = {
+            database = "playground";
+            sslmode = "verify-full"; # disable/require/verify-ca/verify-full
+            maxOpenConns = 50;
+            maxIdleConns = 250;
+            maxIdleConnsAuto = true;
+            connMaxLifetime = 14400;
+            timeInterval = "1m";
+            timescaledb = false;
+            postgresVersion = 1500; # 15.xx
+            # tls
+            tlsConfigurationMethod = "file-path";
+            sslRootCertFile = ../../../certs/ecc-ca.crt;
+          };
+          editable = false;
+        }
+      */
       {
         name = "infinity-dataviewer";
         type = "yesoreyeram-infinity-datasource";
diff --git a/hosts/idols-aquamarine/grafana/default.nix b/hosts/idols-aquamarine/grafana/default.nix
index df5c0ec4..4492eeb9 100644
--- a/hosts/idols-aquamarine/grafana/default.nix
+++ b/hosts/idols-aquamarine/grafana/default.nix
@@ -20,7 +20,7 @@
         http_addr = "127.0.0.1";
         http_port = 3351;
         protocol = "http";
-        domain = "grafana.writefo.fun";
+        domain = "grafana.writefor.fun";
         # Redirect to correct domain if the host header does not match the domain. Prevents DNS rebinding attacks.
         serve_from_sub_path = false;
         # Add subpath to the root_url if serve_from_sub_path is true
diff --git a/hosts/idols-aquamarine/monitoring/alert.nix b/hosts/idols-aquamarine/monitoring/alert.nix
index 00c6de36..ef5deee5 100644
--- a/hosts/idols-aquamarine/monitoring/alert.nix
+++ b/hosts/idols-aquamarine/monitoring/alert.nix
@@ -20,7 +20,9 @@
       # Path to the files with alerting and/or recording rules.
       rule = [
         "${./alert_rules}/*.yml"
+        "${./alert_rules}/*.yaml"
         "${./recoding_rules}/*.yml"
+        "${./recoding_rules}/*.yaml"
       ];
       # https://docs.victoriametrics.com/victoriametrics/vmalert/#link-to-alert-source
       # Set this two args to generate the correct `.GeneratorURL`