fix(aquamarine): repair monitoring config

Load both *.yml and *.yaml alert rule files: the Loki rules were named .yaml while only *.yml was loaded, so they silently never ran. Fix the Grafana domain typo (writefo.fun -> writefor.fun). Comment out the postgres-playground datasource, which used the Grafana admin password for a role that has no password and could never authenticate.

hosts/idols-aquamarine/grafana/datasources.nix

@@ -88,6 +88,11 @@
         };
         editable = false;
       }
+      # Disabled: the `playground` role has no password and remote logins
+      # require scram-sha-256, so this datasource could never authenticate.
+      # Re-enable once a `playground` DB password is provisioned
+      # (docs/system-audit-2026-09-19.md, item 1.5).
+      /*
         {
           # https://grafana.com/docs/grafana/latest/datasources/postgres/configure/
           name = "postgres-playground";
@@ -95,7 +100,7 @@
           url = "postgres.writefor.fun:5432";
           user = "playground";
           secureJsonData = {
-          password = "$__file{${config.age.secrets."grafana-admin-password".path}}";
+            password = "$__file{${config.age.secrets."postgres-playground-password".path}}";
           };
           jsonData = {
             database = "playground";
@@ -113,6 +118,7 @@
           };
           editable = false;
         }
+      */
       {
         name = "infinity-dataviewer";
         type = "yesoreyeram-infinity-datasource";

hosts/idols-aquamarine/grafana/default.nix

@@ -20,7 +20,7 @@
         http_addr = "127.0.0.1";
         http_port = 3351;
         protocol = "http";
-        domain = "grafana.writefo.fun";
+        domain = "grafana.writefor.fun";
         # Redirect to correct domain if the host header does not match the domain. Prevents DNS rebinding attacks.
         serve_from_sub_path = false;
         # Add subpath to the root_url if serve_from_sub_path is true

hosts/idols-aquamarine/monitoring/alert.nix

@@ -20,7 +20,9 @@
       # Path to the files with alerting and/or recording rules.
       rule = [
         "${./alert_rules}/*.yml"
+        "${./alert_rules}/*.yaml"
         "${./recoding_rules}/*.yml"
+        "${./recoding_rules}/*.yaml"
       ];
       # https://docs.victoriametrics.com/victoriametrics/vmalert/#link-to-alert-source
       # Set this two args to generate the correct `.GeneratorURL`