feat(monitoring): cloudflared metrics

modules/nixos/cloudflared.nix

@@ -1,38 +1,67 @@
-{
+let
+  tunnelModule = {pkgs, config, lib, ...}: let
+    inherit (lib.options) mkOption mkEnableOption;
+    settingsFormat = pkgs.formats.json {};
+  in {
+    options = with lib.types; {
+      extraArgs = mkOption {
+        type = listOf str;
+        default = [];
+      };
+      extraTunnel = {
+        enable =
+          mkEnableOption "extra tunnels"
+          // {
+            default = config.extraTunnel.ingress != {};
+          };
+        ingress = mkOption {
+          inherit (settingsFormat) type;
+          default = {};
+        };
+      };
+    };
+  };
+in {
   pkgs,
   config,
   utils,
+  gensokyo-zone,
   lib,
   ...
 }: let
   inherit (lib.attrsets) mapAttrsToList mapAttrs' nameValuePair filterAttrsRecursive;
   inherit (lib.lists) singleton;
   inherit (lib.modules) mkIf mkMerge mkForce;
-  inherit (lib.options) mkOption mkEnableOption;
+  inherit (lib.options) mkOption;
   cfg = config.services.cloudflared;
-  settingsFormat = pkgs.formats.json {};
 in {
   options.services.cloudflared = with lib.types; {
-    tunnels = let
-      tunnelModule = {config, ...}: {
-        options = {
-          extraTunnel = {
-            enable =
-              mkEnableOption "extra tunnels"
-              // {
-                default = config.extraTunnel.ingress != {};
-              };
-            ingress = mkOption {
-              inherit (settingsFormat) type;
-              default = {};
-            };
-          };
+    metricsPort = mkOption {
+      type = nullOr port;
+      default = null;
+    };
+    metricsBind = mkOption {
+      type = str;
+      default = "127.0.0.1";
+    };
+    extraArgs = mkOption {
+      type = listOf str;
+      default = [];
+    };
+    tunnels = mkOption {
+      type = attrsOf (submoduleWith {
+        modules = [tunnelModule];
+        shorthandOnlyDefinesConfig = true;
+        specialArgs = {
+          inherit pkgs utils gensokyo-zone;
         };
-      };
-    in
-      mkOption {
-        type = attrsOf (submodule tunnelModule);
-      };
+      });
+    };
+  };
+  config.services.cloudflared = {
+    extraArgs = mkIf (cfg.metricsPort != null) [
+      "--metrics" "${cfg.metricsBind}:${toString cfg.metricsPort}"
+    ];
   };
   config.systemd.services = let
     filterConfig = filterAttrsRecursive (_: v: ! builtins.elem v [null [] {}]);
@@ -44,29 +73,38 @@ in {
   in
     mkIf cfg.enable (mapAttrs' (uuid: tunnel: let
       RuntimeDirectory = "cloudflared-tunnel-${uuid}";
-      configPath = "/run/${RuntimeDirectory}/config.yml";
       settings = {
         tunnel = uuid;
         credentials-file = tunnel.credentialsFile;
+        warp-routing = filterConfig tunnel.warp-routing;
+        originRequest = filterConfig tunnel.originRequest;
         ingress =
           mapAttrsToList mapIngress tunnel.ingress
           ++ mapAttrsToList mapIngress tunnel.extraTunnel.ingress
           ++ singleton {service = tunnel.default;};
       };
+      configPath =
+        if tunnel.extraTunnel.enable
+        then "/run/${RuntimeDirectory}/config.yml"
+        else pkgs.writeText "cloudflared.yml" (builtins.toJSON settings);
+      args = [
+        "--config=${configPath}"
+        "--no-autoupdate"
+      ] ++ cfg.extraArgs ++ tunnel.extraArgs;
     in
       nameValuePair "cloudflared-tunnel-${uuid}" (mkMerge [
         {
           after = mkIf config.services.tailscale.enable ["tailscale-autoconnect.service"];
           serviceConfig = {
             RestartSec = 10;
+            ExecStart = mkForce [
+              "${cfg.package}/bin/cloudflared tunnel ${utils.escapeSystemdExecArgs args} run"
+            ];
           };
         }
         (mkIf tunnel.extraTunnel.enable {
           serviceConfig = {
             inherit RuntimeDirectory;
-            ExecStart = mkForce [
-              "${cfg.package}/bin/cloudflared tunnel --config=${configPath} --no-autoupdate run"
-            ];
             ExecStartPre = [
               (pkgs.writeShellScript "cloudflared-tunnel-${uuid}-prepare" ''
                 ${utils.genJqSecretsReplacementSnippet settings configPath}