chore: split nixos and opentofu

nixos/modules/common/monitoring.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Prometheus Node Exporter for hardware metrics
+  services.prometheus.exporters = {
+    node = {
+      enable = true;
+      enabledCollectors = [ "systemd" ];
+      port = 9100;
+    };
+  };
+
+  # Promtail to ship logs to Loki
+  services.promtail = {
+    enable = true;
+    configuration = {
+      server = {
+        http_listen_port = 28183;
+        grpc_listen_port = 0;
+      };
+      positions = {
+        filename = "/tmp/positions.yaml";
+      };
+      clients = [{
+        # Use the internal DNS name for the Loki ingress
+        url = "http://loki.lab.depeuter.dev/loki/api/v1/push";
+      }];
+      scrape_configs = [{
+        job_name = "journal";
+        journal = {
+          max_age = "12h";
+          labels = {
+            job = "systemd-journal";
+            host = config.networking.hostName;
+          };
+        };
+        relabel_configs = [{
+          source_labels = [ "__journal__systemd_unit" ];
+          target_label = "unit";
+        }];
+      }];
+    };
+  };
+
+  # Open firewall ports for node-exporter so Prometheus can scrape it
+  networking.firewall.allowedTCPPorts = [ 9100 ];
+}