feat(glyph): add Grafana MCP server

hosts/glyph/secrets/grafana-mcp-token.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 rSr+rA 2Srq6rfOwBrjWpUlzypP2OQZXTXLBgQ3UY/zLPnfLlA
+kw3ptb5pp41bbtAgOQj2tlZTgGO4DsXrqovZRz/elac
+-> ssh-ed25519 3EWhnQ +4wBGx4XFGGvVUVc7ymy/3Tm7cGDFJqdoNCVJ7swYVY
+6iXVQvvkSNMpzJDhPJgyHmH6XBVuiYqQkP4rSrfIo1s
+--- UtH+GQsYUU8aLukR55hOUHfFUahVmUp6l6XZoCk17rk
+ZˆnRÃÎ:8¦›Â=>T€gÉ¡vÛž/3•{ds >"H·¸–à"€H„¼PÇñBÚ¹8~¤Á ʠ)×òJ¯r(#¯n¼•§<z5Ä7öÿ}É tz5Fò¦šßúYYx|¾¥<Õ

hosts/glyph/services/default.nix

@@ -78,6 +78,13 @@
     mode = "440";
   };
 
+  age.secrets.grafana-mcp-token = {
+    file = ./../secrets/grafana-mcp-token.age;
+    mode = "440";
+    owner = "grafana-mcp";
+    group = "grafana-mcp";
+  };
+
   age.secrets.graphite-auth-token = {
     file = ./../secrets/graphite-auth-token.age;
     mode = "440";
@@ -100,6 +107,11 @@
     enable = true;
     environmentFile = config.age.secrets.kagi-api-key.path;
   };
+  services.grafana-mcp = {
+    enable = true;
+    grafanaUrl = "https://grafana.zx.dev";
+    tokenFile = config.age.secrets.grafana-mcp-token.path;
+  };
   services.graphite-mcp = {
     enable = true;
     authTokenFile = config.age.secrets.graphite-auth-token.path;
@@ -118,6 +130,10 @@
       url = "http://127.0.0.1:8093/mcp";
       description = "Kagi web search and page summarization";
     };
+    servers.grafana = {
+      url = "http://127.0.0.1:8095/mcp";
+      description = "Grafana dashboards, Loki logs, and Prometheus metrics";
+    };
     servers.graphite = {
       url = "http://127.0.0.1:8094/mcp";
       description = "Graphite CLI for stacked PRs and code review";

lib/secrets/glyph.nix

@@ -9,6 +9,7 @@ in {
   "hosts/glyph/secrets/open-terminal-env.age".publicKeys = keys;
   "hosts/glyph/secrets/open-webui-api-key.age".publicKeys = keys;
   "hosts/glyph/secrets/open-webui-env.age".publicKeys = keys;
+  "hosts/glyph/secrets/grafana-mcp-token.age".publicKeys = keys;
   "hosts/glyph/secrets/graphite-auth-token.age".publicKeys = keys;
   "hosts/glyph/secrets/attic-credentials.age".publicKeys = keys;
 }

modules/nixos/llm/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./basic-memory.nix
+    ./grafana-mcp.nix
     ./graphite-mcp.nix
     ./kagi.nix
     ./mcp-nixos.nix

modules/nixos/llm/grafana-mcp.nix

@@ -0,0 +1,91 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.services.grafana-mcp;
+
+  startScript = pkgs.writeShellScript "grafana-mcp-start" ''
+    exec ${lib.getExe pkgs.mcp-proxy} \
+      --host ${cfg.host} \
+      --port ${toString cfg.port} \
+      --transport streamablehttp \
+      -- ${lib.getExe pkgs.mcp-grafana}
+  '';
+in {
+  options.services.grafana-mcp = {
+    enable = lib.mkEnableOption "Grafana MCP server (stdio→HTTP bridge)";
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8095;
+      description = "Port for the streamable HTTP transport.";
+    };
+
+    host = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Address to bind the HTTP server to.";
+    };
+
+    grafanaUrl = lib.mkOption {
+      type = lib.types.str;
+      description = "URL of the Grafana instance to connect to.";
+    };
+
+    tokenFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to file containing the Grafana service account token.";
+    };
+
+    openFirewall = lib.mkEnableOption "opening firewall ports for Grafana MCP";
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.grafana-mcp = {
+      isSystemUser = true;
+      group = "grafana-mcp";
+      home = "/var/lib/grafana-mcp";
+    };
+    users.groups.grafana-mcp = {};
+
+    systemd.services.grafana-mcp = {
+      description = "Grafana MCP Server";
+      after = ["network-online.target"];
+      wants = ["network-online.target"];
+      wantedBy = ["multi-user.target"];
+
+      environment = {
+        HOME = "/var/lib/grafana-mcp";
+        GRAFANA_URL = cfg.grafanaUrl;
+      };
+
+      serviceConfig = {
+        ExecStart = "${startScript}";
+        User = "grafana-mcp";
+        Group = "grafana-mcp";
+        WorkingDirectory = "/var/lib/grafana-mcp";
+        StateDirectory = "grafana-mcp";
+        EnvironmentFile = cfg.tokenFile;
+        Restart = "on-failure";
+        RestartSec = 5;
+
+        # Hardening
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectHome = "tmpfs";
+        BindPaths = ["/var/lib/grafana-mcp"];
+        ProtectSystem = "strict";
+        ReadWritePaths = ["/var/lib/grafana-mcp"];
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictSUIDSGID = true;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [cfg.port];
+  };
+}