From fd1fb7b56a92e26db0c749695688d86c2096e0f5 Mon Sep 17 00:00:00 2001
From: wizzdom <dom@wizzdom.xyz>
Date: Wed, 26 Feb 2025 04:20:49 +0000
Subject: [PATCH 1/9] monitoring: add grafana

---
 jobs/monitoring/grafana.hcl | 95 +++++++++++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)
 create mode 100644 jobs/monitoring/grafana.hcl

diff --git a/jobs/monitoring/grafana.hcl b/jobs/monitoring/grafana.hcl
new file mode 100644
index 0000000..2d76bc1
--- /dev/null
+++ b/jobs/monitoring/grafana.hcl
@@ -0,0 +1,95 @@
+job "grafana" {
+  datacenters = ["aperture"]
+
+  type = "service"
+
+  group "monitoring" {
+    network {
+      port "http" {
+        to = 3000
+      }
+      port "db" {
+        to = 5432
+      }
+    }
+
+    service {
+      name = "grafana"
+      port = "http"
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.grafana.entrypoints=web,websecure",
+        "traefik.http.routers.grafana.rule=Host(`grafana.redbrick.dcu.ie`)",
+        "traefik.http.routers.grafana.tls=true",
+        "traefik.http.routers.grafana.tls.certresolver=lets-encrypt",
+      ]
+    }
+
+    task "grafana" {
+      driver = "docker"
+      user   = "1001:1001"
+
+      env {
+        GF_AUTH_BASIC_ENABLED = "true"
+        GF_INSTALL_PLUGINS    = "grafana-piechart-panel"
+        GF_SERVER_ROOT_URL    = "https://grafana.redbrick.dcu.ie"
+      }
+
+      config {
+        image = "grafana/grafana"
+        ports = ["http"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/grafana"
+        ]
+      }
+
+
+      template {
+        data        = <<EOH
+GF_DATABASE_TYPE=postgres
+GF_DATABASE_HOST={{ env "NOMAD_ADDR_db" }}
+GF_DATABASE_NAME={{ key "grafana/db/name" }}
+GF_DATABASE_USER={{ key "grafana/db/user" }}
+GF_DATABASE_PASSWORD={{ key "grafana/db/password" }}
+GF_FEATURE_TOGGLES_ENABLE=publicDashboards
+GF_LOG_LEVEL=debug
+EOH
+        destination = "local/.env"
+        env         = true
+      }
+    }
+    task "db" {
+      driver = "docker"
+
+      config {
+        image = "postgres:17-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/postgresql/data",
+        ]
+      }
+
+      template {
+        data        = <<EOH
+POSTGRES_PASSWORD={{ key "grafana/db/password" }}
+POSTGRES_USER={{ key "grafana/db/user" }}
+POSTGRES_NAME={{ key "grafana/db/name" }}
+EOH
+        destination = "local/db.env"
+        env         = true
+      }
+    }
+  }
+}
+
+

From 35b8082b3bd14b6eeb5d9b41b7886e7814d9816d Mon Sep 17 00:00:00 2001
From: wizzdom <dom@wizzdom.xyz>
Date: Wed, 26 Feb 2025 04:21:12 +0000
Subject: [PATCH 2/9] monitoring: add prometheus

---
 jobs/monitoring/prometheus.hcl | 87 ++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 jobs/monitoring/prometheus.hcl

diff --git a/jobs/monitoring/prometheus.hcl b/jobs/monitoring/prometheus.hcl
new file mode 100644
index 0000000..764673a
--- /dev/null
+++ b/jobs/monitoring/prometheus.hcl
@@ -0,0 +1,87 @@
+job "prometheus" {
+  datacenters = ["aperture"]
+
+  group "prometheus" {
+    network {
+      port "http" {
+        static = 9090
+      }
+    }
+
+    service {
+      name = "prometheus"
+      port = "http"
+    }
+
+    task "prometheus" {
+      driver = "docker"
+      config {
+        image = "quay.io/prometheus/prometheus"
+        ports = ["http"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/prometheus"
+        ]
+
+        args = [
+          "--config.file=$${NOMAD_TASK_DIR}/prometheus.yml",
+          "--log.level=info",
+          "--storage.tsdb.retention.time=90d",
+          "--storage.tsdb.path=/prometheus",
+          "--web.console.libraries=/usr/share/prometheus/console_libraries",
+          "--web.console.templates=/usr/share/prometheus/consoles"
+        ]
+      }
+
+      template {
+        data = <<EOF
+global:
+  scrape_interval: 10s
+  evaluation_interval: 10s
+
+scrape_configs:
+
+- job_name: 'nomad_metrics'
+  consul_sd_configs:
+  - server: '{{ env "attr.unique.network.ip-address" }}:8500'
+    services: ['nomad-client', 'nomad']
+
+  relabel_configs:
+  - source_labels: ['__meta_consul_tags']
+    regex: '(.*)http(.*)'
+    action: keep
+  - source_labels: ['__meta_consul_node']
+    target_label: 'node'
+    # If nomad is available on multiple IPs, drop the ones which are not scrapable
+  - source_labels: ['__address__']
+    regex: '172(.*)'
+    action: drop
+
+  metrics_path: /v1/metrics
+  params:
+    format: ['prometheus']
+
+- job_name: 'application_metrics'
+  consul_sd_configs:
+  - server: '{{ env "attr.unique.network.ip-address" }}:8500'
+
+  relabel_configs:
+  - source_labels: ['__meta_consul_service']
+    regex: 'nomad|nomad-client|consul'
+    action: drop
+    # Drop services which do not want to be scraped.
+    # Typically used when a job does not expose prometheus metrics.
+  - source_labels: ['__meta_consul_tags']
+    regex: '.*prometheus.io/scrape=false.*'
+    action: 'drop'
+  - source_labels: ['__meta_consul_node']
+    target_label: 'node'
+  - source_labels: ['__meta_consul_service']
+    target_label: 'service'
+EOF
+
+        destination = "local/prometheus.yml"
+      }
+    }
+  }
+}

From a0e58b77896770808a5f0a176877d10ca3151ccc Mon Sep 17 00:00:00 2001
From: Gavin Holahan <gholahan9@gmail.com>
Date: Fri, 28 Feb 2025 01:09:05 +0000
Subject: [PATCH 3/9] Removed Static, added better prom .yml

---
 jobs/monitoring/prometheus.hcl | 76 ++++++++++++++--------------------
 1 file changed, 30 insertions(+), 46 deletions(-)

diff --git a/jobs/monitoring/prometheus.hcl b/jobs/monitoring/prometheus.hcl
index 764673a..6ffa3af 100644
--- a/jobs/monitoring/prometheus.hcl
+++ b/jobs/monitoring/prometheus.hcl
@@ -1,87 +1,71 @@
 job "prometheus" {
   datacenters = ["aperture"]
+  type = "service"
 
   group "prometheus" {
+    count = 1
+
     network {
       port "http" {
-        static = 9090
+        to = 9090
       }
     }
 
-    service {
-      name = "prometheus"
-      port = "http"
-    }
-
     task "prometheus" {
       driver = "docker"
+
       config {
-        image = "quay.io/prometheus/prometheus"
+        image = "prom/prometheus:latest"
         ports = ["http"]
 
         volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/prometheus"
-        ]
-
-        args = [
-          "--config.file=$${NOMAD_TASK_DIR}/prometheus.yml",
-          "--log.level=info",
-          "--storage.tsdb.retention.time=90d",
-          "--storage.tsdb.path=/prometheus",
-          "--web.console.libraries=/usr/share/prometheus/console_libraries",
-          "--web.console.templates=/usr/share/prometheus/consoles"
+          "local/prometheus.yml:/etc/prometheus/prometheus.yml"
         ]
       }
 
       template {
+        destination = "local/prometheus.yml"
         data = <<EOF
 global:
   scrape_interval: 10s
   evaluation_interval: 10s
 
 scrape_configs:
-
 - job_name: 'nomad_metrics'
   consul_sd_configs:
-  - server: '{{ env "attr.unique.network.ip-address" }}:8500'
-    services: ['nomad-client', 'nomad']
+    - server: 'consul.service.consul:8500'
+      services: ['nomad-client', 'nomad'] # This allows for Client (Workload) and Server (Orchastration) metrics
+      tags: ['http']
+
+  metrics_path: /v1/metrics
+  params:
+    format: ['prometheus']
 
+- job_name: 'container-metrics'
+  consul_sd_configs:
+  - server: 'consul.service.consul:8500'
+    tags: ['prometheus.enable=true']
   relabel_configs:
-  - source_labels: ['__meta_consul_tags']
-    regex: '(.*)http(.*)'
-    action: keep
-  - source_labels: ['__meta_consul_node']
-    target_label: 'node'
-    # If nomad is available on multiple IPs, drop the ones which are not scrapable
-  - source_labels: ['__address__']
-    regex: '172(.*)'
-    action: drop
+    - source_labels: ['__meta_consul_service']
+      target_label: 'job'
+      replacement: 'consul-service'
+    - source_labels: ['__meta_consul_tags']
+      regex: '.*prometheus.path=([^,]+).*'  # Extract path from tag
+      target_label: '__metrics_path__'
 
   metrics_path: /v1/metrics
   params:
     format: ['prometheus']
 
-- job_name: 'application_metrics'
-  consul_sd_configs:
-  - server: '{{ env "attr.unique.network.ip-address" }}:8500'
 
-  relabel_configs:
-  - source_labels: ['__meta_consul_service']
-    regex: 'nomad|nomad-client|consul'
-    action: drop
-    # Drop services which do not want to be scraped.
-    # Typically used when a job does not expose prometheus metrics.
-  - source_labels: ['__meta_consul_tags']
-    regex: '.*prometheus.io/scrape=false.*'
-    action: 'drop'
-  - source_labels: ['__meta_consul_node']
-    target_label: 'node'
-  - source_labels: ['__meta_consul_service']
-    target_label: 'service'
 EOF
+      }
 
-        destination = "local/prometheus.yml"
+      resources {
+        cpu    = 500
+        memory = 512
       }
     }
   }
 }
+

From 82ab9b515fe49af878e56a0487519b4760dc0b5f Mon Sep 17 00:00:00 2001
From: wizzdom <dom@wizzdom.xyz>
Date: Fri, 28 Feb 2025 01:23:37 +0000
Subject: [PATCH 4/9] traefik: use consul, bump res, add metrics, fix dummy
 service

---
 jobs/ingress/traefik.hcl | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/jobs/ingress/traefik.hcl b/jobs/ingress/traefik.hcl
index 2c830c5..3379f4f 100644
--- a/jobs/ingress/traefik.hcl
+++ b/jobs/ingress/traefik.hcl
@@ -44,6 +44,10 @@ job "traefik" {
           "/storage/nomad/traefik/access.log:/access.log",
         ]
       }
+      resources {
+        cpu    = 500
+        memory = 1024
+      }
 
       template {
         destination = "local/.env"
@@ -137,6 +141,12 @@ EOF
 
 [tracing]
 
+[metrics]
+  [metrics.prometheus]
+    addServicesLabels = true
+    addRoutersLabels = true
+    addEntryPointsLabels = true
+
 [accessLog]
   filePath = "/access.log"
 EOF
@@ -221,6 +231,7 @@ EOF
       certResolver = "lets-encrypt"
 
 {{ end -}}
+      url = "http://127.0.0.1"  # Dummy service - not used
 EOF
       }
     }

From 1b54ac306f59c22c23d65d3149c93b54775e9b8e Mon Sep 17 00:00:00 2001
From: Gavin Holahan <gholahan9@gmail.com>
Date: Fri, 28 Feb 2025 02:12:19 +0000
Subject: [PATCH 5/9] service

---
 jobs/monitoring/prometheus.hcl | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/jobs/monitoring/prometheus.hcl b/jobs/monitoring/prometheus.hcl
index 6ffa3af..bd5c882 100644
--- a/jobs/monitoring/prometheus.hcl
+++ b/jobs/monitoring/prometheus.hcl
@@ -14,6 +14,11 @@ job "prometheus" {
     task "prometheus" {
       driver = "docker"
 
+      service {
+        name = "prometheus"
+        port = "http"
+      }
+
       config {
         image = "prom/prometheus:latest"
         ports = ["http"]
@@ -56,8 +61,6 @@ scrape_configs:
   metrics_path: /v1/metrics
   params:
     format: ['prometheus']
-
-
 EOF
       }
 

From 34a6b5e21e117f2ed9f0d5063a840de43ead7a71 Mon Sep 17 00:00:00 2001
From: wizzdom <dom@wizzdom.xyz>
Date: Fri, 28 Feb 2025 02:40:16 +0000
Subject: [PATCH 6/9] grafana: add dynamic prometheus datasource

---
 jobs/monitoring/grafana.hcl | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/jobs/monitoring/grafana.hcl b/jobs/monitoring/grafana.hcl
index 2d76bc1..5a981ae 100644
--- a/jobs/monitoring/grafana.hcl
+++ b/jobs/monitoring/grafana.hcl
@@ -48,11 +48,11 @@ job "grafana" {
         ports = ["http"]
 
         volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/grafana"
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/grafana",
+          "local/datasources.yml:/etc/grafana/provisioning/datasources/datasources.yml"
         ]
       }
 
-
       template {
         data        = <<EOH
 GF_DATABASE_TYPE=postgres
@@ -66,6 +66,21 @@ EOH
         destination = "local/.env"
         env         = true
       }
+      template {
+        data        = <<EOH
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    access: proxy
+    {{- range service "prometheus" }}
+    url: http://prometheus.service.consul:{{ .Port }}{{ end }}
+    isDefault: true
+    editable: false
+EOH
+        destination = "local/datasources.yml"
+      }
     }
     task "db" {
       driver = "docker"

From 2c47f5c841ae920ff80cf90957c249f6dc982e86 Mon Sep 17 00:00:00 2001
From: Ayden Jahola <jaholaayden@gmail.com>
Date: Tue, 31 Mar 2026 16:58:41 +0100
Subject: [PATCH 7/9] Add node-exporter scrape to prometheus

---
 jobs/monitoring/prometheus.hcl | 72 ++++++++++++++++++++++------------
 1 file changed, 46 insertions(+), 26 deletions(-)

diff --git a/jobs/monitoring/prometheus.hcl b/jobs/monitoring/prometheus.hcl
index bd5c882..6601bbf 100644
--- a/jobs/monitoring/prometheus.hcl
+++ b/jobs/monitoring/prometheus.hcl
@@ -1,6 +1,6 @@
 job "prometheus" {
   datacenters = ["aperture"]
-  type = "service"
+  type        = "service"
 
   group "prometheus" {
     count = 1
@@ -24,43 +24,64 @@ job "prometheus" {
         ports = ["http"]
 
         volumes = [
-          "local/prometheus.yml:/etc/prometheus/prometheus.yml"
+          "local/prometheus.yml:/etc/prometheus/prometheus.yml",
+          "local/tokens/:/etc/prometheus/tokens/"
         ]
       }
 
       template {
         destination = "local/prometheus.yml"
-        data = <<EOF
+        data        = <<EOF
 global:
   scrape_interval: 10s
   evaluation_interval: 10s
 
 scrape_configs:
-- job_name: 'nomad_metrics'
-  consul_sd_configs:
-    - server: 'consul.service.consul:8500'
-      services: ['nomad-client', 'nomad'] # This allows for Client (Workload) and Server (Orchastration) metrics
-      tags: ['http']
+  - job_name: 'nomad_metrics'
+    consul_sd_configs:
+      - server: 'consul.service.consul:8500'
+        services: ['nomad-client', 'nomad']
+        tags: ['http']
+    metrics_path: /v1/metrics
+    params:
+      format: ['prometheus']
 
-  metrics_path: /v1/metrics
-  params:
-    format: ['prometheus']
+  - job_name: 'container-metrics'
+    consul_sd_configs:
+      - server: 'consul.service.consul:8500'
+        tags: ['prometheus.enable=true']
+    metrics_path: /metrics
+    relabel_configs:
+      - source_labels: ['__meta_consul_service']
+        target_label: 'job'
+        replacement: 'consul-service'
 
-- job_name: 'container-metrics'
-  consul_sd_configs:
-  - server: 'consul.service.consul:8500'
-    tags: ['prometheus.enable=true']
-  relabel_configs:
-    - source_labels: ['__meta_consul_service']
-      target_label: 'job'
-      replacement: 'consul-service'
-    - source_labels: ['__meta_consul_tags']
-      regex: '.*prometheus.path=([^,]+).*'  # Extract path from tag
-      target_label: '__metrics_path__'
+      - source_labels: ['__meta_consul_tags']
+        regex: '.*prometheus.path=([^,]+).*'
+        target_label: '__metrics_path__'
+        replacement: '/$1'
 
-  metrics_path: /v1/metrics
-  params:
-    format: ['prometheus']
+      - source_labels: ['__meta_consul_tags']
+        regex: '.*prometheus.auth.bearer_token=([^,]+).*'
+        target_label: '__param_bearer_token_file'
+        replacement: '$1'
+
+  - job_name: 'node-exporter'
+    consul_sd_configs:
+      - server: 'consul.service.consul:8500'
+        services: ['node-exporter']
+    metrics_path: /metrics
+    relabel_configs:
+      - source_labels: ['__meta_consul_service']
+        target_label: 'job'
+        replacement: 'node-exporter'
+EOF
+      }
+
+      template {
+        destination = "local/tokens/minio"
+        data        = <<EOF
+{{ key "prometheus/minio" }}
 EOF
       }
 
@@ -71,4 +92,3 @@ EOF
     }
   }
 }
-

From 97ef0b6357a8b44c9dc5c6ebefac794be61923b2 Mon Sep 17 00:00:00 2001
From: Aris <64918822+Arisamiga@users.noreply.github.com>
Date: Mon, 1 Jun 2026 00:47:38 +0100
Subject: [PATCH 8/9] Added monitoring tools currently used + hcl update

---
 jobs/ingress/traefik.hcl          | 508 +++++++++++++++++++++++-------
 jobs/monitoring/gatus.hcl         | 349 ++++++++++++++++++++
 jobs/monitoring/grafana.hcl       | 155 ++++++---
 jobs/monitoring/node-exporter.hcl |  43 +++
 jobs/monitoring/prometheus.hcl    |   2 +-
 jobs/monitoring/uptime-kuma.hcl   |  48 ---
 6 files changed, 897 insertions(+), 208 deletions(-)
 create mode 100644 jobs/monitoring/gatus.hcl
 create mode 100644 jobs/monitoring/node-exporter.hcl
 delete mode 100644 jobs/monitoring/uptime-kuma.hcl

diff --git a/jobs/ingress/traefik.hcl b/jobs/ingress/traefik.hcl
index 3379f4f..a86ef23 100644
--- a/jobs/ingress/traefik.hcl
+++ b/jobs/ingress/traefik.hcl
@@ -1,96 +1,182 @@
 job "traefik" {
   datacenters = ["aperture"]
-  node_pool   = "ingress"
-  type        = "service"
+  type        = "system"
 
   group "traefik" {
     network {
       port "http" {
         static = 80
       }
+
       port "https" {
         static = 443
       }
+
       port "admin" {
         static = 8080
       }
-      port "ssh" {
-        static = 22
-      }
+
       port "voice-tcp" {
         static = 4502
       }
+
       port "voice-udp" {
         static = 4503
       }
+
+      port "matrix" {
+        static = 8448
+      }
+
+      port "smtp" {
+        static = 25
+      }
+
+      port "submissions" {
+        static = 465
+      }
+
+      port "submission" {
+        static = 587
+      }
+
+      port "imap" {
+        static = 143
+      }
+
+      port "imaps" {
+        static = 993
+      }
+
+      port "pop3" {
+        static = 110
+      }
+
+      port "pop3s" {
+        static = 995
+      }
+
+      port "managesieve" {
+        static = 4190
+      }
     }
 
     service {
       name     = "traefik-http"
       provider = "nomad"
       port     = "admin"
+
+      check {
+        name     = "traefik-ping"
+        type     = "http"
+        path     = "/ping"
+        interval = "10s"
+        timeout  = "2s"
+      }
     }
 
     task "traefik" {
       driver = "docker"
+
       config {
-        image        = "traefik"
+        image        = "traefik:v3.3"
         network_mode = "host"
 
         volumes = [
-          "local/traefik.toml:/etc/traefik/traefik.toml",
-          "/storage/nomad/traefik/acme/acme.json:/acme.json",
-          "/storage/nomad/traefik/acme/acme-dns.json:/acme-dns.json",
+          "local/traefik.toml:/etc/traefik/traefik.toml:ro",
+
+          # Shared dynamic config directory.
+          #
+          # The ACME extractor writes:
+          #   /storage/nomad/traefik/dynamic/90-acme-extracted-certs.toml
+          #
+          # Nomad overlays this job's generated config as:
+          #   /dynamic/10-generated.toml
+          #
+          # Keeping both files directly under /dynamic avoids relying on
+          # Traefik watching subdirectories.
+          "/storage/nomad/traefik/dynamic:/dynamic",
+          "local/dynamic-generated.toml:/dynamic/10-generated.toml:ro",
+
+          # PEM certs extracted from the ACME renewer.
+          "/storage/nomad/traefik/certs:/certs:ro",
+
           "/storage/nomad/traefik/access.log:/access.log",
         ]
       }
-      resources {
-        cpu    = 500
-        memory = 1024
-      }
-
-      template {
-        destination = "local/.env"
-        env         = true
-        change_mode = "restart"
-        data        = <<EOF
-RFC2136_TSIG_KEY=dnsupdate.redbrick.dcu.ie.
-RFC2136_TSIG_SECRET={{ key "traefik/acme/dns/key" }}
-RFC2136_TSIG_ALGORITHM=hmac-sha256.
-RFC2136_NAMESERVER=ns1.redbrick.dcu.ie:53
-EOF
-      }
 
       template {
         destination = "local/traefik.toml"
         change_mode = "restart"
         data        = <<EOF
+# ---------------------------------------------------------------------------
+# Static Traefik config.
+# ---------------------------------------------------------------------------
+# Static config is intentionally kept boring and explicit.
+# Dynamic routers/services/TLS certificates live in /dynamic/*.toml.
+# ---------------------------------------------------------------------------
+
 [entryPoints]
   [entryPoints.web]
-  address = ":80"
-  [entryPoints.web.http.redirections.entryPoint]
-    to = "websecure"
-    scheme = "https"
+    address = ":80"
+
+    [entryPoints.web.http.redirections.entryPoint]
+      to = "websecure"
+      scheme = "https"
+      permanent = true
+      priority = 9000
 
   [entryPoints.websecure]
     address = ":443"
     asDefault = true
+
+    [entryPoints.websecure.http.tls]
+
     [entryPoints.websecure.forwardedHeaders]
-      trustedIPs = ["127.0.0.1/32", "10.10.0.0/16", "136.206.16.0/24"]
+      trustedIPs = [
+        "127.0.0.1/32",
+        "10.10.0.0/16",
+        "136.206.16.0/24",
+      ]
 
   [entryPoints.traefik]
-  address = ":8080"
-
-  [entryPoints.ssh]
-  address = ":22"
+    address = ":8080"
 
   [entryPoints.voice-tcp]
-  address = ":4502"
+    address = ":4502"
 
   [entryPoints.voice-udp]
     address = ":4503/udp"
+
     [entryPoints.voice-udp.udp]
-      timeout = "15s" # this will help reduce random dropouts in audio https://github.com/mumble-voip/mumble/issues/3550#issuecomment-441495977
+      timeout = "15s"
+
+  [entryPoints.matrix]
+    address = ":8448"
+
+  [entryPoints.smtp]
+    address = "136.206.16.50:25"
+
+  [entryPoints.submissions]
+    address = "136.206.16.50:465"
+
+  [entryPoints.submission]
+    address = "136.206.16.50:587"
+
+  [entryPoints.imap]
+    address = "136.206.16.50:143"
+
+  [entryPoints.imaps]
+    address = "136.206.16.50:993"
+
+  [entryPoints.pop3]
+    address = "136.206.16.50:110"
+
+  [entryPoints.pop3s]
+    address = "136.206.16.50:995"
+
+  [entryPoints.managesieve]
+    address = "136.206.16.50:4190"
 
 [tls.options]
   [tls.options.default]
@@ -101,76 +187,103 @@ EOF
       "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
       "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
       "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
-      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
     ]
 
 [api]
-    dashboard = true
-    insecure  = true
+  dashboard = true
+  insecure  = true
+
+[ping]
+  entryPoint = "traefik"
 
-# Enable Consul Catalog configuration backend.
 [providers.consulCatalog]
-    prefix           = "traefik"
-    exposedByDefault = false
+  prefix           = "traefik"
+  exposedByDefault = false
 
-    [providers.consulCatalog.endpoint]
-      address = "127.0.0.1:8500"
-      scheme  = "http"
+  [providers.consulCatalog.endpoint]
+    address = "127.0.0.1:8500"
+    scheme  = "http"
 
-# Enable the file provider for dynamic configuration.
 [providers.file]
-  filename = "/local/dynamic.toml"
-
-#[providers.nomad]
-#  [providers.nomad.endpoint]
-#    address = "127.0.0.1:4646"
-#    scheme = "http"
-
-[certificatesResolvers.lets-encrypt.acme]
-  email = "elected-admins@redbrick.dcu.ie"
-  storage = "acme.json"
-  [certificatesResolvers.lets-encrypt.acme.tlsChallenge]
-
-[certificatesResolvers.rb.acme]
-  email = "elected-admins@redbrick.dcu.ie"
-  storage = "acme-dns.json"
-  [certificatesResolvers.rb.acme.dnsChallenge]
-    provider = "rfc2136"
-    delayBeforeCheck = 60
-        resolvers = "ns1.redbrick.dcu.ie:53,1.1.1.1:53,8.8.8.8:53"
+  directory = "/dynamic"
+  watch     = true
 
 [tracing]
 
-[metrics]
-  [metrics.prometheus]
-    addServicesLabels = true
-    addRoutersLabels = true
-    addEntryPointsLabels = true
-
 [accessLog]
   filePath = "/access.log"
+
+[log]
+  level = "INFO"
 EOF
       }
+
       template {
-        destination = "local/dynamic.toml"
-        change_mode = "noop"
+        destination = "local/dynamic-generated.toml"
+        change_mode = "restart"
         data        = <<EOF
+# ---------------------------------------------------------------------------
+# Dynamic Traefik config generated by Nomad/Consul Template.
+# ---------------------------------------------------------------------------
+# This file is mounted into the container as:
+#   /dynamic/10-generated.toml
+#
+# ACME-extracted certs are written separately by traefik-acme-renewer as:
+#   /dynamic/90-acme-extracted-certs.toml
+# ---------------------------------------------------------------------------
+
 [http]
 
+# ---------------------------------------------------------------------------
+# HTTP middlewares
+# ---------------------------------------------------------------------------
+
 [http.middlewares]
 
-# handle redirects for short links
-# NOTE: this is a consul template, add entries via consul kv
-# create the middlewares with replacements for each redirect
+  [http.middlewares.redirect-to-https.redirectScheme]
+    scheme = "https"
+    permanent = true
+
+# Short-link redirects.
+# Add entries in Consul KV under:
+#   redirect/redbrick/<subdomain>
+#
+# Example:
+#   redirect/redbrick/wiki = https://wiki.redbrick.dcu.ie/
 {{ range $pair := tree "redirect/redbrick" }}
-  [http.middlewares.redirect-{{ trimPrefix "redirect/redbrick/" $pair.Key }}.redirectRegex]
-    regex = ".*"  # match everything - hosts are handled by the router
+{{ $name := trimPrefix "redirect/redbrick/" $pair.Key }}
+  [http.middlewares.redirect-{{ $name }}.redirectRegex]
+    regex = ".*"
     replacement = "{{ $pair.Value }}"
     permanent = true
-{{- end }}
+
+{{ end }}
+      
+ # --- Short-link redirects for rb.dcu.ie ---
+{{ range $pair := tree "redirect/rb" }}
+{{ $name := trimPrefix "redirect/rb/" $pair.Key }}
+  [http.middlewares.redirect-rb-{{ $name }}.redirectRegex]
+    regex = ".*"
+    replacement = "{{ $pair.Value }}"
+    permanent = true
+{{ end }}
+
+# ---------------------------------------------------------------------------
+# HTTP routers
+# ---------------------------------------------------------------------------
 
 [http.routers]
 
+# HTTP-01 ACME challenge router.
+# Public traffic reaches whichever Traefik owns the Keepalived VIP.
+# That Traefik forwards the challenge to the active ACME renewer via Consul.
+[http.routers.acme-http01]
+  rule = "PathPrefix(`/.well-known/acme-challenge/`)"
+  entryPoints = ["web"]
+  service = "traefik-acme-renewer"
+  priority = 10000
+
 [http.routers.webtree]
   rule = "HostRegexp(`^([a-z0-9_-]+)\\.redbrick\\.dcu\\.ie$`) || ((Host(`redbrick.dcu.ie`) || Host(`www.redbrick.dcu.ie`)) && PathPrefix(`/~`))"
   entryPoints = ["websecure"]
@@ -178,62 +291,225 @@ EOF
   service = "webtree@consulcatalog"
 
   [http.routers.webtree.tls]
-    certResolver = "rb"
 
-# create routers with middlewares for each redirect
+# --- redbrick.dcu.ie short-link redirect routers ---
 {{ range $pair := tree "redirect/redbrick" }}
-  [http.routers.{{ trimPrefix "redirect/redbrick/" $pair.Key }}-redirect]
-    rule = "Host(`{{ trimPrefix "redirect/redbrick/" $pair.Key }}.redbrick.dcu.ie`)"
+{{ $name := trimPrefix "redirect/redbrick/" $pair.Key }}
+  [http.routers.{{ $name }}-redirect]
+    rule = "Host(`{{ $name }}.redbrick.dcu.ie`)"
     entryPoints = ["web", "websecure"]
-    middlewares = ["redirect-{{ trimPrefix "redirect/redbrick/" $pair.Key }}"]
-    service = "dummy-service"  # all routers need a service, this isn't used
-    [http.routers.{{ trimPrefix "redirect/redbrick/" $pair.Key }}-redirect.tls]
-{{- end }}
+    middlewares = ["redirect-{{ $name }}"]
+    service = "dummy-service"
+    priority = 50
+
+    [http.routers.{{ $name }}-redirect.tls]
+
+{{ end }}
 
+# --- rb.dcu.ie short-link redirect routers ---
+{{ range $pair := tree "redirect/rb" }}
+{{ $name := trimPrefix "redirect/rb/" $pair.Key }}
+  [http.routers.{{ $name }}-rb-redirect]
+    rule = "Host(`{{ $name }}.rb.dcu.ie`)"
+    entryPoints = ["web", "websecure"]
+    middlewares = ["redirect-rb-{{ $name }}"]
+    service = "dummy-service"
+    priority = 50
+
+    [http.routers.{{ $name }}-rb-redirect.tls]
+
+{{ end }}
+
+# Default TLS router.
+# This exists so Traefik can present an extracted cert for known Redbrick zones
+# even when no higher-priority router has matched.
 [http.routers.tls-default]
-      rule = "HostRegexp(`{any:.+}.redbrick.dcu.ie`) || HostRegexp(`{any:.+}.rb.dcu.ie`) || HostRegexp(`{any:.+}.redbrick.ie`)"
-      entryPoints = ["web", "websecure"]
-      service = "dummy-service"
-      priority = -1
+  rule = "HostRegexp(`{any:.+}.redbrick.dcu.ie`) || HostRegexp(`{any:.+}.rb.dcu.ie`) || HostRegexp(`{any:.+}.redbrick.ie`)"
+  entryPoints = ["websecure"]
+  service = "dummy-service"
+  priority = -1
 
-      [http.routers.tls-default.tls]
-        certResolver = "rb"
+  [http.routers.tls-default.tls]
 
-        [[http.routers.tls-default.tls.domains]]
-          main = "redbrick.dcu.ie"
-          sans = ["*.redbrick.dcu.ie"]
+# Extra webtree domains from Consul KV.
+{{ $i := 0 -}}
+{{- range $pair := tree "webtree/domains" -}}
+  {{- $i = add $i 1 }}
 
-        [[http.routers.tls-default.tls.domains]]
-          main = "rb.dcu.ie"
-          sans = ["*.rb.dcu.ie"]
+[http.routers.webtree-domain-{{ $i }}]
+  rule = "Host(`{{ $pair.Key }}`)"
+  entryPoints = ["websecure"]
+  service = "webtree@consulcatalog"
+  priority = 20
 
-        [[http.routers.tls-default.tls.domains]]
-          main = "redbrick.ie"
-          sans = ["*.redbrick.ie"]
+  [http.routers.webtree-domain-{{ $i }}.tls]
 
+{{ end }}
+
+# ---------------------------------------------------------------------------
+# HTTP services
+# ---------------------------------------------------------------------------
 
 [http.services]
+
+  [http.services.traefik-acme-renewer.loadBalancer]
+    passHostHeader = true
+
+{{ range service "traefik-acme-renewer" }}
+    [[http.services.traefik-acme-renewer.loadBalancer.servers]]
+      url = "http://{{ .Address }}:{{ .Port }}"
+{{ end }}
+
   [http.services.dummy-service.loadBalancer]
+
     [[http.services.dummy-service.loadBalancer.servers]]
-      url = "http://127.0.0.1"  # Dummy service - not used
+      url = "http://127.0.0.1"
 
-{{ $i := 0 -}}
-{{- range $pair := tree "webtree/domains" -}}
-  {{- $i = add $i 1 -}}
+# ---------------------------------------------------------------------------
+# TCP routers
+# ---------------------------------------------------------------------------
 
-  [http.routers.webtree-domain-{{ $i }}]
-    rule = "Host(`{{ $pair.Key }}`)"
-    entryPoints = ["web", "websecure"]
-    service = "webtree@consulcatalog"
-    priority = 20
+[tcp]
+
+[tcp.routers]
 
-    [http.routers.webtree-domain-{{ $i }}.tls]
-      certResolver = "lets-encrypt"
+  [tcp.routers.mail-smtp]
+    entryPoints = ["smtp"]
+    rule = "HostSNI(`*`)"
+    service = "mail-smtp"
 
-{{ end -}}
-      url = "http://127.0.0.1"  # Dummy service - not used
+  [tcp.routers.mail-submissions]
+    entryPoints = ["submissions"]
+    rule = "HostSNI(`*`)"
+    service = "mail-submissions"
+
+  [tcp.routers.mail-submissions.tls]
+    passthrough = true
+
+  [tcp.routers.mail-submission]
+    entryPoints = ["submission"]
+    rule = "HostSNI(`*`)"
+    service = "mail-submission"
+
+  [tcp.routers.mail-imap]
+    entryPoints = ["imap"]
+    rule = "HostSNI(`*`)"
+    service = "mail-imap"
+
+  [tcp.routers.mail-imaps]
+    entryPoints = ["imaps"]
+    rule = "HostSNI(`*`)"
+    service = "mail-imaps"
+
+  [tcp.routers.mail-imaps.tls]
+    passthrough = true
+
+  [tcp.routers.mail-pop3]
+    entryPoints = ["pop3"]
+    rule = "HostSNI(`*`)"
+    service = "mail-pop3"
+
+  [tcp.routers.mail-pop3s]
+    entryPoints = ["pop3s"]
+    rule = "HostSNI(`*`)"
+    service = "mail-pop3s"
+
+  [tcp.routers.mail-pop3s.tls]
+    passthrough = true
+
+  [tcp.routers.mail-managesieve]
+    entryPoints = ["managesieve"]
+    rule = "HostSNI(`*`)"
+    service = "mail-managesieve"
+
+# ---------------------------------------------------------------------------
+# TCP services
+# ---------------------------------------------------------------------------
+
+# ---------------------------------------------------------------------------
+# TCP services
+# ---------------------------------------------------------------------------
+
+[tcp.services]
+
+  [tcp.services.mail-smtp.loadBalancer]
+    [tcp.services.mail-smtp.loadBalancer.proxyProtocol]
+      version = 2
+
+{{ range service "mailserver-smtp" }}
+    [[tcp.services.mail-smtp.loadBalancer.servers]]
+      address = "{{ .Address }}:{{ .Port }}"
+{{ end }}
+
+  [tcp.services.mail-submissions.loadBalancer]
+    [tcp.services.mail-submissions.loadBalancer.proxyProtocol]
+      version = 2
+
+{{ range service "mailserver-submissions" }}
+    [[tcp.services.mail-submissions.loadBalancer.servers]]
+      address = "{{ .Address }}:{{ .Port }}"
+{{ end }}
+
+  [tcp.services.mail-submission.loadBalancer]
+    [tcp.services.mail-submission.loadBalancer.proxyProtocol]
+      version = 2
+
+{{ range service "mailserver-submission" }}
+    [[tcp.services.mail-submission.loadBalancer.servers]]
+      address = "{{ .Address }}:{{ .Port }}"
+{{ end }}
+
+  [tcp.services.mail-imap.loadBalancer]
+    [tcp.services.mail-imap.loadBalancer.proxyProtocol]
+      version = 2
+
+{{ range service "mailserver-imap" }}
+    [[tcp.services.mail-imap.loadBalancer.servers]]
+      address = "{{ .Address }}:{{ .Port }}"
+{{ end }}
+
+  [tcp.services.mail-imaps.loadBalancer]
+    [tcp.services.mail-imaps.loadBalancer.proxyProtocol]
+      version = 2
+
+{{ range service "mailserver-imaps" }}
+    [[tcp.services.mail-imaps.loadBalancer.servers]]
+      address = "{{ .Address }}:{{ .Port }}"
+{{ end }}
+
+  [tcp.services.mail-pop3.loadBalancer]
+    [tcp.services.mail-pop3.loadBalancer.proxyProtocol]
+      version = 2
+
+{{ range service "mailserver-pop3" }}
+    [[tcp.services.mail-pop3.loadBalancer.servers]]
+      address = "{{ .Address }}:{{ .Port }}"
+{{ end }}
+
+  [tcp.services.mail-pop3s.loadBalancer]
+    [tcp.services.mail-pop3s.loadBalancer.proxyProtocol]
+      version = 2
+
+{{ range service "mailserver-pop3s" }}
+    [[tcp.services.mail-pop3s.loadBalancer.servers]]
+      address = "{{ .Address }}:{{ .Port }}"
+{{ end }}
+
+  [tcp.services.mail-managesieve.loadBalancer]
+    [tcp.services.mail-managesieve.loadBalancer.proxyProtocol]
+      version = 2
+
+{{ range service "mailserver-managesieve" }}
+    [[tcp.services.mail-managesieve.loadBalancer.servers]]
+      address = "{{ .Address }}:{{ .Port }}"
+{{ end }}
 EOF
       }
+
+      resources {
+        cpu    = 500
+        memory = 512
+      }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/jobs/monitoring/gatus.hcl b/jobs/monitoring/gatus.hcl
new file mode 100644
index 0000000..ca8255f
--- /dev/null
+++ b/jobs/monitoring/gatus.hcl
@@ -0,0 +1,349 @@
+job "gatus" {
+  datacenters = ["aperture"]
+  type        = "service"
+
+  meta {
+    domain = "gatus.redbrick.dcu.ie"
+  }
+
+  group "db-web" {
+    count = 1
+
+    network {
+      port "db" {
+        to = 5432
+      }
+    }
+
+    service {
+      name = "gatus-db"
+      port = "db"
+
+      check {
+        name     = "postgres-tcp"
+        type     = "tcp"
+        port     = "db"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
+    task "db" {
+      driver = "docker"
+
+      config {
+        image = "postgres:17-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/postgresql/data"
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        data        = <<EOH
+POSTGRES_DB       = {{ key "gatus/db/name" }}
+POSTGRES_USER     = {{ key "gatus/db/user" }}
+POSTGRES_PASSWORD = {{ key "gatus/db/password" }}
+EOH
+      }
+
+      resources {
+        cpu    = 300
+        memory = 512
+      }
+    }
+  }
+
+  group "web" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 8080
+      }
+    }
+
+    service {
+      name = "gatus"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.gatus.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.gatus.entrypoints=web,websecure",
+        "traefik.http.routers.gatus.tls.certresolver=rb",
+      ]
+    }
+
+    task "wait-for-db" {
+      driver = "docker"
+
+      lifecycle {
+        hook    = "prestart"
+        sidecar = false
+      }
+
+      config {
+        image   = "alpine:3.19"
+        command = "sh"
+        args = [
+          "-c",
+          "while ! nc -z \"$DB_HOST\" \"$DB_PORT\"; do echo 'Waiting for DB...'; sleep 1; done; echo 'DB is ready!'"
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        change_mode = "restart"
+        data        = <<EOH
+{{- range service "gatus-db" }}
+DB_HOST={{ .Address }}
+DB_PORT={{ .Port }}
+{{- end }}
+EOH
+      }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
+    }
+
+    task "gatus" {
+      driver = "docker"
+
+      config {
+        image = "twinproduction/gatus:latest"
+        ports = ["http"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/config",
+          "local/config.yaml:/config/config.yaml",
+        ]
+      }
+
+      template {
+        destination = "local/config.yaml"
+        data        = <<EOH
+ui:
+  title: "Redbrick Status"
+  description: "Status and uptime for Redbrick's Services and Servers"
+  header: "Status"
+  dashboard-heading: "Health Dashboard"
+  dashboard-subheading: "Centralised dashboard to monitor all Redbrick's running services and track downtime"
+  logo: "https://redbrick.dcu.ie/assets/favicon.ico"
+  link: "https://{{ env "NOMAD_META_domain" }}"
+  favicon:
+    default: "https://redbrick.dcu.ie/assets/favicon.ico"
+    size16x16: "https://redbrick.dcu.ie/assets/favicon.ico"
+    size32x32: "https://redbrick.dcu.ie/assets/favicon.ico"
+  dark-mode: on
+announcements:
+  - timestamp: 2026-05-08T12:00:00Z
+    type: warning
+    message: "We will be performing planned maintenance on all Redbrick Infrastructure starting this weekend (May 9th). During this time, some services may be unavailable or experience disruptions. Thank you for your understanding and patience. "
+    archived: false
+  - timestamp: 2026-05-21T12:00:00Z
+    type: information
+    message: "Infrastructure upgrades are complete, and we are in the process of restoring services. Please note that some services may take additional time to become fully available. We will provide an update once all services are operational."
+    archived: false
+
+storage:
+  type: postgres
+  path: '{{- range service "gatus-db" -}}postgres://{{ key "gatus/db/user" | urlquery }}:{{ key "gatus/db/password" | urlquery }}@{{ .Address }}:{{ .Port }}/{{ key "gatus/db/name" | urlquery }}?sslmode=disable{{- end -}}'
+
+alerting:
+  discord:
+    webhook-url: '{{ key "gatus/discord/webhook/url" }}'
+    default-alert:
+      enabled: true
+      send-on-resolved: true
+      failure-threshold: 3
+      success-threshold: 2
+
+defaults_tcp: &defaults_tcp
+  interval: 60s
+  alerts:
+      - type: discord
+  conditions:
+      - "[CONNECTED] == true"
+
+defaults: &defaults
+  interval: 60s
+  alerts:
+    - type: discord
+  conditions:
+    - "[STATUS] == 200"
+
+defaults_https: &defaults_https
+  <<: *defaults
+  conditions:
+    - "[STATUS] == 200"
+    - "[CERTIFICATE_EXPIRATION] > 48h"
+
+endpoints:
+  # --- All Redbrick Monitors ---
+  - name: Atlas
+    group: Services
+    url: "https://redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: RB Wiki
+    group: Services
+    url: "https://wiki.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Admin API
+    group: Services
+    url: "https://api.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Timetable Sync
+    group: Services
+    url: "https://timetable.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Vaultwarden
+    group: Services
+    url: "https://vault.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Pastebin
+    group: Services
+    url: "https://paste.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Plausible
+    group: Services
+    url: "https://plausible.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: RB Docs
+    group: Services
+    url: "https://docs.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Paperless
+    group: Services
+    url: "https://paperless.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: DCU Clubs and Socs
+    group: Services
+    url: "https://dcuclubsandsocs.ie"
+    <<: *defaults_https
+
+  - name: C&S Room Bookings
+    group: Services
+    url: "https://rooms.rb.dcu.ie"
+    <<: *defaults_https
+
+  - name: Hedgedoc
+    group: Services
+    url: "https://md.redbrick.dcu.ie/_health"
+    <<: *defaults_https
+
+  # --- Other Socs ---
+  - name: DCU Solar Racing
+    group: Other Socs
+    url: "https://solarracing.ie"
+    <<: *defaults_https
+
+  - name: MPS Site
+    group: Other Socs
+    url: "https://dcumps.ie"
+    <<: *defaults_https
+
+  - name: The Look
+    group: Other Socs
+    url: "https://thelookonline.dcu.ie"
+    <<: *defaults_https
+
+  - name: The College View
+    group: Other Socs
+    url: "https://thecollegeview.ie"
+    <<: *defaults_https
+
+  - name: Solar Racing Outline
+    group: Other Socs
+    url: "https://outline.solarracing.ie"
+    <<: *defaults_https
+
+  - name: Amikon Website
+    group: Other Socs
+    url: "https://amikon.me"
+    <<: *defaults_https
+
+  - name: Glados
+    group: Servers
+    url: "tcp://10.10.10.4:22"
+    <<: *defaults_tcp
+
+  - name: Wheatley
+    group: Servers
+    url: "tcp://10.10.10.5:22"
+    <<: *defaults_tcp
+
+  - name: Johnson
+    group: Servers
+    url: "tcp://10.10.10.80:22"
+    <<: *defaults_tcp
+
+  - name: Chell
+    group: Servers
+    url: "tcp://10.10.10.6:22"
+    <<: *defaults_tcp
+
+  - name: Minecraft Vanilla
+    group: Game Servers
+    url: "tcp://vanilla-mc.rb.dcu.ie:25565"
+    <<: *defaults_tcp
+
+  - name: Discord Shortlink
+    group: Short Links
+    url: "https://discord.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Github Shortlink
+    group: Short Links
+    url: "https://github.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Instagram Shortlink
+    group: Short Links
+    url: "https://instagram.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Youtube Shortlink
+    group: Short Links
+    url: "https://youtube.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: LinkedIn Shortlink
+    group: Short Links
+    url: "https://linkedin.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Twitch Shortlink
+    group: Short Links
+    url: "https://twitch.redbrick.dcu.ie"
+    <<: *defaults_https
+
+  - name: Tiktok Shortlink
+    group: Short Links
+    url: "https://tiktok.redbrick.dcu.ie"
+    <<: *defaults_https
+EOH
+      }
+
+      resources {
+        cpu    = 500
+        memory = 512
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/jobs/monitoring/grafana.hcl b/jobs/monitoring/grafana.hcl
index 5a981ae..21c0968 100644
--- a/jobs/monitoring/grafana.hcl
+++ b/jobs/monitoring/grafana.hcl
@@ -1,20 +1,75 @@
 job "grafana" {
   datacenters = ["aperture"]
+  type        = "service"
 
-  type = "service"
+  meta {
+    domain = "grafana.redbrick.dcu.ie"
+  }
+
+  group "database" {
+    count = 1
 
-  group "monitoring" {
     network {
-      port "http" {
-        to = 3000
-      }
       port "db" {
         to = 5432
       }
     }
 
     service {
-      name = "grafana"
+      name = "grafana-db"
+      port = "db"
+
+      check {
+        name     = "postgres-tcp"
+        type     = "tcp"
+        port     = "db"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
+    task "db" {
+      driver         = "docker"
+      kill_signal    = "SIGTERM" # SIGTERM instead of SIGKILL so database can shutdown safely
+      kill_timeout   = "30s"
+      shutdown_delay = "5s"
+
+      config {
+        image = "postgres:17-alpine"
+        ports = ["db"]
+
+        volumes = [
+          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/postgresql/data"
+        ]
+      }
+
+      template {
+        data        = <<EOH
+POSTGRES_DB={{ key "grafana/db/name" }}
+POSTGRES_USER={{ key "grafana/db/user" }}
+POSTGRES_PASSWORD={{ key "grafana/db/password" }}
+EOH
+        destination = "local/db.env"
+        env         = true
+      }
+
+      resources {
+        cpu    = 500
+        memory = 512
+      }
+    }
+  }
+
+  group "web" {
+    count = 1
+    network {
+      port "http" {
+        to = 3000
+      }
+    }
+
+    service {
+      name = "grafana-rb"
       port = "http"
 
       check {
@@ -26,23 +81,52 @@ job "grafana" {
 
       tags = [
         "traefik.enable=true",
-        "traefik.http.routers.grafana.entrypoints=web,websecure",
-        "traefik.http.routers.grafana.rule=Host(`grafana.redbrick.dcu.ie`)",
-        "traefik.http.routers.grafana.tls=true",
-        "traefik.http.routers.grafana.tls.certresolver=lets-encrypt",
+        "traefik.http.routers.grafanarb.rule=Host(`${NOMAD_META_domain}`)",
+        "traefik.http.routers.grafanarb.entrypoints=web,websecure",
+        "traefik.http.routers.grafanarb.tls=true",
+        "traefik.http.routers.grafanarb.middlewares=grafana-embed-headers",
+        "traefik.http.middlewares.grafana-embed-headers.headers.contentSecurityPolicy=frame-ancestors https://status.redbrick.dcu.ie",
       ]
     }
 
-    task "grafana" {
+    task "wait-for-db" {
       driver = "docker"
-      user   = "1001:1001"
 
-      env {
-        GF_AUTH_BASIC_ENABLED = "true"
-        GF_INSTALL_PLUGINS    = "grafana-piechart-panel"
-        GF_SERVER_ROOT_URL    = "https://grafana.redbrick.dcu.ie"
+      lifecycle {
+        hook    = "prestart"
+        sidecar = false
       }
 
+      config {
+        image   = "alpine:3.19"
+        command = "sh"
+        args = [
+          "-c",
+          "while ! nc -z $DB_HOST $DB_PORT; do echo 'Waiting for DB...'; sleep 1; done; echo 'DB is ready!'"
+        ]
+      }
+
+      template {
+        destination = "local/.env"
+        env         = true
+        change_mode = "restart"
+        data        = <<EOH
+{{- range service "grafana-db" }}
+DB_HOST={{ .Address }}
+DB_PORT={{ .Port }}
+{{- end }}
+EOH
+      }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
+    }
+
+    task "grafana" {
+      driver = "docker"
+
       config {
         image = "grafana/grafana"
         ports = ["http"]
@@ -56,12 +140,17 @@ job "grafana" {
       template {
         data        = <<EOH
 GF_DATABASE_TYPE=postgres
-GF_DATABASE_HOST={{ env "NOMAD_ADDR_db" }}
+GF_DATABASE_HOST={{ range service "grafana-db" }}{{ .Address }}:{{ .Port }}{{ end }}
 GF_DATABASE_NAME={{ key "grafana/db/name" }}
 GF_DATABASE_USER={{ key "grafana/db/user" }}
 GF_DATABASE_PASSWORD={{ key "grafana/db/password" }}
-GF_FEATURE_TOGGLES_ENABLE=publicDashboards
-GF_LOG_LEVEL=debug
+# GF_FEATURE_TOGGLES_ENABLE=publicDashboards
+GF_LOG_LEVEL=info
+GF_AUTH_BASIC_ENABLED=true
+GF_USERS_ALLOW_SIGN_UP=false
+GF_SECURITY_ALLOW_EMBEDDING=true
+GF_SERVER_ROOT_URL=https://{{ env "NOMAD_META_domain" }}
+
 EOH
         destination = "local/.env"
         env         = true
@@ -81,30 +170,10 @@ datasources:
 EOH
         destination = "local/datasources.yml"
       }
-    }
-    task "db" {
-      driver = "docker"
-
-      config {
-        image = "postgres:17-alpine"
-        ports = ["db"]
-
-        volumes = [
-          "/storage/nomad/${NOMAD_JOB_NAME}/${NOMAD_TASK_NAME}:/var/lib/postgresql/data",
-        ]
-      }
-
-      template {
-        data        = <<EOH
-POSTGRES_PASSWORD={{ key "grafana/db/password" }}
-POSTGRES_USER={{ key "grafana/db/user" }}
-POSTGRES_NAME={{ key "grafana/db/name" }}
-EOH
-        destination = "local/db.env"
-        env         = true
+      resources {
+        cpu    = 500
+        memory = 1024
       }
     }
   }
-}
-
-
+}
\ No newline at end of file
diff --git a/jobs/monitoring/node-exporter.hcl b/jobs/monitoring/node-exporter.hcl
new file mode 100644
index 0000000..b87997f
--- /dev/null
+++ b/jobs/monitoring/node-exporter.hcl
@@ -0,0 +1,43 @@
+job "node-exporter" {
+  datacenters = ["aperture"]
+  type        = "system"
+
+  group "node-exporter" {
+    network {
+      mode = "bridge"
+
+      port "metrics" {
+        to = 9100
+      }
+    }
+
+    service {
+      name = "node-exporter"
+      port = "metrics"
+    }
+
+    task "node-exporter" {
+      driver = "docker"
+
+      config {
+        image = "prom/node-exporter:latest"
+        ports = ["metrics"]
+
+        pid_mode = "host"
+
+        volumes = [
+          "/:/host:ro,rslave",
+        ]
+
+        args = [
+          "--path.rootfs=/host",
+        ]
+      }
+
+      resources {
+        cpu    = 100
+        memory = 128
+      }
+    }
+  }
+}
diff --git a/jobs/monitoring/prometheus.hcl b/jobs/monitoring/prometheus.hcl
index 6601bbf..0f6603c 100644
--- a/jobs/monitoring/prometheus.hcl
+++ b/jobs/monitoring/prometheus.hcl
@@ -91,4 +91,4 @@ EOF
       }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/jobs/monitoring/uptime-kuma.hcl b/jobs/monitoring/uptime-kuma.hcl
deleted file mode 100644
index 4f917f9..0000000
--- a/jobs/monitoring/uptime-kuma.hcl
+++ /dev/null
@@ -1,48 +0,0 @@
-job "uptime-kuma" {
-  datacenters = ["aperture"]
-  type        = "service"
-
-  group "web" {
-    count = 1
-
-    network {
-      port "http" {
-        to = 3001
-      }
-    }
-
-    service {
-      port = "http"
-
-      check {
-        type     = "http"
-        path     = "/"
-        interval = "10s"
-        timeout  = "2s"
-      }
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.uptime-kuma.rule=Host(`status.redbrick.dcu.ie`)",
-        "traefik.http.routers.uptime-kuma.entrypoints=web,websecure",
-        "traefik.http.routers.uptime-kuma.tls.certresolver=rb",
-      ]
-    }
-
-    task "web" {
-      driver = "docker"
-
-      config {
-        image = "louislam/uptime-kuma:2"
-        ports = ["http"]
-        volumes = [
-          "/storage/nomad/uptime-kuma/data:/app/data"
-        ]
-      }
-      resources {
-        cpu    = 512
-        memory = 800
-      }
-    }
-  }
-}

From 6b2577ca724c6c9f99af1d0d429d862a40708063 Mon Sep 17 00:00:00 2001
From: Aris <64918822+Arisamiga@users.noreply.github.com>
Date: Mon, 1 Jun 2026 18:10:22 +0100
Subject: [PATCH 9/9] Remove container metrics.

This part should be revisited to be added in the future
---
 jobs/monitoring/prometheus.hcl | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/jobs/monitoring/prometheus.hcl b/jobs/monitoring/prometheus.hcl
index 0f6603c..1452e03 100644
--- a/jobs/monitoring/prometheus.hcl
+++ b/jobs/monitoring/prometheus.hcl
@@ -46,26 +46,6 @@ scrape_configs:
     params:
       format: ['prometheus']
 
-  - job_name: 'container-metrics'
-    consul_sd_configs:
-      - server: 'consul.service.consul:8500'
-        tags: ['prometheus.enable=true']
-    metrics_path: /metrics
-    relabel_configs:
-      - source_labels: ['__meta_consul_service']
-        target_label: 'job'
-        replacement: 'consul-service'
-
-      - source_labels: ['__meta_consul_tags']
-        regex: '.*prometheus.path=([^,]+).*'
-        target_label: '__metrics_path__'
-        replacement: '/$1'
-
-      - source_labels: ['__meta_consul_tags']
-        regex: '.*prometheus.auth.bearer_token=([^,]+).*'
-        target_label: '__param_bearer_token_file'
-        replacement: '$1'
-
   - job_name: 'node-exporter'
     consul_sd_configs:
       - server: 'consul.service.consul:8500'