Every NixOS machine runs Vector (host metrics, internal metrics, journal)
and writes to VictoriaMetrics/VictoriaLogs on both styx and coaxmetal,
each sink with a 512 MiB disk buffer. Both servers run vmalert (metrics and
LogsQL instances), a two-node Alertmanager cluster posting to Matrix via
matrix-alertmanager-receiver, Gatus (results scraped into VictoriaMetrics,
alerted on by vmalert) and Grafana with provisioned datasources and
dashboards. All ports are open on retiolum only.

Replaces telegraf on neoprism, including the borgbackup status file.

The client gives up after connect-timeout on a store it has never reached.
At farm start envoy has no builder yet (none joined, or not yet dialed and
health checked through its tunnel), answers with grpc-status 14, and a few
machine jobs failed on their first QueryMissing. Probe a health check through
the balancer until a builder answers it.

hermes-agent runs with ProtectSystem=strict and cannot write the
group-writable routes dir. crit now asks crit-routes.socket (group crit)
for a route; a root service picks the id, writes the route, regenerates
the nginx map and reloads nginx.

Encrypting to an age1gpg recipient asked gpg-agent (READKEY) for the
public key, which fails on hosts that only have the public key imported
and no secret key or smartcard stub. Export the key by keygrip with gpg
instead in that case and build the same key as the agent path, so
stanzas are unchanged. Decryption still goes through gpg-agent.