{
  lib,
  config,

  services,
  listenAddress,
  nodeExporterPort,
  nginxExporterPort,
  nginxLogExporterPort,
  cadvisorExporterPort,
  dnsmasqExporterPort,
  ...
}:

{
  foundation.tailnetServices =
    let
      exporter = name: "promethes-${name}-exporter";
    in
    [
      (exporter "node")
      (exporter "nginx")
      (exporter "nginxlog")
      # note: it doesn't matter if the service is only enabled conditionally.
      (exporter "dnsmasq")

      "cadvisor"
    ];

  services = {
    prometheus.exporters = {
      node = {
        enable = true;
        openFirewall = false;
        port = nodeExporterPort;
        inherit listenAddress;
      };

      nginx = {
        enable = true;
        openFirewall = false;
        port = nginxExporterPort;
        inherit listenAddress;
      };

      nginxlog = {
        enable = true;
        openFirewall = false;
        port = nginxLogExporterPort;
        inherit listenAddress;

        user = "nginx";
        group = "nginx";

        settings.namespaces =
          let
            namespace = name: log: {
              inherit name;
              source_files = [ log ];
              parser = "json";
              metrics_override.prefix = "nginx";
              namespace_label = "vhost";
            };

            vhost = name: (namespace name "/var/log/nginx/${name}.access.log");
          in
          [
            (namespace "default" "/var/log/nginx/access.log")
          ]
          ++ (map vhost services);
      };

      dnsmasq = lib.mkIf config.services.dnsmasq.enable {
        enable = true;
        port = dnsmasqExporterPort;
        inherit listenAddress;
      };
    };

    cadvisor = {
      enable = true;
      port = cadvisorExporterPort;
      inherit listenAddress;
    };
  };
}