nixos/prometheus-exporters: use DynamicUser by default
Only define seperate users and groups when necessary.
This commit is contained in:
parent
495222a840
commit
afd0dc17d6
|
@ -127,9 +127,12 @@ let
|
|||
);
|
||||
|
||||
mkExporterConf = { name, conf, serviceOpts }:
|
||||
let
|
||||
enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true;
|
||||
in
|
||||
mkIf conf.enable {
|
||||
warnings = conf.warnings or [];
|
||||
users.users = (mkIf (conf.user == "${name}-exporter") {
|
||||
users.users = (mkIf (conf.user == "${name}-exporter" && !enableDynamicUser) {
|
||||
"${name}-exporter" = {
|
||||
description = ''
|
||||
Prometheus ${name} exporter service user
|
||||
|
@ -138,7 +141,7 @@ let
|
|||
inherit (conf) group;
|
||||
};
|
||||
});
|
||||
users.groups = (mkIf (conf.group == "${name}-exporter") {
|
||||
users.groups = (mkIf (conf.group == "${name}-exporter" && !enableDynamicUser) {
|
||||
"${name}-exporter" = {};
|
||||
});
|
||||
networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
|
||||
|
@ -151,7 +154,8 @@ let
|
|||
serviceConfig.Restart = mkDefault "always";
|
||||
serviceConfig.PrivateTmp = mkDefault true;
|
||||
serviceConfig.WorkingDirectory = mkDefault /tmp;
|
||||
} serviceOpts ] ++ optional (!(serviceOpts.serviceConfig.DynamicUser or false)) {
|
||||
serviceConfig.DynamicUser = mkDefault enableDynamicUser;
|
||||
} serviceOpts ] ++ optional (!enableDynamicUser) {
|
||||
serviceConfig.User = conf.user;
|
||||
serviceConfig.Group = conf.group;
|
||||
});
|
||||
|
|
|
@ -39,7 +39,6 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-bind-exporter}/bin/bind_exporter \
|
||||
-web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -18,7 +18,6 @@ in
|
|||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
AmbientCapabilities = [ "CAP_NET_RAW" ]; # for ping probes
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-blackbox-exporter}/bin/blackbox_exporter \
|
||||
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -64,7 +64,6 @@ in
|
|||
'' else "";
|
||||
in {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-collectd-exporter}/bin/collectd_exporter \
|
||||
-log.format ${cfg.logFormat} \
|
||||
|
|
|
@ -26,7 +26,6 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-dnsmasq-exporter}/bin/dnsmasq_exporter \
|
||||
--listen ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -59,6 +59,7 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = false;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-dovecot-exporter}/bin/dovecot_exporter \
|
||||
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -26,7 +26,6 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-fritzbox-exporter}/bin/exporter \
|
||||
-listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -24,7 +24,6 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \
|
||||
--port ${toString cfg.port} \
|
||||
|
|
|
@ -143,6 +143,7 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = false;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-mail-exporter}/bin/mailexporter \
|
||||
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -50,7 +50,6 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-minio-exporter}/bin/minio-exporter \
|
||||
-web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -34,7 +34,6 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-nginx-exporter}/bin/nginx-prometheus-exporter \
|
||||
--nginx.scrape-uri '${cfg.scrapeUri}' \
|
||||
|
|
|
@ -27,6 +27,7 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = false;
|
||||
RuntimeDirectory = "prometheus-node-exporter";
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-node-exporter}/bin/node_exporter \
|
||||
|
|
|
@ -62,6 +62,7 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = false;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
|
||||
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -34,6 +34,7 @@ in
|
|||
serviceOpts = {
|
||||
environment.DATA_SOURCE_NAME = cfg.dataSourceName;
|
||||
serviceConfig = {
|
||||
DynamicUser = false;
|
||||
User = mkIf cfg.runAsLocalSuperUser (mkForce "postgres");
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \
|
||||
|
|
|
@ -57,7 +57,6 @@ in
|
|||
else "${pkgs.writeText "snmp-eporter-conf.yml" (builtins.toJSON cfg.configuration)}";
|
||||
in {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-snmp-exporter.bin}/bin/snmp_exporter \
|
||||
--config.file=${configFile} \
|
||||
|
|
|
@ -20,7 +20,6 @@ in
|
|||
description = "Prometheus exporter for surfboard cable modem";
|
||||
unitConfig.Documentation = "https://github.com/ipstatic/surfboard_exporter";
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-surfboard-exporter}/bin/surfboard_exporter \
|
||||
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -26,7 +26,6 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-tor-exporter}/bin/prometheus-tor-exporter \
|
||||
-b ${cfg.listenAddress} \
|
||||
|
|
|
@ -51,7 +51,6 @@ in
|
|||
};
|
||||
serviceOpts = {
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-unifi-exporter}/bin/unifi_exporter \
|
||||
-telemetry.addr ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -69,6 +69,7 @@ in
|
|||
path = [ pkgs.varnish ];
|
||||
serviceConfig = {
|
||||
RestartSec = mkDefault 1;
|
||||
DynamicUser = false;
|
||||
ExecStart = ''
|
||||
${pkgs.prometheus-varnish-exporter}/bin/prometheus_varnish_exporter \
|
||||
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
|
||||
|
|
|
@ -47,7 +47,6 @@ in {
|
|||
path = [ pkgs.wireguard-tools ];
|
||||
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
AmbientCapabilities = [ "CAP_NET_ADMIN" ];
|
||||
};
|
||||
};
|
||||
|
|
|
@ -191,7 +191,6 @@ let
|
|||
mail = {
|
||||
exporterConfig = {
|
||||
enable = true;
|
||||
user = "mailexporter";
|
||||
configuration = {
|
||||
monitoringInterval = "2s";
|
||||
mailCheckTimeout = "10s";
|
||||
|
@ -199,9 +198,9 @@ let
|
|||
name = "testserver";
|
||||
server = "localhost";
|
||||
port = 25;
|
||||
from = "mailexporter@localhost";
|
||||
to = "mailexporter@localhost";
|
||||
detectionDir = "/var/spool/mail/mailexporter/new";
|
||||
from = "mail-exporter@localhost";
|
||||
to = "mail-exporter@localhost";
|
||||
detectionDir = "/var/spool/mail/mail-exporter/new";
|
||||
} ];
|
||||
};
|
||||
};
|
||||
|
@ -211,7 +210,7 @@ let
|
|||
after = [ "postfix.service" ];
|
||||
requires = [ "postfix.service" ];
|
||||
preStart = ''
|
||||
mkdir -p 0600 mailexporter/new
|
||||
mkdir -p 0600 mail-exporter/new
|
||||
'';
|
||||
serviceConfig = {
|
||||
ProtectHome = true;
|
||||
|
|
Loading…
Reference in a new issue