about summary refs log tree commit diff
path: root/nixos/modules/services/monitoring
Commit message (Collapse)AuthorAge
* nixos/smartctl-exporter: fix typo in rawio capabMartin Weinelt2022-01-30
|
* prometheus.exporters.smartctl: Fix autodiscoveryMartin Weinelt2022-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When no devices are given the exporter tries to autodiscover available disks. The previous DevicePolicy was however preventing the exporter from accessing any device at all, since only explicitly mentioned ones were allowed. This commit adds an allow rule for several device classes that I could find on my machines, that gets set when no devices are explicitly configured. There is an existing problem with nvme devices, that expose a character device at `/dev/nvme0`, and a (namespaced) block device at `/dev/nvme0n1`. The character device does not come with permissions that we could give to the exporter without further impacting the hardening. crw------- 1 root root 247, 0 27. Jan 03:10 /dev/nvme0 brw-rw---- 1 root disk 259, 0 27. Jan 03:10 /dev/nvme0n1 The autodiscovery only finds the character device, which the exporter unfortunately does not have access to. However a simple udev rule can be used to resolve this: services.udev.extraRules = '' SUBSYSTEM=="nvme", KERNEL=="nvme[0-9]*", GROUP="disk" ''; Unfortunately I'm not fully aware of the security implications this change carries and we should question upstream (systemd) why they did not include such a rule. The disk group has no members on any of my machines. ❯ getent group disk disk:x:6:
* prometheus.exporters.smartctl: Allow RAWIOMartin Weinelt2022-01-27
| | | | | This allows the exporter to perform SCSI commands and interact with hpsa and cciss devices.
* nixos/netdata: expose /etc/netdatamisuzu2022-01-10
|
* nixos/netdata: add configDir optionmisuzu2022-01-10
| | | | | | | | This option makes the complete netdata configuration directory available for modification. The default configuration is merged with changes defined in the configDir option. Co-authored-by: Michael Raitza <spacefrogg-github@meterriblecrew.net>
* nixos/prometheus: fix usage of bearer_tokenSandro Jäckel2022-01-08
|
* prometheus: add authorization sectionJörg Thalheim2022-01-03
|
* Merge pull request #149704 from squalus/nginx-prometheus-exporter-fixBobby Rong2021-12-23
|\ | | | | nixos/prometheus-nginx-exporter: fix argument syntax
| * nixos/prometheus-nginx-exporter: fix argument syntaxsqualus2021-12-08
| | | | | | | | | | | | | | | | | | Arguments were being ignored because the program expects an equals sign to separate the argument name from the value. Documented in https://github.com/nginxinc/nginx-prometheus-exporter/issues/153 Fixes #107541
* | nixos/collectd: validate config file syntax at build timeGuillaume Girol2021-12-23
| |
* | services.prometheus.exporters.fastly: add a smoke testGraham Christensen2021-12-20
| |
* | services.prometheus.exporters.fastly: fixup broken module configGraham Christensen2021-12-20
| |
* | Merge pull request #148785 from pennae/more-option-doc-staticizingGraham Christensen2021-12-17
|\ \ | |/ |/| treewide: more defaultText for options
| * treewide: add defaultText to remaining optionspennae2021-12-09
| | | | | | | | | | these are mostly options that use alias bindings, bindings to constants, or bindings to calculated values.
| * treewide: add defaultText for options using other shortcut bindingspennae2021-12-09
| |
| * treewide: add literalDocBook text to options with complex defaultspennae2021-12-09
| | | | | | | | | | | | | | | | some options have default that are best described in prose, such as defaults that depend on the system stateVersion, defaults that are derivations specific to the surrounding context, or those where the expression is much longer and harder to understand than a simple text snippet.
| * treewide: add defaultText for options with simple cfg.* expression defaultspennae2021-12-09
| | | | | | | | | | adds defaultText for options with defaults that use only literals, full config.* paths, and the cfg shortcut binding.
| * treewide: add defaultText for options with simple interpolation defaultspennae2021-12-09
| | | | | | | | | | | | adds defaultText for all options that use `cfg.*` values in their defaults, but only for interpolations with no extra processing (other than toString where necessary)
| * treewide: set defaultText for options using simple path defaultspennae2021-12-09
| | | | | | | | | | adds defaultText for all options that set their default to a path expression using the ubiquitous `cfg` shortcut bindings.
* | Merge pull request #147441 from pennae/option-doc-staticizingRobert Hensing2021-12-06
|\ \ | | | | | | nixos/*: add trivial defaultText to options where applicable
| * | nixos/*: add trivial defaultText for options with simple defaultspennae2021-12-02
| |/
* | Merge pull request #148729 from bjornfor/add-missing-collectd-group-v2Jörg Thalheim2021-12-05
|\ \ | | | | | | nixos/collectd: add missing group
| * | nixos/collectd: add missing groupBjørn Forsman2021-12-05
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | While upgrading my NixOS system I was greeted by this error: error: Failed assertions: - users.users.collectd.group is unset. This used to default to nogroup, but this is unsafe. For example you can create a group for this user with: users.users.collectd.group = "collectd"; users.groups.collectd = {}; Let's fix it.
* | Merge pull request #147056 from mweinelt/smartctl-exporterMartin Weinelt2021-12-05
|\ \
| * | nixos/smartctl-exporter: initMartin Weinelt2021-11-23
| |/
* / nixos/prometheus-postfix-exporter: whitelist addr-family `AF_UNIX`Maximilian Bosch2021-12-03
|/ | | | | | | | Otherwise, `postfix_up{path="/var/lib/postfix/queue/public/showq"}` will always be `0` indicating an postfix outage because this is a unix domain socket that cannot be connected to: 2021/12/03 14:50:46 Failed to scrape showq socket: dial unix /var/lib/postfix/queue/public/showq: socket: address family not supported by protocol
* prometheus-nginx-exporter: boolean conversion to stringMarek Mahut2021-11-19
|
* Merge pull request #146420 from Artturin/cadvisorfixArtturi2021-11-18
|\
| * nixos/cadvisor: add zfs to path when zfs enabledArtturin2021-11-17
| | | | | | | | fixes https://github.com/NixOS/nixpkgs/issues/105139
* | Merge pull request #146409 from aanderse/zabbixMichele Guerini Rocco2021-11-17
|\ \ | |/ |/| nixos/zabbixServer: explicitely set security.wrappers ownership
| * nixos/zabbixServer: explicitely set security.wrappers ownershipAaron Andersen2021-11-17
| |
* | Merge pull request #141551 from astro/collectd-plugin-configSandro2021-11-10
|\ \
| * | nixos/collectd: give plugins option a mergeable typeAstro2021-11-08
| |/
* | nixos/prometheus: throw a helpful error when ↵Bas van Dijk2021-11-07
| | | | | | | | services.prometheus.environmentFile is defined
* | nixos/prometheus: remove services.prometheus.environmentFileBas van Dijk2021-11-07
|/ | | | The option `services.prometheus.environmentFile` has been removed since it was causing [issues](https://github.com/NixOS/nixpkgs/issues/126083) and Prometheus now has native support for secret files.
* nixos/prometheus: add remaining service discovery optionsYannik Rödel2021-11-05
|
* nixos/prometheus: add service discovery optionsYannik Rödel2021-11-04
|
* nixos/prometheus: add new configuration optionsYannik Rödel2021-11-04
|
* Merge pull request #143147 from basvandijk/prometheus-reloadBas van Dijk2021-11-04
|\ | | | | nixos/prometheus: optionally support reloading on config changes
| * module/prometheus: optionally support reloading on config changesBas van Dijk2021-11-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The new option `services.prometheus.enableReload` has been introduced which, when enabled, causes the prometheus systemd service to reload when its config file changes. More specifically the following property holds: switching to a configuration (`switch-to-configuration`) that changes the prometheus configuration only finishes successully when prometheus has finished loading the new configuration. `enableReload` is `false` by default in which case the old semantics of restarting the prometheus systemd service are in effect.
* | Merge pull request #136191 from LeSuisse/nixos-unifi-poller-lokiPascal Bach2021-11-03
|\ \ | |/ |/| nixos/unifi-poller: add support of Loki
| * nixos/unifi-poller: add support of LokiThomas Gerbet2021-08-30
| | | | | | | | | | | | | | | | Since the v2.0.2 unifi-poller supports Loki [0][1], this contribution adds the options so it can be used. [0] https://github.com/unpoller/unpoller/releases/tag/v2.0.2-beta1 [1] https://unpoller.com/docs/dependencies/loki/
* | nixos/grafana: fix systemd unitAlexandre Iooss2021-10-23
| | | | | | | | | | | | | | | | | | | | | | Remove MemoryDenyWriteExecute hardening as it breaks image rendering plugin. Add CAP_NET_BIND_SERVICE to bind to low ports when needed. Remove PrivateUsers and ProcSubset as upstream choose to remove it. Upstream changes: <https://github.com/grafana/grafana/pull/40219>, <https://github.com/grafana/grafana/pull/40178>, <https://github.com/grafana/grafana/pull/40339> and <https://github.com/grafana/grafana/pull/40815>.
* | nixos/prometheus: add hardening exceptions to node-exporterMartin Weinelt2021-10-18
| | | | | | | | | | Conditionally grants access for the logind, wifi and network_route collectors.
* | nixos/prometheus-rtl_433-exporter: fix systemd hardeningAlexandre Macabies2021-10-16
| | | | | | | | | | | | | | | | | | | | | | 9fea6d4c8551b7c8783f23e011a2ba113c95d0dd broke rtl_433-exporter by introducing several hardening options which do not play well with rtl_433 requiring writing to USB. More precisely, rtl_433 requires (a) AF_NETLINK to configure the radio; (b) access to the USB device, but PrivateDevices=true hides them; (c) rw access to the USB device, but DeviceAllow= block-lists everything. This commit was tested on real hardware with a standard NixOS setup.
* | nixos/prometheus: fix node exporter timex collectorMatthias Treydte2021-10-14
| | | | | | | | | | | | | | | | The timex collector (enabled by default) needs the adjtimex syscall, which was disabled by 9fea6d4c8551b7c8783f23e011a2ba113c95d0dd. So allow it unless the timex collector is disabled.
* | nixos/prometheus: fix node exporter systemd collectorMatthias Treydte2021-10-14
| | | | | | | | | | | | | | | | The systemd collector needs AF_UNIX to talk to /var/run/dbus/system_bus_socket, which was broken with 9fea6d4c8551b7c8783f23e011a2ba113c95d0dd. This commit allows AF_UNIX when needed.
* | Merge pull request #140076 from ↵Arseniy Seroka2021-10-12
|\ \ | | | | | | | | | | | | jraygauthier/jrg/96633_fix-teamviewer-client-server-issue teamviewer: fix #96633, #44307 and #97148 + 15.15.5 -> 15.18.5 -> 15.22.3
| * | nixos/teamviewer: fix issue #44307Raymond Gauthier2021-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move to a forefront launch of the daemon. Doing so allowed us to move the service from forking to simple to avoid the missing pid error log. Also: - Make the dbus dependency explicit.
| * | nixos/teamviewer: fix issue #96633Raymond Gauthier2021-09-30
| | | | | | | | | | | | | | | Add teamviewer package as a dbus package now that the client / server communication depends on dbus.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-21 15:05:48 +0000