diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index 37dab65d2eba..d5ca4a555459 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -119,6 +119,8 @@ - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable). +- [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available under [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable). + - [Actual Budget](https://actualbudget.org/), a local-first personal finance app. Available as [services.actual](#opt-services.actual.enable). - [immich-public-proxy](https://github.com/alangrainger/immich-public-proxy), a proxy for sharing Immich albums without exposing the Immich API. Available as [services.immich-public-proxy](#opt-services.immich-public-proxy.enable). diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix index f805920c5b87..b67f41c4fb12 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters.nix @@ -66,6 +66,7 @@ let "nginx" "nginxlog" "node" + "node-cert" "nut" "nvidia-gpu" "pgbouncer" diff --git a/nixos/modules/services/monitoring/prometheus/exporters/node-cert.nix b/nixos/modules/services/monitoring/prometheus/exporters/node-cert.nix new file mode 100644 index 000000000000..d8b2004e8e85 --- /dev/null +++ b/nixos/modules/services/monitoring/prometheus/exporters/node-cert.nix @@ -0,0 +1,70 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.prometheus.exporters.node-cert; + inherit (lib) mkOption types concatStringsSep; +in +{ + port = 9141; + + extraOpts = { + paths = mkOption { + type = types.listOf types.str; + description = '' + List of paths to search for SSL certificates. + ''; + }; + + excludePaths = mkOption { + type = types.listOf types.str; + description = '' + List of paths to exclute from searching for SSL certificates. + ''; + default = [ ]; + }; + + includeGlobs = mkOption { + type = types.listOf types.str; + description = '' + List files matching a pattern to include. Uses Go blob pattern. + ''; + default = [ ]; + }; + + excludeGlobs = mkOption { + type = types.listOf types.str; + description = '' + List files matching a pattern to include. Uses Go blob pattern. + ''; + default = [ ]; + }; + + user = mkOption { + type = types.str; + description = '' + User owning the certs. + ''; + default = "acme"; + }; + }; + + serviceOpts = { + serviceConfig = { + User = cfg.user; + ExecStart = '' + ${lib.getExe pkgs.prometheus-node-cert-exporter} \ + --listen ${toString cfg.listenAddress}:${toString cfg.port} \ + --path ${concatStringsSep "," cfg.paths} \ + --exclude-path "${concatStringsSep "," cfg.excludePaths}" \ + --include-glob "${concatStringsSep "," cfg.includeGlobs}" \ + --exclude-glob "${concatStringsSep "," cfg.excludeGlobs}" \ + ${concatStringsSep " \\\n " cfg.extraFlags} + ''; + }; + }; +} diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix index 3afe4fcc9579..be11bddb9329 100644 --- a/nixos/tests/prometheus-exporters.nix +++ b/nixos/tests/prometheus-exporters.nix @@ -1002,6 +1002,49 @@ let ''; }; + node-cert = { + nodeName = "node_cert"; + exporterConfig = { + enable = true; + paths = ["/run/certs"]; + }; + exporterTest = '' + wait_for_unit("prometheus-node-cert-exporter.service") + wait_for_open_port(9141) + wait_until_succeeds( + "curl -sSf http://localhost:9141/metrics | grep 'ssl_certificate_expiry_seconds{.\\+path=\"/run/certs/node-cert\\.cert\".\\+}'" + ) + ''; + + metricProvider = { + system.activationScripts.cert.text = '' + mkdir -p /run/certs + cd /run/certs + + cat >ca.template <