From 1f52ec9f95614d616ab29254d62a375aa152dcb6 Mon Sep 17 00:00:00 2001 From: ibizaman Date: Wed, 25 Dec 2024 23:10:04 +0100 Subject: [PATCH] prometheus-node-cert-exporter: init at 1.1.7-unstable-2024-12-26 --- .../manual/release-notes/rl-2505.section.md | 2 + .../monitoring/prometheus/exporters.nix | 1 + .../prometheus/exporters/node-cert.nix | 70 +++++++++++++++++++ nixos/tests/prometheus-exporters.nix | 43 ++++++++++++ .../prometheus-node-cert-exporter/gomod.patch | 33 +++++++++ .../prometheus-node-cert-exporter/package.nix | 33 +++++++++ 6 files changed, 182 insertions(+) create mode 100644 nixos/modules/services/monitoring/prometheus/exporters/node-cert.nix create mode 100644 pkgs/by-name/pr/prometheus-node-cert-exporter/gomod.patch create mode 100644 pkgs/by-name/pr/prometheus-node-cert-exporter/package.nix diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md index d55c94795ea6..ecf8e3be55a4 100644 --- a/nixos/doc/manual/release-notes/rl-2505.section.md +++ b/nixos/doc/manual/release-notes/rl-2505.section.md @@ -69,6 +69,8 @@ - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable). +- [Prometheus Node Cert Exporter](https://github.com/amimof/node-cert-exporter), a prometheus exporter to check for SSL cert expiry. Available under [services.prometheus.exporters.node-cert](#opt-services.prometheus.exporters.node-cert.enable). + - [Actual Budget](https://actualbudget.org/), a local-first personal finance app. Available as [services.actual](#opt-services.actual.enable). - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable). diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix index f805920c5b87..b67f41c4fb12 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters.nix @@ -66,6 +66,7 @@ let "nginx" "nginxlog" "node" + "node-cert" "nut" "nvidia-gpu" "pgbouncer" diff --git a/nixos/modules/services/monitoring/prometheus/exporters/node-cert.nix b/nixos/modules/services/monitoring/prometheus/exporters/node-cert.nix new file mode 100644 index 000000000000..d8b2004e8e85 --- /dev/null +++ b/nixos/modules/services/monitoring/prometheus/exporters/node-cert.nix @@ -0,0 +1,70 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.prometheus.exporters.node-cert; + inherit (lib) mkOption types concatStringsSep; +in +{ + port = 9141; + + extraOpts = { + paths = mkOption { + type = types.listOf types.str; + description = '' + List of paths to search for SSL certificates. + ''; + }; + + excludePaths = mkOption { + type = types.listOf types.str; + description = '' + List of paths to exclute from searching for SSL certificates. + ''; + default = [ ]; + }; + + includeGlobs = mkOption { + type = types.listOf types.str; + description = '' + List files matching a pattern to include. Uses Go blob pattern. + ''; + default = [ ]; + }; + + excludeGlobs = mkOption { + type = types.listOf types.str; + description = '' + List files matching a pattern to include. Uses Go blob pattern. + ''; + default = [ ]; + }; + + user = mkOption { + type = types.str; + description = '' + User owning the certs. + ''; + default = "acme"; + }; + }; + + serviceOpts = { + serviceConfig = { + User = cfg.user; + ExecStart = '' + ${lib.getExe pkgs.prometheus-node-cert-exporter} \ + --listen ${toString cfg.listenAddress}:${toString cfg.port} \ + --path ${concatStringsSep "," cfg.paths} \ + --exclude-path "${concatStringsSep "," cfg.excludePaths}" \ + --include-glob "${concatStringsSep "," cfg.includeGlobs}" \ + --exclude-glob "${concatStringsSep "," cfg.excludeGlobs}" \ + ${concatStringsSep " \\\n " cfg.extraFlags} + ''; + }; + }; +} diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix index c15a3fd20b02..f59d61e69b92 100644 --- a/nixos/tests/prometheus-exporters.nix +++ b/nixos/tests/prometheus-exporters.nix @@ -1002,6 +1002,49 @@ let ''; }; + node-cert = { + nodeName = "node_cert"; + exporterConfig = { + enable = true; + paths = ["/run/certs"]; + }; + exporterTest = '' + wait_for_unit("prometheus-node-cert-exporter.service") + wait_for_open_port(9141) + wait_until_succeeds( + "curl -sSf http://localhost:9141/metrics | grep 'ssl_certificate_expiry_seconds{.\\+path=\"/run/certs/node-cert\\.cert\".\\+}'" + ) + ''; + + metricProvider = { + system.activationScripts.cert.text = '' + mkdir -p /run/certs + cd /run/certs + + cat >ca.template <