movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

Merge pull request #325133 from jpds/nixos-prometheus-hardening

Browse source 
nixos/prometheus: systemd hardening for alertmanager/pushgateway
This commit is contained in:
Aaron Andersen 2024-07-07 16:22:35 -04:00 • committed by GitHub
commit aa3e6fadd2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 106 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nixos/tests/prometheus/alertmanager.nix
View file

@ -144,5 +144,9 @@ import ../make-test-python.nix ({ lib, pkgs, ... }:
logger.wait_until_succeeds(
"journalctl -o cat -u alertmanager-webhook-logger.service | grep '\"alertname\":\"InstanceDown\"'"
)
logger.log(logger.succeed("systemd-analyze security alertmanager-webhook-logger.service | grep -v '✓'"))
alertmanager.log(alertmanager.succeed("systemd-analyze security alertmanager.service | grep -v '✓'"))
'';
})

2
nixos/tests/prometheus/pushgateway.nix
View file

@ -90,5 +90,7 @@ import ../make-test-python.nix ({ lib, pkgs, ... }:
"curl -sf 'http://127.0.0.1:9090/api/v1/query?query=absent(some_metric)' | "
+ "jq '.data.result[0].value[1]' | grep '\"1\"'"
)
pushgateway.log(pushgateway.succeed("systemd-analyze security pushgateway.service | grep -v '✓'"))
'';
})