mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-06-30 21:15:21 +03:00
86a6ef5f15
smartctl_exporter already runs with SupplementaryGroups "disk", which gives full access to SATA drives, but NVMe devices are owned by root:root, resulting in no access: [...] msg="Smartctl open device: /dev/nvme0 failed: Permission denied" This patch introduces a "smartctl-exporter-access" supplementary group, and an udev rule with setfacl to give the exporter access to NVMe drives, without changing the base root:root ownership. Fixes https://github.com/NixOS/nixpkgs/issues/210041
65 lines
1.6 KiB
Nix
65 lines
1.6 KiB
Nix
{ config, lib, pkgs, options, ... }:
|
|
|
|
let
|
|
cfg = config.services.prometheus.exporters.smartctl;
|
|
|
|
inherit (lib) mkOption types literalExpression;
|
|
|
|
args = lib.escapeShellArgs ([
|
|
"--web.listen-address=${cfg.listenAddress}:${toString cfg.port}"
|
|
"--smartctl.interval=${cfg.maxInterval}"
|
|
] ++ map (device: "--smartctl.device=${device}") cfg.devices
|
|
++ cfg.extraFlags);
|
|
|
|
in
|
|
{
|
|
port = 9633;
|
|
|
|
extraOpts = {
|
|
devices = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ ];
|
|
example = literalExpression ''
|
|
[ "/dev/sda", "/dev/nvme0n1" ];
|
|
'';
|
|
description = ''
|
|
Paths to the disks that will be monitored. Will autodiscover
|
|
all disks if none given.
|
|
'';
|
|
};
|
|
|
|
maxInterval = mkOption {
|
|
type = types.str;
|
|
default = "60s";
|
|
example = "2m";
|
|
description = ''
|
|
Interval that limits how often a disk can be queried.
|
|
'';
|
|
};
|
|
};
|
|
|
|
serviceOpts = {
|
|
serviceConfig = {
|
|
AmbientCapabilities = [
|
|
"CAP_SYS_RAWIO"
|
|
"CAP_SYS_ADMIN"
|
|
];
|
|
CapabilityBoundingSet = [
|
|
"CAP_SYS_RAWIO"
|
|
"CAP_SYS_ADMIN"
|
|
];
|
|
DevicePolicy = "closed";
|
|
DeviceAllow = lib.mkOverride 50 [
|
|
"block-blkext rw"
|
|
"block-sd rw"
|
|
"char-nvme rw"
|
|
];
|
|
ExecStart = "${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter ${args}";
|
|
PrivateDevices = lib.mkForce false;
|
|
ProtectProc = "invisible";
|
|
ProcSubset = "pid";
|
|
SupplementaryGroups = [ "disk" "smartctl-exporter-access" ];
|
|
SystemCallFilter = [ "@system-service" "~@privileged" ];
|
|
};
|
|
};
|
|
}
|