mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-07-04 23:02:38 +03:00
fdcc9e8202
Setting up the DeviceAllow list with explicitly configured devices was a nice idea, but sometimes a configured device (`/dev/nvme0n1` an NVMe namespace) has a parent device (`/dev/nvme0`) that smartctl needs to access to query metrics. Falling back to the block and character definitions is probably a valid fallback.
64 lines
1.6 KiB
Nix
64 lines
1.6 KiB
Nix
{ config, lib, pkgs, options }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.prometheus.exporters.smartctl;
|
|
args = concatStrings [
|
|
"--web.listen-address=\"${cfg.listenAddress}:${toString cfg.port}\" "
|
|
"--smartctl.path=\"${pkgs.smartmontools}/bin/smartctl\" "
|
|
"--smartctl.interval=\"${cfg.maxInterval}\" "
|
|
"${concatMapStringsSep " " (device: "--smartctl.device=${device}") cfg.devices}"
|
|
];
|
|
in {
|
|
port = 9633;
|
|
|
|
extraOpts = {
|
|
devices = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
example = literalExpression ''
|
|
[ "/dev/sda", "/dev/nvme0n1" ];
|
|
'';
|
|
description = lib.mdDoc ''
|
|
Paths to the disks that will be monitored. Will autodiscover
|
|
all disks if none given.
|
|
'';
|
|
};
|
|
maxInterval = mkOption {
|
|
type = types.str;
|
|
default = "60s";
|
|
example = "2m";
|
|
description = lib.mdDoc ''
|
|
Interval that limits how often a disk can be queried.
|
|
'';
|
|
};
|
|
};
|
|
|
|
serviceOpts = {
|
|
serviceConfig = {
|
|
AmbientCapabilities = [
|
|
"CAP_SYS_RAWIO"
|
|
"CAP_SYS_ADMIN"
|
|
];
|
|
CapabilityBoundingSet = [
|
|
"CAP_SYS_RAWIO"
|
|
"CAP_SYS_ADMIN"
|
|
];
|
|
DevicePolicy = "closed";
|
|
DeviceAllow = lib.mkOverride 50 [
|
|
"block-blkext rw"
|
|
"block-sd rw"
|
|
"char-nvme rw"
|
|
];
|
|
ExecStart = ''
|
|
${pkgs.prometheus-smartctl-exporter}/bin/smartctl_exporter ${args}
|
|
'';
|
|
PrivateDevices = lib.mkForce false;
|
|
ProtectProc = "invisible";
|
|
ProcSubset = "pid";
|
|
SupplementaryGroups = [ "disk" ];
|
|
SystemCallFilter = [ "@system-service" "~@privileged" ];
|
|
};
|
|
};
|
|
}
|