yadunut/clan-core
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

clanServices: jail telegraf-json to not write to tmp dir

Browse Source
This commit is contained in:
Qubasa
2025-09-18 01:38:30 +02:00
parent eb321df10d
commit bc521a1b9b
2 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
clanServices/monitoring/telegraf.nix
View File

@@ -11,7 +11,6 @@
... ...
}: }:
let let
jsonpath = "/tmp/telegraf.json";
auth_user = "prometheus"; auth_user = "prometheus";
in in
{ {
@@ -59,9 +58,22 @@
after = [ "telegraf.service" ]; after = [ "telegraf.service" ];
wants = [ "telegraf.service" ]; wants = [ "telegraf.service" ];
serviceConfig = { serviceConfig = {
LoadCredential = [
"auth_file_path:${config.clan.core.vars.generators.telegraf.files.miniserve-auth.path}"
];
Environment = [
"AUTH_FILE_PATH=%d/auth_file_path"
];
Restart = "on-failure"; Restart = "on-failure";
User = "telegraf";
Group = "telegraf";
}; };
script = "${pkgs.miniserve}/bin/miniserve -p 9990 ${jsonpath} --auth-file ${config.clan.core.vars.generators.telegraf.files.miniserve-auth.path}"; script = "${pkgs.miniserve}/bin/miniserve -p 9990 /var/lib/telegraf/telegraf.json --auth-file \"$AUTH_FILE_PATH\"";
};
users.users.telegraf = {
home = "/var/lib/telegraf";
createHome = true;
}; };
services.telegraf = { services.telegraf = {
@@ -107,7 +119,7 @@
}; };
outputs.file = { outputs.file = {
files = [ jsonpath ]; files = [ "/var/lib/telegraf/telegraf.json" ];
data_format = "json"; data_format = "json";
json_timestamp_units = "1s"; json_timestamp_units = "1s";
}; };

1
clanServices/monitoring/tests/vm/default.nix
View File

@@ -54,6 +54,7 @@
peer1.wait_for_unit("network-online.target") peer1.wait_for_unit("network-online.target")
peer1.wait_for_unit("telegraf.service") peer1.wait_for_unit("telegraf.service")
peer1.wait_for_unit("telegraf-json.service") peer1.wait_for_unit("telegraf-json.service")
peer1.succeed("curl http://localhost:9990") peer1.succeed("curl http://localhost:9990")
peer1.succeed("curl http://localhost:9273/metrics") peer1.succeed("curl http://localhost:9273/metrics")