Unverified Commit 6c69cfb8 authored by Leona Maroni's avatar Leona Maroni
Browse files

nixos/vmagent: use dynamic user and cache directory

parent e0638909

nixos/doc/manual/release-notes/rl-2405.section.md

+4 −0
Original line number Diff line number Diff line
@@ -319,6 +319,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m 


- `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.



- `services.vmagent` module deprecates `dataDir`, `group` and `user` setting in favor of systemd provided CacheDirectory and DynamicUser.



- `services.vmagent.remoteWriteUrl` setting has been renamed to `services.vmagent.remoteWrite.url` and now defaults to `null`.



- `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200).



- `services.nginx` will no longer advertise HTTP/3 availability automatically. This must now be manually added, preferably to each location block.

nixos/modules/services/monitoring/vmagent.nix

+46 −48
Original line number Diff line number Diff line
@@ -4,42 +4,41 @@ let 
  cfg = config.services.vmagent;

  settingsFormat = pkgs.formats.json { };

in {

  imports = [

    (lib.mkRemovedOptionModule [ "services" "vmagent" "dataDir" ] "dataDir has been deprecated in favor of systemd provided CacheDirectory")

    (lib.mkRemovedOptionModule [ "services" "vmagent" "user" ] "user has been deprecated in favor of systemd DynamicUser")

    (lib.mkRemovedOptionModule [ "services" "vmagent" "group" ] "group has been deprecated in favor of systemd DynamicUser")

    (lib.mkRenamedOptionModule [ "services" "vmagent" "remoteWriteUrl" ] [ "services" "vmagent" "remoteWrite" "url" ])

  ];



  options.services.vmagent = {

    enable = lib.mkEnableOption "vmagent";



    user = lib.mkOption {

      default = "vmagent";

      type = lib.types.str;

      description = ''

        User account under which vmagent runs.

      '';

    };

    package = lib.mkPackageOption pkgs "vmagent" { };



    group = lib.mkOption {

      type = lib.types.str;

      default = "vmagent";

    remoteWrite = {

      url = lib.mkOption {

        default = null;

        type = lib.types.nullOr lib.types.str;

        description = ''

        Group under which vmagent runs.

          Endpoint for prometheus compatible remote_write

        '';

      };



    package = lib.mkPackageOption pkgs "vmagent" { };



    dataDir = lib.mkOption {

      type = lib.types.str;

      default = "/var/lib/vmagent";

      basicAuthUsername = lib.mkOption {

        default = null;

        type = lib.types.nullOr lib.types.str;

        description = ''

        The directory where vmagent stores its data files.

          Basic Auth username used to connect to remote_write endpoint

        '';

      };



    remoteWriteUrl = lib.mkOption {

      default = "http://localhost:8428/api/v1/write";

      type = lib.types.str;

      basicAuthPasswordFile = lib.mkOption {

        default = null;

        type = lib.types.nullOr lib.types.str;

        description = ''

        The storage endpoint such as VictoriaMetrics

          File that contains the Basic Auth password used to connect to remote_write endpoint

        '';

      };

    };



    prometheusConfig = lib.mkOption {

      type = lib.types.submodule { freeformType = settingsFormat.type; };
@@ -68,36 +67,35 @@ in { 
  };



  config = lib.mkIf cfg.enable {

    users.groups = lib.mkIf (cfg.group == "vmagent") { vmagent = { }; };



    users.users = lib.mkIf (cfg.user == "vmagent") {

      vmagent = {

        group = cfg.group;

        description = "vmagent daemon user";

        home = cfg.dataDir;

        isSystemUser = true;

      };

    };



    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 8429 ];



    systemd.services.vmagent = let

      prometheusConfig = settingsFormat.generate "prometheusConfig.yaml" cfg.prometheusConfig;

      startCommandLine = lib.concatStringsSep " " ([

        "${cfg.package}/bin/vmagent"

        "-promscrape.config=${prometheusConfig}"

      ] ++ cfg.extraArgs

        ++ lib.optionals (cfg.remoteWrite.url != null) [

        "-remoteWrite.url=${cfg.remoteWrite.url}"

        "-remoteWrite.tmpDataPath=%C/vmagent/remote_write_tmp"

      ] ++ lib.optional (cfg.remoteWrite.basicAuthUsername != null) "-remoteWrite.basicAuth.username=${cfg.remoteWrite.basicAuthUsername}"

        ++ lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) "-remoteWrite.basicAuth.passwordFile=\${CREDENTIALS_DIRECTORY}/remote_write_basic_auth_password");

    in {

      wantedBy = [ "multi-user.target" ];

      after = [ "network.target" ];

      description = "vmagent system service";

      serviceConfig = {

        User = cfg.user;

        Group = cfg.group;

        DynamicUser = true;

        User = "vmagent";

        Group = "vmagent";

        Type = "simple";

        Restart = "on-failure";

        WorkingDirectory = cfg.dataDir;

        ExecStart = "${cfg.package}/bin/vmagent -remoteWrite.url=${cfg.remoteWriteUrl} -promscrape.config=${prometheusConfig} ${lib.escapeShellArgs cfg.extraArgs}";

        CacheDirectory = "vmagent";

        ExecStart = startCommandLine;

        LoadCredential = lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) [

          "remote_write_basic_auth_password:${cfg.remoteWrite.basicAuthPasswordFile}"

        ];

      };

    };



    systemd.tmpfiles.rules =

      [ "d '${cfg.dataDir}' 0755 ${cfg.user} ${cfg.group} -" ];

  };

}