From 39c0694709db9a9b31505f39aecffa06367cc172 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 19 Jul 2022 16:08:15 +0200 Subject: [PATCH 1/4] nixos/prometheus-mail-exporter: support storing `passphrase` outside of the store --- .../monitoring/prometheus/exporters/mail.nix | 18 +++++++++++++++--- nixos/tests/prometheus-exporters.nix | 8 +++++--- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/nixos/modules/services/monitoring/prometheus/exporters/mail.nix b/nixos/modules/services/monitoring/prometheus/exporters/mail.nix index 956bd96aa454..c0b8b3570c07 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/mail.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/mail.nix @@ -5,6 +5,8 @@ with lib; let cfg = config.services.prometheus.exporters.mail; + configFile = if cfg.configuration != null then configurationFile else (escapeShellArg cfg.configFile); + configurationFile = pkgs.writeText "prometheus-mail-exporter.conf" (builtins.toJSON ( # removes the _module attribute, null values and converts attrNames to lowercase mapAttrs' (name: value: @@ -137,6 +139,13 @@ in { port = 9225; extraOpts = { + environmentFile = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + File containing env-vars to be substituted into the exporter's config. + ''; + }; configFile = mkOption { type = types.nullOr types.path; default = null; @@ -162,13 +171,16 @@ in serviceOpts = { serviceConfig = { DynamicUser = false; + EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ]; + RuntimeDirectory = "prometheus-mail-exporter"; + ExecStartPre = [ + "${pkgs.envsubst}/bin/envsubst -i ${configFile} -o \${RUNTIME_DIRECTORY}/mail-exporter.json" + ]; ExecStart = '' ${pkgs.prometheus-mail-exporter}/bin/mailexporter \ --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \ --web.telemetry-path ${cfg.telemetryPath} \ - --config.file ${ - if cfg.configuration != null then configurationFile else (escapeShellArg cfg.configFile) - } \ + --config.file ''${RUNTIME_DIRECTORY}/mail-exporter.json \ ${concatStringsSep " \\\n " cfg.extraFlags} ''; }; diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix index a3092d101d87..0a1ec824986a 100644 --- a/nixos/tests/prometheus-exporters.nix +++ b/nixos/tests/prometheus-exporters.nix @@ -557,10 +557,12 @@ let systemd.services.prometheus-mail-exporter = { after = [ "postfix.service" ]; requires = [ "postfix.service" ]; - preStart = '' - mkdir -p -m 0700 mail-exporter/new - ''; serviceConfig = { + ExecStartPre = [ + "${pkgs.writeShellScript "create-maildir" '' + mkdir -p -m 0700 mail-exporter/new + ''}" + ]; ProtectHome = true; ReadOnlyPaths = "/"; ReadWritePaths = "/var/spool/mail"; From 81add6600cba1e6a896fd0dc413e44f52bb0d601 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Wed, 20 Jul 2022 20:12:46 +0200 Subject: [PATCH 2/4] nixos/privacyidea-ldap-proxy: umask to avoid accidental world-readability --- nixos/modules/services/security/privacyidea.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix index 13e27f255068..1f5639d475e8 100644 --- a/nixos/modules/services/security/privacyidea.nix +++ b/nixos/modules/services/security/privacyidea.nix @@ -332,6 +332,7 @@ in [ cfg.ldap-proxy.environmentFile ]; ExecStartPre = "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" '' + umask 0077 ${pkgs.envsubst}/bin/envsubst \ -i ${ldapProxyConfig} \ -o $STATE_DIRECTORY/ldap-proxy.ini From 590e60d124fb93934d03e8c740ca738657cc1816 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Wed, 20 Jul 2022 20:15:53 +0200 Subject: [PATCH 3/4] nixos/mxisd: umask to avoid accidental world-readability --- nixos/modules/services/networking/mxisd.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/networking/mxisd.nix b/nixos/modules/services/networking/mxisd.nix index 5b1e0dee8e35..1509671bc54a 100644 --- a/nixos/modules/services/networking/mxisd.nix +++ b/nixos/modules/services/networking/mxisd.nix @@ -130,6 +130,7 @@ in { EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ]; ExecStart = "${cfg.package}/bin/${executable} -c ${cfg.dataDir}/mxisd-config.yaml"; ExecStartPre = "${pkgs.writeShellScript "mxisd-substitute-secrets" '' + umask 0077 ${pkgs.envsubst}/bin/envsubst -o ${cfg.dataDir}/mxisd-config.yaml \ -i ${configFile} ''}"; From 92bd77e85e024c4a58e00cb9f6ff1e6e501ddf02 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Wed, 20 Jul 2022 20:21:16 +0200 Subject: [PATCH 4/4] nixos/prometheus-mail-exporter: umask to avoid accidental world-readability --- .../services/monitoring/prometheus/exporters/mail.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/monitoring/prometheus/exporters/mail.nix b/nixos/modules/services/monitoring/prometheus/exporters/mail.nix index c0b8b3570c07..a60f47f63932 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/mail.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/mail.nix @@ -174,7 +174,10 @@ in EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ]; RuntimeDirectory = "prometheus-mail-exporter"; ExecStartPre = [ - "${pkgs.envsubst}/bin/envsubst -i ${configFile} -o \${RUNTIME_DIRECTORY}/mail-exporter.json" + "${pkgs.writeShellScript "subst-secrets-mail-exporter" '' + umask 0077 + ${pkgs.envsubst}/bin/envsubst -i ${configFile} -o ''${RUNTIME_DIRECTORY}/mail-exporter.json + ''}" ]; ExecStart = '' ${pkgs.prometheus-mail-exporter}/bin/mailexporter \