From 7e0588b2fba3dfedd583933eff8bd6820b073483 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Tue, 27 Dec 2022 04:47:21 +0100 Subject: [PATCH] nixos/grafana: listen on localhost by default (again) --- .../manual/from_md/release-notes/rl-2305.section.xml | 8 ++++++++ nixos/doc/manual/release-notes/rl-2305.section.md | 2 ++ nixos/modules/services/monitoring/grafana.nix | 10 ++++++++-- 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml index c05caa122b14..828dbee2125e 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml @@ -339,6 +339,14 @@ NixOS manual. + + + services.grafana listens only on localhost + by default again. This was changed to upstreams default of + 0.0.0.0 by accident in the freeform setting + conversion. + + A new virtualisation.rosetta module was diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 2d05d092f5b6..5933cb4f861f 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -95,6 +95,8 @@ In addition to numerous new and upgraded packages, this release has the followin - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual. +- `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion. + - A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=unstable&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm). - The new option `users.motdFile` allows configuring a Message Of The Day that can be updated dynamically. diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix index 9a9a0ab75532..9cce4c71d964 100644 --- a/nixos/modules/services/monitoring/grafana.nix +++ b/nixos/modules/services/monitoring/grafana.nix @@ -364,9 +364,15 @@ in { }; http_addr = mkOption { - description = lib.mdDoc "Listening address."; - default = ""; type = types.str; + default = "127.0.0.1"; + description = lib.mdDoc '' + Listening address. + + ::: {.note} + This setting intentionally varies from upstream's default to be a bit more secure by default. + ::: + ''; }; http_port = mkOption {