From f46b9643cc72edcaa8ced795dbc3cad70972f4e1 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Thu, 23 Oct 2025 14:24:41 +0100 Subject: [PATCH 1/8] prometheus: Move assets to npmBuildPackage --- .../pr/prometheus/disable-react-app.diff | 10 +++ pkgs/by-name/pr/prometheus/package.nix | 82 ++++++++++++++----- 2 files changed, 71 insertions(+), 21 deletions(-) create mode 100644 pkgs/by-name/pr/prometheus/disable-react-app.diff diff --git a/pkgs/by-name/pr/prometheus/disable-react-app.diff b/pkgs/by-name/pr/prometheus/disable-react-app.diff new file mode 100644 index 000000000000..f98eca28554a --- /dev/null +++ b/pkgs/by-name/pr/prometheus/disable-react-app.diff @@ -0,0 +1,10 @@ +--- ./build_ui.sh 2025-10-22 23:32:08.739188520 +0100 ++++ ./build_ui.sh 2025-10-22 23:32:23.753242986 +0100 +@@ -50,7 +50,6 @@ for i in "$@"; do + case ${i} in + --all) + buildModule +- buildReactApp + buildMantineUI + shift + ;; diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix index 7b75b0b7bff7..88050c435489 100644 --- a/pkgs/by-name/pr/prometheus/package.nix +++ b/pkgs/by-name/pr/prometheus/package.nix @@ -4,8 +4,8 @@ lib, go, buildGoModule, + buildNpmPackage, fetchFromGitHub, - fetchurl, nixosTests, enableAWS ? true, enableAzure ? true, @@ -32,31 +32,62 @@ enableZookeeper ? true, }: -buildGoModule (finalAttrs: { +let pname = "prometheus"; version = "3.8.0"; + src = fetchFromGitHub { + owner = "prometheus"; + repo = "prometheus"; + tag = "v${version}"; + hash = "sha256-bitRDX1oymFfzvQVYL31BON6UBfQYnqjZefQKc+yXx0="; + }; + + assets = buildNpmPackage { + pname = "${pname}-assets"; + inherit version; + + src = "${src}/web/ui"; + + npmDepsHash = "sha256-Uq7vikiYLqhRQNCpB49aMJgAE/uK4Mst/Iz6W+hdxBw="; + + patches = [ + # Disable old React app as it depends on deprecated create-react-apps + # script + ./disable-react-app.diff + ]; + + env.CI = true; + + doCheck = true; + checkPhase = '' + runHook preCheck + + npm test + + runHook postCheck + ''; + + postInstall = '' + mkdir -p $out/static + cp -r $out/lib/node_modules/prometheus-io/static/* $out/static + find $out/static -type f -exec gzip -f9 {} \; + + # Remove node_modules + rm -rf $out/lib + ''; + }; +in +buildGoModule (finalAttrs: { + inherit pname version src; + outputs = [ "out" "doc" "cli" ]; - src = fetchFromGitHub { - owner = "prometheus"; - repo = "prometheus"; - tag = "v${finalAttrs.version}"; - hash = "sha256-hRuZxwPPDLxQvy5MPKEyfmanNabcSjLRO+XbNKugPtk="; - }; - - depsBuildBuild = [ buildPackages.stdenv.cc ]; - - vendorHash = "sha256-5wDaG01vcTtGzrS/S33U5XWXoSWM+N9z3dzXZlILxD8="; - - webUiStatic = fetchurl { - url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz"; - hash = "sha256-oOEvNZFlYtTNBsn+B2pAWXi0A2oJ6IAo7V8bOLtjfCM="; - }; + vendorHash = "sha256-V+qLxjqGOaT1veEwtklqcS7iO31ufvDHBA9DbZLzDiE="; excludedPackages = [ "documentation/prometheus-mixin" @@ -65,7 +96,7 @@ buildGoModule (finalAttrs: { ]; postPatch = '' - tar -C web/ui -xzf ${finalAttrs.webUiStatic} + cp -r ${assets}/static web/ui/static/ patchShebangs scripts @@ -99,9 +130,18 @@ buildGoModule (finalAttrs: { ''; preBuild = '' - if [[ -d vendor ]]; then - GOARCH= CC="$CC_FOR_BUILD" LD="$LD_FOR_BUILD" make -o assets assets-compress plugins - fi + if [[ -d vendor ]]; then GOARCH= make -o assets plugins; fi + + # Recreate the `make assets-compress` target here - workaround permissions + # errors + cp web/ui/embed.go.tmpl web/ui/embed.go + + find web/ui/static -type f -name '*.gz' -print0 | sort -z | xargs -0 echo //go:embed >> web/ui/embed.go + + echo 'var EmbedFS embed.FS' >> web/ui/embed.go + + # EmbedFS requires relative paths + substituteInPlace web/ui/embed.go --replace-fail "web/ui/" "" ''; tags = [ "builtinassets" ]; From 648378b1675776fa723da3567cab53cc4924dcd6 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Thu, 30 Oct 2025 17:10:07 +0000 Subject: [PATCH 2/8] prometheus: Split source definition to separate file --- pkgs/by-name/pr/prometheus/package.nix | 19 ++++++++++++------- pkgs/by-name/pr/prometheus/source.nix | 6 ++++++ 2 files changed, 18 insertions(+), 7 deletions(-) create mode 100644 pkgs/by-name/pr/prometheus/source.nix diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix index 88050c435489..248b90242d2b 100644 --- a/pkgs/by-name/pr/prometheus/package.nix +++ b/pkgs/by-name/pr/prometheus/package.nix @@ -1,6 +1,5 @@ { stdenv, - buildPackages, lib, go, buildGoModule, @@ -33,14 +32,17 @@ }: let + source = import ./source.nix; + + inherit (source) version vendorHash; + pname = "prometheus"; - version = "3.8.0"; src = fetchFromGitHub { owner = "prometheus"; repo = "prometheus"; tag = "v${version}"; - hash = "sha256-bitRDX1oymFfzvQVYL31BON6UBfQYnqjZefQKc+yXx0="; + hash = source.hash; }; assets = buildNpmPackage { @@ -49,7 +51,7 @@ let src = "${src}/web/ui"; - npmDepsHash = "sha256-Uq7vikiYLqhRQNCpB49aMJgAE/uK4Mst/Iz6W+hdxBw="; + npmDepsHash = source.npmDepsHash; patches = [ # Disable old React app as it depends on deprecated create-react-apps @@ -79,7 +81,12 @@ let }; in buildGoModule (finalAttrs: { - inherit pname version src; + inherit + pname + version + vendorHash + src + ; outputs = [ "out" @@ -87,8 +94,6 @@ buildGoModule (finalAttrs: { "cli" ]; - vendorHash = "sha256-V+qLxjqGOaT1veEwtklqcS7iO31ufvDHBA9DbZLzDiE="; - excludedPackages = [ "documentation/prometheus-mixin" "internal/tools" diff --git a/pkgs/by-name/pr/prometheus/source.nix b/pkgs/by-name/pr/prometheus/source.nix new file mode 100644 index 000000000000..c3bc5b3c9f2a --- /dev/null +++ b/pkgs/by-name/pr/prometheus/source.nix @@ -0,0 +1,6 @@ +{ + version = "3.8.0"; + hash = "sha256-hRuZxwPPDLxQvy5MPKEyfmanNabcSjLRO+XbNKugPtk="; + npmDepsHash = "sha256-pOHEchYVDv7A/3v37hpN60kK620SgQduhVIn6GMyOLM="; + vendorHash = "sha256-5wDaG01vcTtGzrS/S33U5XWXoSWM+N9z3dzXZlILxD8="; +} From e2ddd5a9178134098f7282dba3519463db96ce1b Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Thu, 23 Oct 2025 14:26:10 +0100 Subject: [PATCH 3/8] prometheus: Add update.sh script --- pkgs/by-name/pr/prometheus/package.nix | 6 +- pkgs/by-name/pr/prometheus/update.sh | 77 ++++++++++++++++++++++++++ 2 files changed, 82 insertions(+), 1 deletion(-) create mode 100755 pkgs/by-name/pr/prometheus/update.sh diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix index 248b90242d2b..7390976c5c9b 100644 --- a/pkgs/by-name/pr/prometheus/package.nix +++ b/pkgs/by-name/pr/prometheus/package.nix @@ -186,12 +186,16 @@ buildGoModule (finalAttrs: { "-skip=TestEvaluations/testdata/aggregators.test" ]; - passthru.tests = { inherit (nixosTests) prometheus; }; + passthru = { + tests = { inherit (nixosTests) prometheus; }; + updateScript = ./update.sh; + }; meta = { description = "Service monitoring system and time series database"; homepage = "https://prometheus.io"; license = lib.licenses.asl20; + changelog = "https://github.com/prometheus/prometheus/blob/v${version}/CHANGELOG.md"; maintainers = with lib.maintainers; [ fpletz Frostman diff --git a/pkgs/by-name/pr/prometheus/update.sh b/pkgs/by-name/pr/prometheus/update.sh new file mode 100755 index 000000000000..c09ec3a4064b --- /dev/null +++ b/pkgs/by-name/pr/prometheus/update.sh @@ -0,0 +1,77 @@ +#!/usr/bin/env nix-shell +#!nix-shell -i bash -p nix coreutils curl jq nix-prefetch-git prefetch-npm-deps + +set -euo pipefail + +OWNER=prometheus +REPO=prometheus + +# Current version. +LATEST_NIXPKGS_VERSION=$(nix eval --raw .#prometheus.version 2>/dev/null) +UPDATE_NIX_OLD_VERSION=${UPDATE_NIX_OLD_VERSION:-$LATEST_NIXPKGS_VERSION} + +TARGET_TAG="$(curl -L -s ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r '.tag_name')" +TARGET_VERSION="$(echo "$TARGET_TAG" | sed -e 's/^v//')" + +if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then + # prometheus is up-to-date + if [[ -n "$UPDATE_NIX_ATTR_PATH" ]]; then + echo "[{}]"; + fi + + exit 0 +fi + +extractVendorHash() { + original="${1?original hash missing}" + result="$(nix-build -A prometheus.goModules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)" + [ -z "$result" ] && { echo "$original"; } || { echo "$result"; } +} + +TMP=$(mktemp -d) +trap 'rm -rf "$TMP"' EXIT + +NIXPKGS_PROMETHEUS_PATH=$(cd $(dirname ${BASH_SOURCE[0]}); pwd -P)/ +SOURCE_NIX="$NIXPKGS_PROMETHEUS_PATH/source.nix" + +PREFETCH_JSON=$TMP/prefetch.json +nix-prefetch-git --rev "$TARGET_TAG" --url "https://github.com/$OWNER/$REPO" > "$PREFETCH_JSON" +PREFETCH_HASH="$(jq '.hash' -r < "$PREFETCH_JSON")" +PREFETCH_PATH="$(jq '.path' -r < "$PREFETCH_JSON")" +NPM_DEPS_HASH="$(prefetch-npm-deps "$PREFETCH_PATH/web/ui/package-lock.json")" + +FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="; + +cat > "$SOURCE_NIX" <<-EOF +{ + version = "$TARGET_VERSION"; + hash = "$PREFETCH_HASH"; + npmDepsHash = "$NPM_DEPS_HASH"; + vendorHash = "$FAKE_HASH"; +} +EOF + +GO_HASH="$(nix-instantiate --eval -A prometheus.vendorHash | tr -d '"')" +VENDOR_HASH=$(extractVendorHash "$GO_HASH") + +cat > "$SOURCE_NIX" <<-EOF +{ + version = "$TARGET_VERSION"; + hash = "$PREFETCH_HASH"; + npmDepsHash = "$NPM_DEPS_HASH"; + vendorHash = "$VENDOR_HASH"; +} +EOF + +if [[ -z "$UPDATE_NIX_ATTR_PATH" ]]; then + exit 0 +fi + +cat <<-EOF +[{ + "attrPath": "$UPDATE_NIX_ATTR_PATH", + "oldVersion": "$UPDATE_NIX_OLD_VERSION", + "newVersion": "$TARGET_VERSION", + "files": ["$SOURCE_NIX"] +}] +EOF From 985b1f40a8b54dcb195c73a60b5bce6614806a59 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Fri, 24 Oct 2025 09:13:01 +0000 Subject: [PATCH 4/8] prometheus: Add jpds to maintainers --- pkgs/by-name/pr/prometheus/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix index 7390976c5c9b..68d0a2591338 100644 --- a/pkgs/by-name/pr/prometheus/package.nix +++ b/pkgs/by-name/pr/prometheus/package.nix @@ -199,6 +199,7 @@ buildGoModule (finalAttrs: { maintainers = with lib.maintainers; [ fpletz Frostman + jpds ]; mainProgram = "prometheus"; }; From 0d17bb6789c89153acb0cca5be802e0f61d6b326 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Thu, 6 Nov 2025 13:20:19 +0000 Subject: [PATCH 5/8] prometheus: Add versionCheckHook --- pkgs/by-name/pr/prometheus/package.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix index 68d0a2591338..082dfcc2e044 100644 --- a/pkgs/by-name/pr/prometheus/package.nix +++ b/pkgs/by-name/pr/prometheus/package.nix @@ -29,6 +29,7 @@ enableVultr ? true, enableXDS ? true, enableZookeeper ? true, + versionCheckHook, }: let @@ -186,6 +187,12 @@ buildGoModule (finalAttrs: { "-skip=TestEvaluations/testdata/aggregators.test" ]; + nativeInstallCheckInputs = [ + versionCheckHook + ]; + versionCheckProgramArg = "--version"; + doInstallCheck = true; + passthru = { tests = { inherit (nixosTests) prometheus; }; updateScript = ./update.sh; From 46ce9a461e9ec8ffc2b8042bbf879841718fdd88 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Tue, 2 Dec 2025 13:11:58 +0000 Subject: [PATCH 6/8] nixos/prometheus: Use `lib.getExe` for systemd exec path --- nixos/modules/services/monitoring/prometheus/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix index 965ef9313b53..09ab6c4fcf3f 100644 --- a/nixos/modules/services/monitoring/prometheus/default.nix +++ b/nixos/modules/services/monitoring/prometheus/default.nix @@ -1969,7 +1969,7 @@ in after = [ "network.target" ]; serviceConfig = { ExecStart = - "${cfg.package}/bin/prometheus" + "${lib.getExe cfg.package}" + optionalString (length cmdlineArgs != 0) (" \\\n " + concatStringsSep " \\\n " cmdlineArgs); ExecReload = mkIf cfg.enableReload "+${reload}/bin/reload-prometheus"; User = "prometheus"; From e1e7ee899e4f1b50cdd127996bf4a7f4e16dd221 Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Tue, 2 Dec 2025 13:22:02 +0000 Subject: [PATCH 7/8] nixos/prometheus: Enable CapabilityBoundingSet hardening --- nixos/modules/services/monitoring/prometheus/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix index 09ab6c4fcf3f..35fb022631e0 100644 --- a/nixos/modules/services/monitoring/prometheus/default.nix +++ b/nixos/modules/services/monitoring/prometheus/default.nix @@ -1980,6 +1980,7 @@ in StateDirectory = cfg.stateDir; StateDirectoryMode = "0700"; # Hardening + CapabilityBoundingSet = [ "" ]; DeviceAllow = [ "/dev/null rw" ]; DevicePolicy = "strict"; LockPersonality = true; From 3ea8d8cb0d53e810d1bfc447a26bb1b997eb322d Mon Sep 17 00:00:00 2001 From: Jonathan Davies Date: Wed, 17 Dec 2025 09:42:51 +0000 Subject: [PATCH 8/8] =?UTF-8?q?prometheus:=203.8.0=20=E2=86=92=203.8.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkgs/by-name/pr/prometheus/source.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/pr/prometheus/source.nix b/pkgs/by-name/pr/prometheus/source.nix index c3bc5b3c9f2a..d112d1e2116c 100644 --- a/pkgs/by-name/pr/prometheus/source.nix +++ b/pkgs/by-name/pr/prometheus/source.nix @@ -1,6 +1,6 @@ { - version = "3.8.0"; - hash = "sha256-hRuZxwPPDLxQvy5MPKEyfmanNabcSjLRO+XbNKugPtk="; - npmDepsHash = "sha256-pOHEchYVDv7A/3v37hpN60kK620SgQduhVIn6GMyOLM="; - vendorHash = "sha256-5wDaG01vcTtGzrS/S33U5XWXoSWM+N9z3dzXZlILxD8="; + version = "3.8.1"; + hash = "sha256-mb1aMWpIELyZaqjYX1teYdtAK/+W9jzdPwzgbT7AVj4="; + npmDepsHash = "sha256-wmxvlQWQO2gP2apupMJssqAPr1ntWWIazduQU3AuodU="; + vendorHash = "sha256-35pVMl1Hu970BQE6jMzT1xaz/3FaIFWUtel0cl/uBdw="; }