gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/netdata: add wireguard support

Browse Source 
CAP_NET_ADMIN is required.

Change-Id: I8559e50ccf2d34a4bc7c8f4f2aeafb7771fe751b
Signed-off-by: Raito Bezarius <masterancpp@gmail.com>
This commit is contained in:
Raito Bezarius
2024-06-19 21:30:04 +02:00
parent 6955aab487
commit aaccbed9fb
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/monitoring/netdata.nix
+4 -1
View File
@@ -50,6 +50,7 @@ let
defaultUser = "netdata";
isThereAnyWireGuardTunnels = config.networking.wireguard.enable || lib.any (c: lib.hasAttrByPath [ "netdevConfig" "Kind" ] c && c.netdevConfig.Kind == "wireguard") (builtins.attrValues config.systemd.network.netdevs);
in {
options = {
services.netdata = {
@@ -286,6 +287,8 @@ in {
# Configuration directory and mode
ConfigurationDirectory = "netdata";
ConfigurationDirectoryMode = "0755";
# AmbientCapabilities
AmbientCapabilities = lib.optional isThereAnyWireGuardTunnels "CAP_NET_ADMIN";
# Capabilities
CapabilityBoundingSet = [
"CAP_DAC_OVERRIDE" # is required for freeipmi and slabinfo plugins
@@ -299,7 +302,7 @@ in {
"CAP_SYS_CHROOT" # is required for cgroups plugin
"CAP_SETUID" # is required for cgroups and cgroups-network plugins
"CAP_SYSLOG" # is required for systemd-journal plugin
];
] ++ lib.optional isThereAnyWireGuardTunnels "CAP_NET_ADMIN";
# Sandboxing
ProtectSystem = "full";
ProtectHome = "read-only";