From 5f27e501a1bc170d08d6093544eeac29b4e0214a Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Sun, 21 Apr 2024 22:45:26 +0200 Subject: [PATCH 1/3] nixos/vmagent: remove global `with lib;` --- nixos/modules/services/monitoring/vmagent.nix | 42 +++++++++---------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/nixos/modules/services/monitoring/vmagent.nix b/nixos/modules/services/monitoring/vmagent.nix index cdcf1571154e..0ce23c5ec731 100644 --- a/nixos/modules/services/monitoring/vmagent.nix +++ b/nixos/modules/services/monitoring/vmagent.nix @@ -1,63 +1,63 @@ { config, pkgs, lib, ... }: -with lib; + let cfg = config.services.vmagent; settingsFormat = pkgs.formats.json { }; in { options.services.vmagent = { - enable = mkEnableOption "vmagent"; + enable = lib.mkEnableOption "vmagent"; - user = mkOption { + user = lib.mkOption { default = "vmagent"; - type = types.str; + type = lib.types.str; description = '' User account under which vmagent runs. ''; }; - group = mkOption { - type = types.str; + group = lib.mkOption { + type = lib.types.str; default = "vmagent"; description = '' Group under which vmagent runs. ''; }; - package = mkPackageOption pkgs "vmagent" { }; + package = lib.mkPackageOption pkgs "vmagent" { }; - dataDir = mkOption { - type = types.str; + dataDir = lib.mkOption { + type = lib.types.str; default = "/var/lib/vmagent"; description = '' The directory where vmagent stores its data files. ''; }; - remoteWriteUrl = mkOption { + remoteWriteUrl = lib.mkOption { default = "http://localhost:8428/api/v1/write"; - type = types.str; + type = lib.types.str; description = '' The storage endpoint such as VictoriaMetrics ''; }; - prometheusConfig = mkOption { + prometheusConfig = lib.mkOption { type = lib.types.submodule { freeformType = settingsFormat.type; }; description = '' Config for prometheus style metrics ''; }; - openFirewall = mkOption { - type = types.bool; + openFirewall = lib.mkOption { + type = lib.types.bool; default = false; description = '' Whether to open the firewall for the default ports. ''; }; - extraArgs = mkOption { - type = types.listOf types.str; + extraArgs = lib.mkOption { + type = lib.types.listOf lib.types.str; default = []; description = '' Extra args to pass to `vmagent`. See the docs: @@ -67,10 +67,10 @@ in { }; }; - config = mkIf cfg.enable { - users.groups = mkIf (cfg.group == "vmagent") { vmagent = { }; }; + config = lib.mkIf cfg.enable { + users.groups = lib.mkIf (cfg.group == "vmagent") { vmagent = { }; }; - users.users = mkIf (cfg.user == "vmagent") { + users.users = lib.mkIf (cfg.user == "vmagent") { vmagent = { group = cfg.group; description = "vmagent daemon user"; @@ -79,7 +79,7 @@ in { }; }; - networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ 8429 ]; + networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 8429 ]; systemd.services.vmagent = let prometheusConfig = settingsFormat.generate "prometheusConfig.yaml" cfg.prometheusConfig; @@ -93,7 +93,7 @@ in { Type = "simple"; Restart = "on-failure"; WorkingDirectory = cfg.dataDir; - ExecStart = "${cfg.package}/bin/vmagent -remoteWrite.url=${cfg.remoteWriteUrl} -promscrape.config=${prometheusConfig} ${escapeShellArgs cfg.extraArgs}"; + ExecStart = "${cfg.package}/bin/vmagent -remoteWrite.url=${cfg.remoteWriteUrl} -promscrape.config=${prometheusConfig} ${lib.escapeShellArgs cfg.extraArgs}"; }; }; From e0638909ae5b988b6154b75a28482b44e96270fc Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Sun, 21 Apr 2024 22:45:51 +0200 Subject: [PATCH 2/3] vmagent: add me as maintainer --- pkgs/servers/monitoring/vmagent/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/servers/monitoring/vmagent/default.nix b/pkgs/servers/monitoring/vmagent/default.nix index 6267b14c0f4c..c290b81ef04e 100644 --- a/pkgs/servers/monitoring/vmagent/default.nix +++ b/pkgs/servers/monitoring/vmagent/default.nix @@ -22,6 +22,6 @@ buildGoModule rec { mainProgram = "vmagent"; license = licenses.asl20; platforms = platforms.linux; - maintainers = with maintainers; [ nullx76 ]; + maintainers = with maintainers; [ nullx76 leona ]; }; } From 6c69cfb804fd1f3e55e87b90d219394edf9e6fb9 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Sun, 21 Apr 2024 23:02:44 +0200 Subject: [PATCH 3/3] nixos/vmagent: use dynamic user and cache directory --- .../manual/release-notes/rl-2405.section.md | 4 + nixos/modules/services/monitoring/vmagent.nix | 94 +++++++++---------- 2 files changed, 50 insertions(+), 48 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md index 3a4a3a211e4c..d83e7c4ff71c 100644 --- a/nixos/doc/manual/release-notes/rl-2405.section.md +++ b/nixos/doc/manual/release-notes/rl-2405.section.md @@ -319,6 +319,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m - `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service. +- `services.vmagent` module deprecates `dataDir`, `group` and `user` setting in favor of systemd provided CacheDirectory and DynamicUser. + +- `services.vmagent.remoteWriteUrl` setting has been renamed to `services.vmagent.remoteWrite.url` and now defaults to `null`. + - `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200). - `services.nginx` will no longer advertise HTTP/3 availability automatically. This must now be manually added, preferably to each location block. diff --git a/nixos/modules/services/monitoring/vmagent.nix b/nixos/modules/services/monitoring/vmagent.nix index 0ce23c5ec731..4838e0709d09 100644 --- a/nixos/modules/services/monitoring/vmagent.nix +++ b/nixos/modules/services/monitoring/vmagent.nix @@ -4,41 +4,40 @@ let cfg = config.services.vmagent; settingsFormat = pkgs.formats.json { }; in { + imports = [ + (lib.mkRemovedOptionModule [ "services" "vmagent" "dataDir" ] "dataDir has been deprecated in favor of systemd provided CacheDirectory") + (lib.mkRemovedOptionModule [ "services" "vmagent" "user" ] "user has been deprecated in favor of systemd DynamicUser") + (lib.mkRemovedOptionModule [ "services" "vmagent" "group" ] "group has been deprecated in favor of systemd DynamicUser") + (lib.mkRenamedOptionModule [ "services" "vmagent" "remoteWriteUrl" ] [ "services" "vmagent" "remoteWrite" "url" ]) + ]; + options.services.vmagent = { enable = lib.mkEnableOption "vmagent"; - user = lib.mkOption { - default = "vmagent"; - type = lib.types.str; - description = '' - User account under which vmagent runs. - ''; - }; - - group = lib.mkOption { - type = lib.types.str; - default = "vmagent"; - description = '' - Group under which vmagent runs. - ''; - }; - package = lib.mkPackageOption pkgs "vmagent" { }; - dataDir = lib.mkOption { - type = lib.types.str; - default = "/var/lib/vmagent"; - description = '' - The directory where vmagent stores its data files. - ''; - }; - - remoteWriteUrl = lib.mkOption { - default = "http://localhost:8428/api/v1/write"; - type = lib.types.str; - description = '' - The storage endpoint such as VictoriaMetrics - ''; + remoteWrite = { + url = lib.mkOption { + default = null; + type = lib.types.nullOr lib.types.str; + description = '' + Endpoint for prometheus compatible remote_write + ''; + }; + basicAuthUsername = lib.mkOption { + default = null; + type = lib.types.nullOr lib.types.str; + description = '' + Basic Auth username used to connect to remote_write endpoint + ''; + }; + basicAuthPasswordFile = lib.mkOption { + default = null; + type = lib.types.nullOr lib.types.str; + description = '' + File that contains the Basic Auth password used to connect to remote_write endpoint + ''; + }; }; prometheusConfig = lib.mkOption { @@ -68,36 +67,35 @@ in { }; config = lib.mkIf cfg.enable { - users.groups = lib.mkIf (cfg.group == "vmagent") { vmagent = { }; }; - - users.users = lib.mkIf (cfg.user == "vmagent") { - vmagent = { - group = cfg.group; - description = "vmagent daemon user"; - home = cfg.dataDir; - isSystemUser = true; - }; - }; - networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 8429 ]; systemd.services.vmagent = let prometheusConfig = settingsFormat.generate "prometheusConfig.yaml" cfg.prometheusConfig; + startCommandLine = lib.concatStringsSep " " ([ + "${cfg.package}/bin/vmagent" + "-promscrape.config=${prometheusConfig}" + ] ++ cfg.extraArgs + ++ lib.optionals (cfg.remoteWrite.url != null) [ + "-remoteWrite.url=${cfg.remoteWrite.url}" + "-remoteWrite.tmpDataPath=%C/vmagent/remote_write_tmp" + ] ++ lib.optional (cfg.remoteWrite.basicAuthUsername != null) "-remoteWrite.basicAuth.username=${cfg.remoteWrite.basicAuthUsername}" + ++ lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) "-remoteWrite.basicAuth.passwordFile=\${CREDENTIALS_DIRECTORY}/remote_write_basic_auth_password"); in { wantedBy = [ "multi-user.target" ]; after = [ "network.target" ]; description = "vmagent system service"; serviceConfig = { - User = cfg.user; - Group = cfg.group; + DynamicUser = true; + User = "vmagent"; + Group = "vmagent"; Type = "simple"; Restart = "on-failure"; - WorkingDirectory = cfg.dataDir; - ExecStart = "${cfg.package}/bin/vmagent -remoteWrite.url=${cfg.remoteWriteUrl} -promscrape.config=${prometheusConfig} ${lib.escapeShellArgs cfg.extraArgs}"; + CacheDirectory = "vmagent"; + ExecStart = startCommandLine; + LoadCredential = lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) [ + "remote_write_basic_auth_password:${cfg.remoteWrite.basicAuthPasswordFile}" + ]; }; }; - - systemd.tmpfiles.rules = - [ "d '${cfg.dataDir}' 0755 ${cfg.user} ${cfg.group} -" ]; }; }