From b4b9b08426337645f625f1f0bd8020e7ac9b2f0b Mon Sep 17 00:00:00 2001
From: Dee Anzorge <d.anzorge@gmail.com>
Date: Tue, 26 Dec 2023 21:41:34 +0100
Subject: [PATCH] nixos/prometheus-exporters/kea: run under same user/group as
 kea

This fixes access to the kea unix sockets, after enabling
RuntimeDirectoryPreserve on the kea units.

https://github.com/NixOS/nixpkgs/pull/274460#issuecomment-1869702893
---
 .../modules/services/monitoring/prometheus/exporters/kea.nix  | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/monitoring/prometheus/exporters/kea.nix b/nixos/modules/services/monitoring/prometheus/exporters/kea.nix
index ed33c72f644f..3abb6ff6bdf8 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/kea.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/kea.nix
@@ -31,13 +31,15 @@ in {
     ];
     serviceConfig = {
       User = "kea";
+      DynamicUser = true;
       ExecStart = ''
         ${pkgs.prometheus-kea-exporter}/bin/kea-exporter \
           --address ${cfg.listenAddress} \
           --port ${toString cfg.port} \
           ${concatStringsSep " " cfg.controlSocketPaths}
       '';
-      SupplementaryGroups = [ "kea" ];
+      RuntimeDirectory = "kea";
+      RuntimeDirectoryPreserve = true;
       RestrictAddressFamilies = [
         # Need AF_UNIX to collect data
         "AF_UNIX"