From e50595fdffe853074431d0540affe62c4392697a Mon Sep 17 00:00:00 2001
From: Ananth Bhaskararaman <antsub@gmail.com>
Date: Sat, 4 Apr 2026 00:38:07 +0530
Subject: [PATCH] nixos/prometheus-libvirt-exporter: fix systemd socket
 restrictions

Allow AF_UNIX, AF_INET, and AF_INET6 address families so the exporter
can connect to the libvirt socket and serve HTTP metrics.
---
 .../services/monitoring/prometheus/exporters/libvirt.nix     | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/services/monitoring/prometheus/exporters/libvirt.nix b/nixos/modules/services/monitoring/prometheus/exporters/libvirt.nix
index 8a4b5f481022..37b16c331598 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/libvirt.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/libvirt.nix
@@ -24,6 +24,11 @@ in
         --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
         --libvirt.uri ${cfg.libvirtUri} ${lib.concatStringsSep " " cfg.extraFlags}
       '';
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+      ];
     };
   };
 }