public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/promtail: Allow write access to positions file if not in CacheDirectory

Browse Source 
Because of `ProtectSystem=strict`, Promtail cannot write to the positions
file if it's not in its `CacheDirectory` (the default value).

(cherry picked from commit b6ad701a2c6bf619fa9418a8e27c4940ce921456)
This commit is contained in:
Zhaofeng Li 2021-08-25 22:17:17 -07:00 committed by github-actions[bot]
parent e85f0175e3
commit f69c32ec21
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/modules/services/logging/promtail.nix
View File

@ -7,6 +7,9 @@ let
''; '';
allowSystemdJournal = cfg.configuration ? scrape_configs && lib.any (v: v ? journal) cfg.configuration.scrape_configs; allowSystemdJournal = cfg.configuration ? scrape_configs && lib.any (v: v ? journal) cfg.configuration.scrape_configs;
allowPositionsFile = !lib.hasPrefix "/var/cache/promtail" positionsFile;
positionsFile = cfg.configuration.positions.filename;
in { in {
options.services.promtail = with types; { options.services.promtail = with types; {
enable = mkEnableOption "the Promtail ingresser"; enable = mkEnableOption "the Promtail ingresser";
@ -53,6 +56,7 @@ in {
RestrictSUIDSGID = true; RestrictSUIDSGID = true;
PrivateMounts = true; PrivateMounts = true;
CacheDirectory = "promtail"; CacheDirectory = "promtail";
ReadWritePaths = lib.optional allowPositionsFile (builtins.dirOf positionsFile);
User = "promtail"; User = "promtail";
Group = "promtail"; Group = "promtail";