blob: 8556695de2695ccb75e827e47c6fae7109bef950 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.systemd-discord-notifier;
# Add our template unit to each service by default if enabled
systemdServicesSubmodule = {
config = lib.mkIf cfg.enable {
onFailure = lib.mkDefault [ "discord-notify-failure@%N.service" ];
};
};
in
{
options = {
services.systemd-discord-notifier = {
enable = lib.mkEnableOption "systemd-discord-notifier";
content = lib.mkOption {
type = lib.types.str;
default = "# 🚨 %i.service failed! 🚨";
description = "String template for webhook message content.";
};
webhookURLFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
Path to a file containing the webhook URL.
NOTE: This is required.
If not set declaratively, use `systemctl edit` and pass a `webhook-url` credential.
'';
example = "/run/secrets/discordWebhookURL";
};
};
systemd.services = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule systemdServicesSubmodule);
};
};
config = lib.mkIf cfg.enable {
systemd.services."discord-notify-failure@" = {
description = "Notify of service failures on Discord.";
after = [ "network.target" ];
path = [ pkgs.curl ];
script = ''
systemd-creds cat webhook-url | xargs curl -X POST -F "content=$CONTENT"
'';
enableStrictShellChecks = true;
environment = {
CONTENT = cfg.content;
};
serviceConfig = {
Type = "oneshot";
# TODO: Why doesn't AssertCredential work with this?
LoadCredential = lib.mkIf (cfg.webhookURLFile != null) "webhook-url:${cfg.webhookURLFile}";
# TODO: Harden
DynamicUser = true;
};
};
};
}
|
