blob: ab6be3a4f900683ef173b1af580d2899c88918db (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
# From https://github.com/NixOS/nixpkgs/pull/376834
{
config,
pkgs,
lib,
...
}:
let
inherit (lib)
getBin
hasPrefix
literalExpression
mkBefore
mkEnableOption
mkIf
mkOption
mkPackageOption
optionalString
types
;
cfg = config.borealis.victorialogs;
startCLIList = [
"${cfg.package}/bin/victoria-logs"
"-storageDataPath=/var/lib/${cfg.stateDir}"
"-httpListenAddr=${cfg.listenAddress}"
] ++ cfg.extraOptions;
in
{
options.borealis.victorialogs = {
enable = mkEnableOption "VictoriaLogs is an open source user-friendly database for logs from VictoriaMetrics";
package = mkPackageOption pkgs "victoriametrics" { };
listenAddress = lib.mkOption {
default = "127.0.0.1:9428";
type = types.str;
description = ''
TCP address to listen for incoming http requests.
'';
};
stateDir = mkOption {
type = types.str;
default = "victorialogs";
description = ''
Directory below `/var/lib` to store VictoriaLogs data.
This directory will be created automatically using systemd's StateDirectory mechanism.
'';
};
extraOptions = mkOption {
type = types.listOf types.str;
default = [ ];
example = literalExpression ''
[
"-httpAuth.username=username"
"-httpAuth.password=file:///abs/path/to/file"
"-loggerLevel=WARN"
]
'';
description = ''
Extra options to pass to VictoriaLogs. See {command}`victoria-logs -help` for
possible options.
'';
};
};
config = mkIf cfg.enable {
systemd.services.victorialogs = {
description = "VictoriaLogs logs database";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
startLimitBurst = 5;
serviceConfig = {
ExecStart = lib.escapeShellArgs startCLIList;
DynamicUser = true;
RestartSec = 1;
Restart = "on-failure";
RuntimeDirectory = "victorialogs";
RuntimeDirectoryMode = "0700";
StateDirectory = cfg.stateDir;
StateDirectoryMode = "0700";
# Hardening
DeviceAllow = [ "/dev/null rw" ];
DevicePolicy = "strict";
LockPersonality = true;
MemoryDenyWriteExecute = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RemoveIPC = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_UNIX"
];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
];
};
postStart =
let
bindAddr = (optionalString (hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
in
mkBefore ''
until ${getBin pkgs.curl}/bin/curl -s -o /dev/null http://${bindAddr}/ping; do
sleep 1;
done
'';
};
};
}
|
