Merge pull request #24341 from LumiGuide/cadviser-storageDriverPasswordFile

cadviser: add storageDriverPasswordFile option

nixos/modules/services/monitoring/cadvisor.nix

@@ -54,7 +54,29 @@ in {
       storageDriverPassword = mkOption {
         default = "root";
         type = types.str;
-        description = "Cadvisor storage driver password.";
+        description = ''
+          Cadvisor storage driver password.
+
+          Warning: this password is stored in the world-readable Nix store. It's
+          recommended to use the <option>storageDriverPasswordFile</option> option
+          since that gives you control over the security of the password.
+          <option>storageDriverPasswordFile</option> also takes precedence over <option>storageDriverPassword</option>.
+        '';
+      };
+
+      storageDriverPasswordFile = mkOption {
+        type = types.str;
+        description = ''
+          File that contains the cadvisor storage driver password.
+
+          <option>storageDriverPasswordFile</option> takes precedence over <option>storageDriverPassword</option>
+
+          Warning: when <option>storageDriverPassword</option> is non-empty this defaults to a file in the
+          world-readable Nix store that contains the value of <option>storageDriverPassword</option>.
+
+          It's recommended to override this with a path not in the Nix store.
+          Tip: use <link xlink:href='https://nixos.org/nixops/manual/#idm140737318306400'>nixops key management</link>
+        '';
       };
 
       storageDriverSecure = mkOption {
@@ -65,7 +87,16 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
+  config = mkMerge [
+    { services.cadvisor.storageDriverPasswordFile = mkIf (cfg.storageDriverPassword != "") (
+        mkDefault (toString (pkgs.writeTextFile {
+          name = "cadvisor-storage-driver-password";
+          text = cfg.storageDriverPassword;
+        }))
+      );
+    }
+
+    (mkIf cfg.enable {
       systemd.services.cadvisor = {
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" "docker.service" "influxdb.service" ];
@@ -76,24 +107,24 @@ in {
           done
         '';
 
-      serviceConfig = {
+        script = ''
-        ExecStart = ''${pkgs.cadvisor}/bin/cadvisor \
+          exec ${pkgs.cadvisor}/bin/cadvisor \
             -logtostderr=true \
-          -listen_ip=${cfg.listenAddress} \
+            -listen_ip="${cfg.listenAddress}" \
-          -port=${toString cfg.port} \
+            -port="${toString cfg.port}" \
             ${optionalString (cfg.storageDriver != null) ''
-            -storage_driver ${cfg.storageDriver} \
+              -storage_driver "${cfg.storageDriver}" \
-            -storage_driver_user ${cfg.storageDriverHost} \
+              -storage_driver_user "${cfg.storageDriverHost}" \
-            -storage_driver_db ${cfg.storageDriverDb} \
+              -storage_driver_db "${cfg.storageDriverDb}" \
-            -storage_driver_user ${cfg.storageDriverUser} \
+              -storage_driver_user "${cfg.storageDriverUser}" \
-            -storage_driver_password ${cfg.storageDriverPassword} \
+              -storage_driver_password "$(cat "${cfg.storageDriverPasswordFile}")" \
               ${optionalString cfg.storageDriverSecure "-storage_driver_secure"}
             ''}
         '';
-        TimeoutStartSec=300;
-      };
-    };
 
-    virtualisation.docker.enable = mkDefault true;
+        serviceConfig.TimeoutStartSec=300;
       };
+      virtualisation.docker.enable = mkDefault true;
+    })
+  ];
 }