mirror of
https://github.com/ilyakooo0/nixpkgs.git
synced 2024-09-11 07:15:54 +03:00
Merge pull request #222415 from justinas/prometheus-exporters-nftables
prometheus-exporters: support nftables
This commit is contained in:
commit
598c71dac6
@ -72,6 +72,7 @@ example:
|
||||
- `extraFlags`
|
||||
- `openFirewall`
|
||||
- `firewallFilter`
|
||||
- `firewallRules`
|
||||
- `user`
|
||||
- `group`
|
||||
- As there is already a package available, the module can now be added. This
|
||||
|
@ -169,6 +169,17 @@ let
|
||||
is true. It is used as `ip46tables -I nixos-fw firewallFilter -j nixos-fw-accept`.
|
||||
'';
|
||||
};
|
||||
firewallRules = mkOption {
|
||||
type = types.nullOr types.lines;
|
||||
default = null;
|
||||
example = literalExpression ''
|
||||
iifname "eth0" tcp dport ${toString port} counter accept
|
||||
'';
|
||||
description = lib.mdDoc ''
|
||||
Specify rules for nftables to add to the input chain
|
||||
when {option}`services.prometheus.exporters.${name}.openFirewall` is true.
|
||||
'';
|
||||
};
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "${name}-exporter";
|
||||
@ -194,6 +205,7 @@ let
|
||||
} // extraOpts);
|
||||
} ({ config, ... }: mkIf config.openFirewall {
|
||||
firewallFilter = mkDefault "-p tcp -m tcp --dport ${toString config.port}";
|
||||
firewallRules = mkDefault ''tcp dport ${toString config.port} accept comment "${name}-exporter"'';
|
||||
})];
|
||||
internal = true;
|
||||
default = {};
|
||||
@ -212,6 +224,7 @@ let
|
||||
mkExporterConf = { name, conf, serviceOpts }:
|
||||
let
|
||||
enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true;
|
||||
nftables = config.networking.nftables.enable;
|
||||
in
|
||||
mkIf conf.enable {
|
||||
warnings = conf.warnings or [];
|
||||
@ -223,10 +236,11 @@ let
|
||||
users.groups = (mkIf (conf.group == "${name}-exporter" && !enableDynamicUser) {
|
||||
"${name}-exporter" = {};
|
||||
});
|
||||
networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
|
||||
networking.firewall.extraCommands = mkIf (conf.openFirewall && !nftables) (concatStrings [
|
||||
"ip46tables -A nixos-fw ${conf.firewallFilter} "
|
||||
"-m comment --comment ${name}-exporter -j nixos-fw-accept"
|
||||
]);
|
||||
networking.firewall.extraInputRules = mkIf (conf.openFirewall && nftables) conf.firewallRules;
|
||||
systemd.services."prometheus-${name}-exporter" = mkMerge ([{
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
|
Loading…
Reference in New Issue
Block a user