Merge pull request #135751 from zhaofengli/promtail-allow-positions-file
nixos/promtail: Allow write access to positions file if not in CacheDirectory
commit8b13843f4e08c2d707acb8b558c012f0fb1cb314
authorMaximilian Bosch <maximilian@mbosch.me>
dateSun 12 Sep 2021, 18:17 (5 years ago)
parent0517de2b6ad701
nixos/modules/services/logging/promtail.nix+4
@@ -7,6 +7,9 @@ let
77 '';
88
99 allowSystemdJournal = cfg.configuration ? scrape_configs && lib.any (v: v ? journal) cfg.configuration.scrape_configs;
10+
11+ allowPositionsFile = !lib.hasPrefix "/var/cache/promtail" positionsFile;
12+ positionsFile = cfg.configuration.positions.filename;
1013in {
1114 options.services.promtail = with types; {
1215 enable = mkEnableOption "the Promtail ingresser";
@@ -53,6 +56,7 @@ in {
5356 RestrictSUIDSGID = true;
5457 PrivateMounts = true;
5558 CacheDirectory = "promtail";
59+ ReadWritePaths = lib.optional allowPositionsFile (builtins.dirOf positionsFile);
5660
5761 User = "promtail";
5862 Group = "promtail";