nixos/promtail: Allow write access to positions file if not in CacheDirectory
Because of `ProtectSystem=strict`, Promtail cannot write to the positions
file if it's not in its `CacheDirectory` (the default value).
commitb6ad701a2c6bf619fa9418a8e27c4940ce921456
authorZhaofeng Li <hello@zhaofeng.li>
dateWed 25 Aug 2021, 22:17 (5 years ago)
parentce38fec
nixos/modules/services/logging/promtail.nix+4
@@ -7,6 +7,9 @@ let
77 '';
88
99 allowSystemdJournal = cfg.configuration ? scrape_configs && lib.any (v: v ? journal) cfg.configuration.scrape_configs;
10+
11+ allowPositionsFile = !lib.hasPrefix "/var/cache/promtail" positionsFile;
12+ positionsFile = cfg.configuration.positions.filename;
1013in {
1114 options.services.promtail = with types; {
1215 enable = mkEnableOption "the Promtail ingresser";
@@ -53,6 +56,7 @@ in {
5356 RestrictSUIDSGID = true;
5457 PrivateMounts = true;
5558 CacheDirectory = "promtail";
59+ ReadWritePaths = lib.optional allowPositionsFile (builtins.dirOf positionsFile);
5660
5761 User = "promtail";
5862 Group = "promtail";