From 0e3747095920c0dcfeee74ebe6f280b0defc02c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Fri, 29 Jan 2021 16:33:03 +0100 Subject: Remove netdata stream key from the store --- modules/private/system/monitoring-1.nix | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) (limited to 'modules') diff --git a/modules/private/system/monitoring-1.nix b/modules/private/system/monitoring-1.nix index 188162a..2198d09 100644 --- a/modules/private/system/monitoring-1.nix +++ b/modules/private/system/monitoring-1.nix @@ -42,13 +42,24 @@ services.netdata.config.web."allow netdata.conf from" = "fd*"; services.netdata.config.web."allow management from" = "fd*"; networking.firewall.allowedTCPPorts = [ 19999 ]; - environment.etc."netdata/stream.conf".text = builtins.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (_: key: '' - [${key}] - enabled = yes - default history = 3600 - default memory = ram - health enabled by default = auto - '') config.myEnv.monitoring.netdata_keys); + environment.etc."netdata/stream.conf".source = "/var/secrets/netdata-stream.conf"; + + secrets.keys = [ + { + dest = "netdata-stream.conf"; + user = config.services.netdata.user; + group = config.services.netdata.group; + permissions = "0400"; + text = builtins.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (_: key: '' + [${key}] + enabled = yes + default history = 3600 + default memory = ram + health enabled by default = auto + '') config.myEnv.monitoring.netdata_keys); + } + ]; + users.users."${config.services.netdata.user}".extraGroups = [ "keys" ]; # This value determines the NixOS release with which your system is # to be compatible, in order to avoid breaking some software such as # database servers. You should change this only after NixOS release -- cgit v1.2.3