treewide: source guard for prometheus exporter access
Martin Weinelt committed
Sep 21, 2025 at 14:56 UTC
0ebab0affe655b6a278843124a10637c50e6e78d
6 files changed
+50
-15
build/haumea/postgresql.nix
+10
-2
@@ -1,4 +1,9 @@
1
-{ lib, pkgs, ... }:
1
+{
2
+ config,
3
+ lib,
4
+ pkgs,
5
+ ...
6
+}:
7
8
{
9
systemd.services.postgresql = {
@@ -9,8 +14,11 @@
14
services.prometheus.exporters.postgres = {
15
enable = true;
16
dataSourceName = "user=root database=hydra host=/run/postgresql sslmode=disable";
12
- firewallFilter = "-i wg0 -p tcp -m tcp --dport 9187";
17
openFirewall = true;
18
+ firewallRules = ''
19
+ ip6 saddr $prometheus_inet6 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept
20
+ ip saddr $prometheus_inet4 tcp dport ${toString config.services.prometheus.exporters.postgres.port} accept
21
+ '';
22
};
23
24
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 5432 ];
build/hydra-proxy.nix
+5
-1
@@ -8,7 +8,6 @@
8
networking.firewall.allowedTCPPorts = [
9
80
10
443
11
- 9001
11
];
12
13
services.anubis.instances."hydra-server" = {
@@ -21,6 +20,11 @@
20
};
21
};
22
23
+ networking.firewall.extraInputRules = ''
24
+ ip6 saddr $prometheus_inet6 tcp dport 9001 accept
25
+ ip saddr $prometheus_inet4 tcp dport 9001 accept
26
+ '';
27
+
28
services.nginx = {
29
enable = true;
30
enableReload = true;
build/hydra.nix
+5
-4
@@ -15,10 +15,11 @@ in
15
inputs.hydra.nixosModules.hydra
16
];
17
18
- networking.firewall.allowedTCPPorts = [
19
- 9198 # queue-runnner metrics
20
- 9199 # hydra-notify metrics
21
- ];
18
+ # queue-runner and hydra-notify metrics
19
+ networking.firewall.extraInputRules = ''
20
+ ip6 saddr $prometheus_inet6 tcp dport { 9198, 9199 } accept
21
+ ip saddr $prometheus_inet4 tcp dport { 9198, 9199 } accept
22
+ '';
23
24
nix.package = config.services.hydra-dev.package.nix;
25
build/pluto/prometheus/exporters/hydra.nix
+1
-3
@@ -1,8 +1,6 @@
1
{ pkgs, ... }:
2
3
{
4
- networking.firewall.allowedTCPPorts = [ 9200 ];
5
-
4
systemd.services.prometheus-hydra-queue-runner-exporter = {
5
wantedBy = [ "multi-user.target" ];
6
after = [ "network.target" ];
@@ -51,7 +49,7 @@
49
{
50
job_name = "hydra-reexport";
51
metrics_path = "/";
54
- static_configs = [ { targets = [ "monitoring.nixos.org:9200" ]; } ];
52
+ static_configs = [ { targets = [ "localhost:9200" ]; } ];
53
}
54
];
55
modules/prometheus/default.nix
+20
-5
@@ -1,17 +1,22 @@
1
-{ pkgs, ... }:
1
+{
2
+ config,
3
+ pkgs,
4
+ ...
5
+}:
6
7
let
8
prometheus-nixos-exporter = pkgs.callPackage ./nixos-exporter { };
9
in
10
{
7
- networking.firewall.allowedTCPPorts = [
8
- 9100 # node-exporter
9
- 9300 # prometheus-nixos-exporter
10
- ];
11
services.prometheus.exporters.node = {
12
enable = true;
13
enabledCollectors = [ "systemd" ];
14
extraFlags = [ "--collector.textfile.directory=/var/lib/prometheus-node-exporter-text-files" ];
15
+ openFirewall = true;
16
+ firewallRules = ''
17
+ ip6 saddr $prometheus_inet6 tcp dport ${toString config.services.prometheus.exporters.node.port} accept
18
+ ip saddr $prometheus_inet4 tcp dport ${toString config.services.prometheus.exporters.node.port} accept
19
+ '';
20
};
21
22
system.activationScripts.node-exporter-system-version = ''
@@ -35,9 +40,19 @@ in
40
};
41
};
42
43
+ networking.firewall.extraInputRules = ''
44
+ # prometheus-nixos-exporter
45
+ ip6 saddr $prometheus_inet6 tcp dport 9300 accept
46
+ ip saddr $prometheus_inet4 tcp dport 9300 accept
47
+ '';
48
+
49
services.prometheus.exporters.zfs = {
50
enable = true;
51
listenAddress = "[::]";
52
openFirewall = true;
53
+ firewallRules = ''
54
+ ip6 saddr $prometheus_inet6 tcp dport ${toString config.services.prometheus.exporters.zfs.port} accept
55
+ ip saddr $prometheus_inet4 tcp dport ${toString config.services.prometheus.exporters.zfs.port} accept
56
+ '';
57
};
58
}
modules/rasdaemon.nix
+9
@@ -1,3 +1,8 @@
1
+{
2
+ config,
3
+ ...
4
+}:
5
+
6
{
7
hardware.rasdaemon = {
8
enable = true;
@@ -15,5 +20,9 @@
20
"disk"
21
];
22
openFirewall = true;
23
+ firewallRules = ''
24
+ ip6 saddr $prometheus_inet6 tcp dport ${toString config.services.prometheus.exporters.rasdaemon.port} accept
25
+ ip saddr $prometheus_inet4 tcp dport ${toString config.services.prometheus.exporters.rasdaemon.port} accept
26
+ '';
27
};
28
}