prometheus/packet-spot-market-exporter: run as dynamic user
Another static user allocation gone. To access the api token it now relies on systemds LoadCredential.
Martin Weinelt committed
Feb 26, 2024 at 02:25 UTC
6c0b015dd5e9f621d79e293850016e3d232f8c41
1 file changed
+6
-12
delft/pluto/prometheus/exporters/packet-spot-market.nix
+6
-12
@@ -7,17 +7,7 @@ let
7
sha256 = "sha256-I2WolAAM+siE8JfZbEZ3Mmk7/XqVio/PzUKqZUYCBfE=";
8
};
9
in {
10
- age.secrets.prometheus-packet-spot-market-price-exporter = {
11
- file = ../../../secrets/prometheus-packet-spot-market-price-exporter.age;
12
- owner = "spot-price-exporter";
13
- };
14
-
15
- users.users.spot-price-exporter = {
16
- description = "Prometheus Packet Spot Market Price Exporter";
17
- isSystemUser = true;
18
- group = "spot-price-exporter";
19
- };
20
- users.groups.spot-price-exporter = {};
10
+ age.secrets.prometheus-packet-spot-market-price-exporter.file = ../../../secrets/prometheus-packet-spot-market-price-exporter.age;
11
12
systemd.services.prometheus-packet-spot-market-price-exporter = {
13
wantedBy = [
@@ -27,11 +17,15 @@ in {
17
"network.target"
18
];
19
serviceConfig = {
20
+ DynamicUser = true;
21
User = "spot-price-exporter";
22
Group = "keys";
23
Restart = "always";
24
RestartSec = "60s";
25
PrivateTmp = true;
26
+ LoadCredential = [
27
+ "config:${config.age.secrets.prometheus-packet-spot-market-price-exporter.path}"
28
+ ];
29
};
30
31
path = [
@@ -41,6 +35,6 @@ in {
35
]))
36
];
37
44
- script = "exec python3 ${exporter}/scrape.py ${config.age.secrets.prometheus-packet-spot-market-price-exporter.path}";
38
+ script = "exec python3 ${exporter}/scrape.py $CREDENTIALS_DIRECTORY/config";
39
};
40
}