pyrox.dev
1{
2 config,
3 pkgs,
4 lib,
5 ...
6}:
7let
8 cfg = config.services.prometheus.alertmanager;
9 mkConfigFile = pkgs.writeText "alertmanager.yml" (builtins.toJSON cfg.configuration);
10
11 checkedConfig =
12 file:
13 if cfg.checkConfig then
14 pkgs.runCommand "checked-config" { nativeBuildInputs = [ cfg.package ]; } ''
15 ln -s ${file} $out
16 amtool check-config $out
17 ''
18 else
19 file;
20
21 alertmanagerYml =
22 let
23 yml =
24 if cfg.configText != null then pkgs.writeText "alertmanager.yml" cfg.configText else mkConfigFile;
25 in
26 checkedConfig yml;
27
28 cmdlineArgs =
29 cfg.extraFlags
30 ++ [
31 "--config.file /tmp/alert-manager-substituted.yaml"
32 "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
33 "--log.level ${cfg.logLevel}"
34 "--storage.path /var/lib/alertmanager"
35 (toString (map (peer: "--cluster.peer ${peer}:9094") cfg.clusterPeers))
36 ]
37 ++ (lib.optional (cfg.webExternalUrl != null) "--web.external-url ${cfg.webExternalUrl}")
38 ++ (lib.optional (cfg.logFormat != null) "--log.format ${cfg.logFormat}");
39in
40{
41 imports = [
42 (lib.mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "user" ]
43 "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a user setting."
44 )
45 (lib.mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "group" ]
46 "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a group setting."
47 )
48 (lib.mkRemovedOptionModule [ "services" "prometheus" "alertmanagerURL" ] ''
49 Due to incompatibility, the alertmanagerURL option has been removed,
50 please use 'services.prometheus.alertmanagers' instead.
51 '')
52 ];
53
54 options = {
55 services.prometheus.alertmanager = {
56 enable = lib.mkEnableOption "Prometheus Alertmanager";
57
58 package = lib.mkPackageOption pkgs "prometheus-alertmanager" { };
59
60 configuration = lib.mkOption {
61 type = lib.types.nullOr lib.types.attrs;
62 default = null;
63 description = ''
64 Alertmanager configuration as nix attribute set.
65
66 The contents of the resulting config file are processed using envsubst.
67 `$` needs to be escaped as `$$` to be preserved.
68 '';
69 };
70
71 configText = lib.mkOption {
72 type = lib.types.nullOr lib.types.lines;
73 default = null;
74 description = ''
75 Alertmanager configuration as YAML text. If non-null, this option
76 defines the text that is written to alertmanager.yml. If null, the
77 contents of alertmanager.yml is generated from the structured config
78 options.
79
80 The contents of the resulting config file are processed using envsubst.
81 `$` needs to be escaped as `$$` to be preserved.
82 '';
83 };
84
85 checkConfig = lib.mkOption {
86 type = lib.types.bool;
87 default = true;
88 description = ''
89 Check configuration with `amtool check-config`. The call to `amtool` is
90 subject to sandboxing by Nix.
91
92 If you use credentials stored in external files
93 (`environmentFile`, etc),
94 they will not be visible to `amtool`
95 and it will report errors, despite a correct configuration.
96 '';
97 };
98
99 logFormat = lib.mkOption {
100 type = lib.types.nullOr lib.types.str;
101 default = null;
102 description = ''
103 If set use a syslog logger or JSON logging.
104 '';
105 };
106
107 logLevel = lib.mkOption {
108 type = lib.types.enum [
109 "debug"
110 "info"
111 "warn"
112 "error"
113 "fatal"
114 ];
115 default = "warn";
116 description = ''
117 Only log messages with the given severity or above.
118 '';
119 };
120
121 webExternalUrl = lib.mkOption {
122 type = lib.types.nullOr lib.types.str;
123 default = null;
124 description = ''
125 The URL under which Alertmanager is externally reachable (for example, if Alertmanager is served via a reverse proxy).
126 Used for generating relative and absolute links back to Alertmanager itself.
127 If the URL has a path portion, it will be used to prefix all HTTP endoints served by Alertmanager.
128 If omitted, relevant URL components will be derived automatically.
129 '';
130 };
131
132 listenAddress = lib.mkOption {
133 type = lib.types.str;
134 default = "";
135 description = ''
136 Address to listen on for the web interface and API. Empty string will listen on all interfaces.
137 "localhost" will listen on 127.0.0.1 (but not ::1).
138 '';
139 };
140
141 port = lib.mkOption {
142 type = lib.types.port;
143 default = 9093;
144 description = ''
145 Port to listen on for the web interface and API.
146 '';
147 };
148
149 openFirewall = lib.mkOption {
150 type = lib.types.bool;
151 default = false;
152 description = ''
153 Open port in firewall for incoming connections.
154 '';
155 };
156
157 clusterPeers = lib.mkOption {
158 type = lib.types.listOf lib.types.str;
159 default = [ ];
160 description = ''
161 Initial peers for HA cluster.
162 '';
163 };
164
165 extraFlags = lib.mkOption {
166 type = lib.types.listOf lib.types.str;
167 default = [ ];
168 description = ''
169 Extra commandline options when launching the Alertmanager.
170 '';
171 };
172
173 environmentFile = lib.mkOption {
174 type = lib.types.nullOr lib.types.path;
175 default = null;
176 example = "/root/alertmanager.env";
177 description = ''
178 File to load as environment file. Environment variables
179 from this file will be interpolated into the config file
180 using envsubst with this syntax:
181 `$ENVIRONMENT ''${VARIABLE}`
182 '';
183 };
184 };
185 };
186
187 config = lib.mkMerge [
188 (lib.mkIf cfg.enable {
189 assertions = lib.singleton {
190 assertion = cfg.configuration != null || cfg.configText != null;
191 message =
192 "Can not enable alertmanager without a configuration. "
193 + "Set either the `configuration` or `configText` attribute.";
194 };
195 })
196 (lib.mkIf cfg.enable {
197 networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
198
199 systemd.services.alertmanager = {
200 wantedBy = [ "multi-user.target" ];
201 wants = [ "network-online.target" ];
202 after = [ "network-online.target" ];
203 preStart = ''
204 ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/tmp/alert-manager-substituted.yaml" \
205 -i "${alertmanagerYml}"
206 '';
207 serviceConfig = {
208 ExecStart =
209 "${cfg.package}/bin/alertmanager"
210 + lib.optionalString (lib.length cmdlineArgs != 0) (
211 " \\\n " + lib.concatStringsSep " \\\n " cmdlineArgs
212 );
213 ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
214
215 EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
216
217 CapabilityBoundingSet = [ "" ];
218 DeviceAllow = [ "" ];
219 DynamicUser = true;
220 NoNewPrivileges = true;
221
222 MemoryDenyWriteExecute = true;
223
224 LockPersonality = true;
225
226 ProtectProc = "invisible";
227 ProtectSystem = "strict";
228 ProtectHome = "tmpfs";
229
230 PrivateTmp = true;
231 PrivateDevices = true;
232 PrivateIPC = true;
233
234 ProcSubset = "pid";
235
236 ProtectHostname = true;
237 ProtectClock = true;
238 ProtectKernelTunables = true;
239 ProtectKernelModules = true;
240 ProtectKernelLogs = true;
241 ProtectControlGroups = true;
242
243 Restart = "always";
244
245 RestrictAddressFamilies = [
246 "AF_INET"
247 "AF_INET6"
248 "AF_NETLINK"
249 ];
250 RestrictNamespaces = true;
251 RestrictRealtime = true;
252 RestrictSUIDSGID = true;
253
254 StateDirectory = "alertmanager";
255 SystemCallFilter = [
256 "@system-service"
257 "~@cpu-emulation"
258 "~@privileged"
259 "~@reboot"
260 "~@setuid"
261 "~@swap"
262 ];
263
264 WorkingDirectory = "/tmp";
265 };
266 };
267 })
268 ];
269}