nixos/prometheus-*-exporter: escape shell args

+1 -1
nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix
···
ExecStart = ''
${pkgs.prometheus-blackbox-exporter}/bin/blackbox_exporter \
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-
--config.file ${adjustedConfigFile} \
+
--config.file ${escapeShellArg adjustedConfigFile} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+1 -1
nixos/modules/services/monitoring/prometheus/exporters/collectd.nix
···
serviceConfig = {
ExecStart = ''
${pkgs.prometheus-collectd-exporter}/bin/collectd_exporter \
-
-log.format ${cfg.logFormat} \
+
-log.format ${escapeShellArg cfg.logFormat} \
-log.level ${cfg.logLevel} \
-web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
${collectSettingsArgs} \
+1 -1
nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
···
${pkgs.prometheus-dnsmasq-exporter}/bin/dnsmasq_exporter \
--listen ${cfg.listenAddress}:${toString cfg.port} \
--dnsmasq ${cfg.dnsmasqListenAddress} \
-
--leases_path ${cfg.leasesPath} \
+
--leases_path ${escapeShellArg cfg.leasesPath} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
};
+1 -1
nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
···
${pkgs.prometheus-dovecot-exporter}/bin/dovecot_exporter \
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--web.telemetry-path ${cfg.telemetryPath} \
-
--dovecot.socket-path ${cfg.socketPath} \
+
--dovecot.socket-path ${escapeShellArg cfg.socketPath} \
--dovecot.scopes ${concatStringsSep "," cfg.scopes} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
+1 -1
nixos/modules/services/monitoring/prometheus/exporters/json.nix
···
ExecStart = ''
${pkgs.prometheus-json-exporter}/bin/prometheus-json-exporter \
--port ${toString cfg.port} \
-
${cfg.url} ${cfg.configFile} \
+
${cfg.url} ${escapeShellArg cfg.configFile} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
};
+1 -1
nixos/modules/services/monitoring/prometheus/exporters/mail.nix
···
${pkgs.prometheus-mail-exporter}/bin/mailexporter \
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--config.file ${
-
if cfg.configuration != {} then configurationFile else cfg.configFile
+
if cfg.configuration != {} then configurationFile else (escapeShellArg cfg.configFile)
} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
+2 -2
nixos/modules/services/monitoring/prometheus/exporters/minio.nix
···
${pkgs.prometheus-minio-exporter}/bin/minio-exporter \
-web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-minio.server ${cfg.minioAddress} \
-
-minio.access-key ${cfg.minioAccessKey} \
-
-minio.access-secret ${cfg.minioAccessSecret} \
+
-minio.access-key ${escapeShellArg cfg.minioAccessKey} \
+
-minio.access-secret ${escapeShellArg cfg.minioAccessSecret} \
${optionalString cfg.minioBucketStats "-minio.bucket-stats"} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
+1 -1
nixos/modules/services/monitoring/prometheus/exporters/nextcloud.nix
···
-u ${cfg.username} \
-t ${cfg.timeout} \
-l ${cfg.url} \
-
-p @${cfg.passwordFile} \
+
-p ${escapeShellArg "@${cfg.passwordFile}"} \
${concatStringsSep " \\\n " cfg.extraFlags}
'';
};
+3 -3
nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
···
${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--web.telemetry-path ${cfg.telemetryPath} \
-
--postfix.showq_path ${cfg.showqPath} \
+
--postfix.showq_path ${escapeShellArg cfg.showqPath} \
${concatStringsSep " \\\n " (cfg.extraFlags
++ optional cfg.systemd.enable "--systemd.enable"
++ optional cfg.systemd.enable (if cfg.systemd.slice != null
then "--systemd.slice ${cfg.systemd.slice}"
else "--systemd.unit ${cfg.systemd.unit}")
++ optional (cfg.systemd.enable && (cfg.systemd.journalPath != null))
-
"--systemd.journal_path ${cfg.systemd.journalPath}"
-
++ optional (!cfg.systemd.enable) "--postfix.logfile_path ${cfg.logfilePath}")}
+
"--systemd.journal_path ${escapeShellArg cfg.systemd.journalPath}"
+
++ optional (!cfg.systemd.enable) "--postfix.logfile_path ${escapeShellArg cfg.logfilePath}")}
'';
};
};
+2 -2
nixos/modules/services/monitoring/prometheus/exporters/snmp.nix
···
serviceConfig = {
ExecStart = ''
${pkgs.prometheus-snmp-exporter.bin}/bin/snmp_exporter \
-
--config.file=${configFile} \
-
--log.format=${cfg.logFormat} \
+
--config.file=${escapeShellArg configFile} \
+
--log.format=${escapeShellArg cfg.logFormat} \
--log.level=${cfg.logLevel} \
--web.listen-address=${cfg.listenAddress}:${toString cfg.port} \
${concatStringsSep " \\\n " cfg.extraFlags}
+2 -2
nixos/modules/services/monitoring/prometheus/exporters/unifi.nix
···
${pkgs.prometheus-unifi-exporter}/bin/unifi_exporter \
-telemetry.addr ${cfg.listenAddress}:${toString cfg.port} \
-unifi.addr ${cfg.unifiAddress} \
-
-unifi.username ${cfg.unifiUsername} \
-
-unifi.password ${cfg.unifiPassword} \
+
-unifi.username ${escapeShellArg cfg.unifiUsername} \
+
-unifi.password ${escapeShellArg cfg.unifiPassword} \
-unifi.timeout ${cfg.unifiTimeout} \
${optionalString cfg.unifiInsecure "-unifi.insecure" } \
${concatStringsSep " \\\n " cfg.extraFlags}
+2 -2
nixos/modules/services/monitoring/prometheus/exporters/varnish.nix
···
${pkgs.prometheus-varnish-exporter}/bin/prometheus_varnish_exporter \
--web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--web.telemetry-path ${cfg.telemetryPath} \
-
--varnishstat-path ${cfg.varnishStatPath} \
+
--varnishstat-path ${escapeShellArg cfg.varnishStatPath} \
${concatStringsSep " \\\n " (cfg.extraFlags
++ optional (cfg.healthPath != null) "--web.health-path ${cfg.healthPath}"
-
++ optional (cfg.instance != null) "-n ${cfg.instance}"
+
++ optional (cfg.instance != null) "-n ${escapeShellArg cfg.instance}"
++ optional cfg.noExit "--no-exit"
++ optional cfg.withGoMetrics "--with-go-metrics"
++ optional cfg.verbose "--verbose"
+1 -1
nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
···
${optionalString cfg.verbose "-v"} \
${optionalString cfg.singleSubnetPerField "-s"} \
${optionalString cfg.withRemoteIp "-r"} \
-
${optionalString (cfg.wireguardConfig != null) "-n ${cfg.wireguardConfig}"}
+
${optionalString (cfg.wireguardConfig != null) "-n ${escapeShellArg cfg.wireguardConfig}"}
'';
};
};