nixos/modules/services/monitoring/grafana-agent.nix

   1 { lib, pkgs, config, generators, ... }:
   2 let
   3   cfg = config.services.grafana-agent;
   4   settingsFormat = pkgs.formats.yaml { };
   5   configFile = settingsFormat.generate "grafana-agent.yaml" cfg.settings;
   6 in
   7 {
   8   meta = {
   9     maintainers = with lib.maintainers; [ flokli zimbatm ];
  10   };
  11
  12   options.services.grafana-agent = {
  13     enable = lib.mkEnableOption "grafana-agent";
  14
  15     package = lib.mkPackageOption pkgs "grafana-agent" { };
  16
  17     credentials = lib.mkOption {
  18       description = ''
  19         Credentials to load at service startup. Keys that are UPPER_SNAKE will be loaded as env vars. Values are absolute paths to the credentials.
  20       '';
  21       type = lib.types.attrsOf lib.types.str;
  22       default = { };
  23
  24       example = {
  25         logs_remote_write_password = "/run/keys/grafana_agent_logs_remote_write_password";
  26         LOGS_REMOTE_WRITE_URL = "/run/keys/grafana_agent_logs_remote_write_url";
  27         LOGS_REMOTE_WRITE_USERNAME = "/run/keys/grafana_agent_logs_remote_write_username";
  28         metrics_remote_write_password = "/run/keys/grafana_agent_metrics_remote_write_password";
  29         METRICS_REMOTE_WRITE_URL = "/run/keys/grafana_agent_metrics_remote_write_url";
  30         METRICS_REMOTE_WRITE_USERNAME = "/run/keys/grafana_agent_metrics_remote_write_username";
  31       };
  32     };
  33
  34     extraFlags = lib.mkOption {
  35       type = with lib.types; listOf str;
  36       default = [ ];
  37       example = [ "-enable-features=integrations-next" "-disable-reporting" ];
  38       description = ''
  39         Extra command-line flags passed to {command}`grafana-agent`.
  40
  41         See <https://grafana.com/docs/agent/latest/static/configuration/flags/>
  42       '';
  43     };
  44
  45     settings = lib.mkOption {
  46       description = ''
  47         Configuration for {command}`grafana-agent`.
  48
  49         See <https://grafana.com/docs/agent/latest/configuration/>
  50       '';
  51
  52       type = lib.types.submodule {
  53         freeformType = settingsFormat.type;
  54       };
  55
  56       default = { };
  57       defaultText = lib.literalExpression ''
  58         {
  59           metrics = {
  60             wal_directory = "\''${STATE_DIRECTORY}";
  61             global.scrape_interval = "5s";
  62           };
  63           integrations = {
  64             agent.enabled = true;
  65             agent.scrape_integration = true;
  66             node_exporter.enabled = true;
  67           };
  68         }
  69       '';
  70       example = {
  71         metrics.global.remote_write = [{
  72           url = "\${METRICS_REMOTE_WRITE_URL}";
  73           basic_auth.username = "\${METRICS_REMOTE_WRITE_USERNAME}";
  74           basic_auth.password_file = "\${CREDENTIALS_DIRECTORY}/metrics_remote_write_password";
  75         }];
  76         logs.configs = [{
  77           name = "default";
  78           scrape_configs = [
  79             {
  80               job_name = "journal";
  81               journal = {
  82                 max_age = "12h";
  83                 labels.job = "systemd-journal";
  84               };
  85               relabel_configs = [
  86                 {
  87                   source_labels = [ "__journal__systemd_unit" ];
  88                   target_label = "systemd_unit";
  89                 }
  90                 {
  91                   source_labels = [ "__journal__hostname" ];
  92                   target_label = "nodename";
  93                 }
  94                 {
  95                   source_labels = [ "__journal_syslog_identifier" ];
  96                   target_label = "syslog_identifier";
  97                 }
  98               ];
  99             }
 100           ];
 101           positions.filename = "\${STATE_DIRECTORY}/loki_positions.yaml";
 102           clients = [{
 103             url = "\${LOGS_REMOTE_WRITE_URL}";
 104             basic_auth.username = "\${LOGS_REMOTE_WRITE_USERNAME}";
 105             basic_auth.password_file = "\${CREDENTIALS_DIRECTORY}/logs_remote_write_password";
 106           }];
 107         }];
 108       };
 109     };
 110   };
 111
 112   config = lib.mkIf cfg.enable {
 113     services.grafana-agent.settings = {
 114       # keep this in sync with config.services.grafana-agent.settings.defaultText.
 115       metrics = {
 116         wal_directory = lib.mkDefault "\${STATE_DIRECTORY}";
 117         global.scrape_interval = lib.mkDefault "5s";
 118       };
 119       integrations = {
 120         agent.enabled = lib.mkDefault true;
 121         agent.scrape_integration = lib.mkDefault true;
 122         node_exporter.enabled = lib.mkDefault true;
 123       };
 124     };
 125
 126     systemd.services.grafana-agent = {
 127       wantedBy = [ "multi-user.target" ];
 128       script = ''
 129         set -euo pipefail
 130         shopt -u nullglob
 131
 132         # Load all credentials into env if they are in UPPER_SNAKE form.
 133         if [[ -n "''${CREDENTIALS_DIRECTORY:-}" ]]; then
 134           for file in "$CREDENTIALS_DIRECTORY"/*; do
 135             key=$(basename "$file")
 136             if [[ $key =~ ^[A-Z0-9_]+$ ]]; then
 137               echo "Environ $key"
 138               export "$key=$(< "$file")"
 139             fi
 140           done
 141         fi
 142
 143         # We can't use Environment=HOSTNAME=%H, as it doesn't include the domain part.
 144         export HOSTNAME=$(< /proc/sys/kernel/hostname)
 145
 146         exec ${lib.getExe cfg.package} -config.expand-env -config.file ${configFile} ${lib.escapeShellArgs cfg.extraFlags}
 147       '';
 148       serviceConfig = {
 149         Restart = "always";
 150         DynamicUser = true;
 151         RestartSec = 2;
 152         SupplementaryGroups = [
 153           # allow to read the systemd journal for loki log forwarding
 154           "systemd-journal"
 155         ];
 156         StateDirectory = "grafana-agent";
 157         LoadCredential = lib.mapAttrsToList (key: value: "${key}:${value}") cfg.credentials;
 158         Type = "simple";
 159       };
 160     };
 161   };
 162 }