modules/monitoring/: Hard-code all the {u,g}ids

1 files changed, 31 insertions, 1 deletions

diff --git a/modules/by-name/mo/monitoring/components/loki.nix b/modules/by-name/mo/monitoring/components/loki.nix
index 9a285c5..30d32b3 100644
--- a/modules/by-name/mo/monitoring/components/loki.nix
+++ b/modules/by-name/mo/monitoring/components/loki.nix
@@ -17,6 +17,37 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    users = {
+      groups = {
+        fluent-bit = {
+          gid = config.vhack.constants.ids.gids.fluent-bit;
+        };
+        loki = {
+          gid = config.vhack.constants.ids.gids.loki;
+        };
+      };
+      users = {
+        fluent-bit = {
+          isSystemUser = true;
+          group = "fluent-bit";
+          uid = config.vhack.constants.ids.uids.fluent-bit;
+        };
+        loki = {
+          isSystemUser = true;
+          group = "loki";
+          uid = config.vhack.constants.ids.uids.loki;
+        };
+      };
+    };
+
+    # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
+    systemd.services.fluent-bit = {
+      serviceConfig = {
+        User = "fluent-bit";
+        Group = "fluent-bit";
+        DynamicUser = lib.mkForce false;
+      };
+    };
     services = {
       loki = {
         enable = true;
@@ -60,7 +91,6 @@ in {
         };
       };
 
-      # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
       fluent-bit = {
         enable = true;
         settings = {