modules/monitoring/: Hard-code all the {u,g}ids

4 files changed, 72 insertions, 1 deletions

diff --git a/modules/by-name/mo/monitoring/components/grafana.nix b/modules/by-name/mo/monitoring/components/grafana.nix
index 503fa17..b1254e4 100644
--- a/modules/by-name/mo/monitoring/components/grafana.nix
+++ b/modules/by-name/mo/monitoring/components/grafana.nix
@@ -118,6 +118,21 @@ in {
       };
     };
 
+    users = {
+      groups = {
+        grafana = {
+          gid = config.vhack.constants.ids.gids.grafana;
+        };
+      };
+      users = {
+        grafana = {
+          isSystemUser = true;
+          group = "grafana";
+          uid = lib.mkForce config.vhack.constants.ids.uids.grafana;
+        };
+      };
+    };
+
     vhack = {
       postgresql.enable = true;
       monitoring.grafana.dashboards = [
diff --git a/modules/by-name/mo/monitoring/components/loki.nix b/modules/by-name/mo/monitoring/components/loki.nix
index 9a285c5..30d32b3 100644
--- a/modules/by-name/mo/monitoring/components/loki.nix
+++ b/modules/by-name/mo/monitoring/components/loki.nix
@@ -17,6 +17,37 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    users = {
+      groups = {
+        fluent-bit = {
+          gid = config.vhack.constants.ids.gids.fluent-bit;
+        };
+        loki = {
+          gid = config.vhack.constants.ids.gids.loki;
+        };
+      };
+      users = {
+        fluent-bit = {
+          isSystemUser = true;
+          group = "fluent-bit";
+          uid = config.vhack.constants.ids.uids.fluent-bit;
+        };
+        loki = {
+          isSystemUser = true;
+          group = "loki";
+          uid = config.vhack.constants.ids.uids.loki;
+        };
+      };
+    };
+
+    # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
+    systemd.services.fluent-bit = {
+      serviceConfig = {
+        User = "fluent-bit";
+        Group = "fluent-bit";
+        DynamicUser = lib.mkForce false;
+      };
+    };
     services = {
       loki = {
         enable = true;
@@ -60,7 +91,6 @@ in {
         };
       };
 
-      # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
       fluent-bit = {
         enable = true;
         settings = {
diff --git a/modules/by-name/mo/monitoring/components/prometheus.nix b/modules/by-name/mo/monitoring/components/prometheus.nix
index 468ece3..bf95a6b 100644
--- a/modules/by-name/mo/monitoring/components/prometheus.nix
+++ b/modules/by-name/mo/monitoring/components/prometheus.nix
@@ -71,6 +71,19 @@ in {
       ];
     };
 
+    users = {
+      groups = {
+        node-exporter.gid = config.vhack.constants.ids.gids.node-exporter;
+      };
+      users = {
+        node-exporter = {
+          isSystemUser = true;
+          group = "node-exporter";
+          uid = config.vhack.constants.ids.uids.node-exporter;
+        };
+      };
+    };
+
     services = {
       prometheus = {
         enable = true;
diff --git a/modules/by-name/mo/monitoring/components/scrutiny.nix b/modules/by-name/mo/monitoring/components/scrutiny.nix
index d69dcab..93212dd 100644
--- a/modules/by-name/mo/monitoring/components/scrutiny.nix
+++ b/modules/by-name/mo/monitoring/components/scrutiny.nix
@@ -33,6 +33,19 @@ in {
       ];
     };
 
+    users = {
+      groups = {
+        smartctl-exporter-access.gid = config.vhack.constants.ids.gids.smartctl-exporter-access;
+      };
+      users = {
+        smartctl-exporter-access = {
+          isSystemUser = true;
+          group = "smartctl-exporter-access";
+          uid = config.vhack.constants.ids.uids.smartctl-exporter-access;
+        };
+      };
+    };
+
     services = {
       scrutiny = {
         enable = true;