1 files changed, 89 insertions, 41 deletions

diff --git a/modules/by-name/mo/monitoring/components/loki.nix b/modules/by-name/mo/monitoring/components/loki.nix
index 9a285c5..149e577 100644
--- a/modules/by-name/mo/monitoring/components/loki.nix
+++ b/modules/by-name/mo/monitoring/components/loki.nix
@@ -17,50 +17,56 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    services = {
-      loki = {
-        enable = true;
-        dataDir = "/var/lib/loki";
-        package = pkgs.grafana-loki;
-        configuration = {
-          auth_enabled = false;
-
-          server.http_listen_port = cfg.port;
-
-          common = {
-            ring = {
-              instance_addr = "127.0.0.1";
-              kvstore = {
-                store = "inmemory";
-              };
-            };
-
-            replication_factor = 1;
-            path_prefix = "/tmp/loki";
-          };
-
-          schema_config = {
-            configs = [
-              {
-                from = "2020-05-15";
-                store = "tsdb";
-                object_store = "filesystem";
-                schema = "v13";
-                index = {
-                  prefix = "index_";
-                  period = "24h";
-                };
-              }
-            ];
-          };
+    vhack = {
+      persist.directories = [
+        {
+          directory = "/var/lib/loki";
+          user = "loki";
+          group = "loki";
+          mode = "0700";
+        }
+        {
+          directory = "/var/lib/fluent-bit";
+          user = "fluent-bit";
+          group = "fluent-bit";
+          mode = "0700";
+        }
+      ];
+    };
 
-          storage_config = {
-            filesystem.directory = "/tmp/loki/chunks";
-          };
+    users = {
+      groups = {
+        fluent-bit = {
+          gid = config.vhack.constants.ids.gids.fluent-bit;
+        };
+        loki = {
+          gid = config.vhack.constants.ids.gids.loki;
         };
       };
+      users = {
+        fluent-bit = {
+          isSystemUser = true;
+          group = "fluent-bit";
+          uid = config.vhack.constants.ids.uids.fluent-bit;
+        };
+        loki = {
+          isSystemUser = true;
+          group = "loki";
+          uid = config.vhack.constants.ids.uids.loki;
+        };
+      };
+    };
 
-      # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
+    # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
+    systemd.services.fluent-bit = {
+      serviceConfig = {
+        StateDirectory = "fluent-bit";
+        User = "fluent-bit";
+        Group = "fluent-bit";
+        DynamicUser = lib.mkForce false;
+      };
+    };
+    services = {
       fluent-bit = {
         enable = true;
         settings = {
@@ -85,7 +91,7 @@ in {
                 path = "/var/log/journal";
 
                 # Database file to keep track of the journald cursor.
-                db = "/var/fluent-bit/systemd.db";
+                db = "/var/lib/fluent-bit/systemd.db";
 
                 # Start reading new entries. Skip entries already stored in journald.
                 read_from_tail = true;
@@ -117,6 +123,48 @@ in {
         };
         graceLimit = "1m";
       };
+
+      loki = {
+        enable = true;
+        dataDir = "/var/lib/loki";
+        package = pkgs.grafana-loki;
+        configuration = {
+          auth_enabled = false;
+
+          server.http_listen_port = cfg.port;
+
+          common = {
+            ring = {
+              instance_addr = "127.0.0.1";
+              kvstore = {
+                store = "inmemory";
+              };
+            };
+
+            replication_factor = 1;
+            path_prefix = "/tmp/loki";
+          };
+
+          schema_config = {
+            configs = [
+              {
+                from = "2020-05-15";
+                store = "tsdb";
+                object_store = "filesystem";
+                schema = "v13";
+                index = {
+                  prefix = "index_";
+                  period = "24h";
+                };
+              }
+            ];
+          };
+
+          storage_config = {
+            filesystem.directory = "/tmp/loki/chunks";
+          };
+        };
+      };
     };
   };
 }