From abaa76a8523e6e81e2c30bb073d3200d0283b15b Mon Sep 17 00:00:00 2001
From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
Date: Sun, 19 Jul 2026 16:38:43 +0200
Subject: modules/monitoring/: Hard-code all the {u,g}ids

---
 modules/by-name/co/constants/module.nix            | 10 +++++++
 .../by-name/mo/monitoring/components/grafana.nix   | 15 ++++++++++
 modules/by-name/mo/monitoring/components/loki.nix  | 32 +++++++++++++++++++++-
 .../mo/monitoring/components/prometheus.nix        | 13 +++++++++
 .../by-name/mo/monitoring/components/scrutiny.nix  | 13 +++++++++
 5 files changed, 82 insertions(+), 1 deletion(-)

diff --git a/modules/by-name/co/constants/module.nix b/modules/by-name/co/constants/module.nix
index b94020b..9127488 100644
--- a/modules/by-name/co/constants/module.nix
+++ b/modules/by-name/co/constants/module.nix
@@ -56,6 +56,11 @@
       anubis = 342;
       postfix-tlspol = 343;
       rocie = 344;
+      fluent-bit = 345;
+      loki = 346;
+      grafana = 347;
+      node-exporter = 348;
+      smartctl-exporter-access = 349;
 
       # As per the NixOS file, the uids should not be greater or equal to 400;
     };
@@ -96,6 +101,11 @@
         resolvconf # This group is not matched to an user?
         stalwart-mail-certificates # This group is used to connect nginx and stalwart-mail
         rocie
+        fluent-bit
+        loki
+        grafana
+        node-exporter
+        smartctl-exporter-access
         ;
 
       # The gid should match the uid. Thus should not be >= 400;
diff --git a/modules/by-name/mo/monitoring/components/grafana.nix b/modules/by-name/mo/monitoring/components/grafana.nix
index 503fa17..b1254e4 100644
--- a/modules/by-name/mo/monitoring/components/grafana.nix
+++ b/modules/by-name/mo/monitoring/components/grafana.nix
@@ -118,6 +118,21 @@ in {
       };
     };
 
+    users = {
+      groups = {
+        grafana = {
+          gid = config.vhack.constants.ids.gids.grafana;
+        };
+      };
+      users = {
+        grafana = {
+          isSystemUser = true;
+          group = "grafana";
+          uid = lib.mkForce config.vhack.constants.ids.uids.grafana;
+        };
+      };
+    };
+
     vhack = {
       postgresql.enable = true;
       monitoring.grafana.dashboards = [
diff --git a/modules/by-name/mo/monitoring/components/loki.nix b/modules/by-name/mo/monitoring/components/loki.nix
index 9a285c5..30d32b3 100644
--- a/modules/by-name/mo/monitoring/components/loki.nix
+++ b/modules/by-name/mo/monitoring/components/loki.nix
@@ -17,6 +17,37 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    users = {
+      groups = {
+        fluent-bit = {
+          gid = config.vhack.constants.ids.gids.fluent-bit;
+        };
+        loki = {
+          gid = config.vhack.constants.ids.gids.loki;
+        };
+      };
+      users = {
+        fluent-bit = {
+          isSystemUser = true;
+          group = "fluent-bit";
+          uid = config.vhack.constants.ids.uids.fluent-bit;
+        };
+        loki = {
+          isSystemUser = true;
+          group = "loki";
+          uid = config.vhack.constants.ids.uids.loki;
+        };
+      };
+    };
+
+    # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
+    systemd.services.fluent-bit = {
+      serviceConfig = {
+        User = "fluent-bit";
+        Group = "fluent-bit";
+        DynamicUser = lib.mkForce false;
+      };
+    };
     services = {
       loki = {
         enable = true;
@@ -60,7 +91,6 @@ in {
         };
       };
 
-      # I decided to switch to fluent-bit because it can be tested locally https://docs.fluentbit.io/manual/local-testing/logging-pipeline
       fluent-bit = {
         enable = true;
         settings = {
diff --git a/modules/by-name/mo/monitoring/components/prometheus.nix b/modules/by-name/mo/monitoring/components/prometheus.nix
index 468ece3..bf95a6b 100644
--- a/modules/by-name/mo/monitoring/components/prometheus.nix
+++ b/modules/by-name/mo/monitoring/components/prometheus.nix
@@ -71,6 +71,19 @@ in {
       ];
     };
 
+    users = {
+      groups = {
+        node-exporter.gid = config.vhack.constants.ids.gids.node-exporter;
+      };
+      users = {
+        node-exporter = {
+          isSystemUser = true;
+          group = "node-exporter";
+          uid = config.vhack.constants.ids.uids.node-exporter;
+        };
+      };
+    };
+
     services = {
       prometheus = {
         enable = true;
diff --git a/modules/by-name/mo/monitoring/components/scrutiny.nix b/modules/by-name/mo/monitoring/components/scrutiny.nix
index d69dcab..93212dd 100644
--- a/modules/by-name/mo/monitoring/components/scrutiny.nix
+++ b/modules/by-name/mo/monitoring/components/scrutiny.nix
@@ -33,6 +33,19 @@ in {
       ];
     };
 
+    users = {
+      groups = {
+        smartctl-exporter-access.gid = config.vhack.constants.ids.gids.smartctl-exporter-access;
+      };
+      users = {
+        smartctl-exporter-access = {
+          isSystemUser = true;
+          group = "smartctl-exporter-access";
+          uid = config.vhack.constants.ids.uids.smartctl-exporter-access;
+        };
+      };
+    };
+
     services = {
       scrutiny = {
         enable = true;
-- 
cgit v1.3.1