mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2025-01-18 08:06:16 +01:00
23564b29a6
Add a new role called prometheus_exporters which should be run on every machine we have and starts different collectors depending on what group the machine is in. Currently supported our the gitlab runner exporter, rebuilder textcollector, mysqld-exporter, borg textcollector and an node/arch exporter. The arch exporter monitors the security status and pacman out of date packages gauge.
38 lines
739 B
Django/Jinja
38 lines
739 B
Django/Jinja
[Unit]
|
|
Description=Prometheus Arch Exporter
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=node_exporter
|
|
ExecStart=/usr/local/bin/arch-textcollector.sh {{ prometheus_textfile_dir }}
|
|
|
|
NoNewPrivileges=true
|
|
LockPersonality=true
|
|
CapabilityBoundingSet=
|
|
UMask=077
|
|
|
|
PrivateDevices=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths={{ prometheus_textfile_dir }}
|
|
|
|
MemoryDenyWriteExecute=true
|
|
RemoveIPC=true
|
|
RestrictRealtime=true
|
|
RestrictNamespaces=true
|
|
RestrictSUIDSGID=true
|
|
|
|
RestrictAddressFamilies=~AF_NETLINK
|
|
RestrictAddressFamilies=~AF_PACKET
|
|
|
|
ProtectHostname=true
|
|
ProtectControlGroups=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectClock=true
|
|
|
|
SystemCallArchitectures=native
|