starred/nix-config
1
0 Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity

refactor(power-monitoring): grant RAPL read access from a udev rule

Browse Source 
The boot-time oneshot only fixed the zones present when it ran, and
node_exporter had to Require it. A powercap add rule covers every zone
whenever it appears; the collector reads at scrape time, so no ordering
is needed.

Assisted-by: Claude Code (claude-opus-5-5)
This commit is contained in:
Ryan Yin authored and ryan4yin | 二花 committed 2026-11-01 11:42:57 -06:00
1 parent 42341491f3
commit f8ca25a03b
5 files changed
+10 -35
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

outputs/x86_64-linux/tests/cpu-power/expr.nix
+5 -5
View File
@@ -41,7 +41,7 @@ in
name:
configs.${name}.config.modules.powerMonitoring.enable
&& builtins.elem "rapl" configs.${name}.config.services.prometheus.exporters.node.enabledCollectors
&& configs.${name}.config.systemd.services ? rapl-permissions
&& lib.hasInfix "chgrp rapl" configs.${name}.config.services.udev.extraRules
);
serverRaplReaderOnly = lib.all (
name:
@@ -51,9 +51,9 @@ in
desktopRaplDisabled =
!configs.ai-niri.config.modules.powerMonitoring.enable
&& !(builtins.elem "rapl" configs.ai-niri.config.services.prometheus.exporters.node.enabledCollectors)
&& !(configs.ai-niri.config.systemd.services ? rapl-permissions);
guestsHaveNoRapl = lib.all (name: !(configs.${name}.config.systemd.services ? rapl-permissions)) (
lib.subtractLists physicalHosts (builtins.attrNames configs)
);
&& !(lib.hasInfix "chgrp rapl" configs.ai-niri.config.services.udev.extraRules);
guestsHaveNoRapl = lib.all (
name: !(lib.hasInfix "chgrp rapl" configs.${name}.config.services.udev.extraRules)
) (lib.subtractLists physicalHosts (builtins.attrNames configs));
desktopBatteryReporting = configs.ai-niri.config.services.upower.enable;
}
outputs/x86_64-linux/tests/idols-aquamarine/expr.nix
+1 -1
View File
@@ -82,7 +82,7 @@ in
) cfg.environment.systemPackages;
gpuMetricsExported = builtins.elem "drm" cfg.services.prometheus.exporters.node.enabledCollectors;
raplMetricsExported = builtins.elem "rapl" cfg.services.prometheus.exporters.node.enabledCollectors;
raplPermissionsExposed = cfg.systemd.services ? rapl-permissions;
raplPermissionsExposed = lib.hasInfix "chgrp rapl" cfg.services.udev.extraRules;
# node_exporter rejects a repeated flag, and this list merges with the base
# module's entries, so a duplicate restart-loops the unit.
collectorFlagsUnique =
outputs/x86_64-linux/tests/security-service-hardening/expected.nix
-3
View File
@@ -34,9 +34,6 @@ in
};
privilegedOneshot = {
rapl-permissions = privilegedOneshot // {
CapabilityBoundingSet = [ "CAP_CHOWN" ];
};
hdd-no-spindown = privilegedOneshot // {
CapabilityBoundingSet = [ "CAP_SYS_RAWIO" ];
DeviceAllow = [ "block-sd rw" ];
outputs/x86_64-linux/tests/security-service-hardening/expr.nix
-1
View File
@@ -38,7 +38,6 @@ units "youko" [
// units "aquamarine" [ "whisper-asr" ]
// {
privilegedOneshot = {
rapl-permissions = privilegedUnit "aquamarine" "rapl-permissions";
hdd-no-spindown = privilegedUnit "youko" "hdd-no-spindown";
};
}