Merge pull request #94 from artudis-utils/main

fix: node_exporter - Fix Systemd ProtectHome option in service unit
prometheus-community · May 10, 2023 · 51997ca · 51997ca
2 parents 26d2f99 + be0a877
commit 51997ca
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 3 deletions.
diff --git a/roles/node_exporter/molecule/alternative/tests/test_alternative.py b/roles/node_exporter/molecule/alternative/tests/test_alternative.py
@@ -23,6 +23,12 @@ def test_service(host):
     assert s.is_running
 
 
+def test_protecthome_property(host):
+    s = host.service("node_exporter")
+    p = s.systemd_properties
+    assert p.get("ProtectHome") == "yes"
+
+
 def test_socket(host):
     sockets = [
         "tcp://127.0.0.1:8080"

diff --git a/roles/node_exporter/molecule/default/tests/test_default.py b/roles/node_exporter/molecule/default/tests/test_default.py
@@ -57,6 +57,12 @@ def test_service(host):
     assert s.is_running
 
 
+def test_protecthome_property(host):
+    s = host.service("node_exporter")
+    p = s.systemd_properties
+    assert p.get("ProtectHome") == "yes"
+
+
 def test_socket(host):
     sockets = [
         "tcp://127.0.0.1:9100"

diff --git a/roles/node_exporter/molecule/latest/tests/test_alternative.py b/roles/node_exporter/molecule/latest/tests/test_alternative.py
@@ -25,6 +25,12 @@ def test_service(host):
     assert s.is_running
 
 
+def test_protecthome_property(host):
+    s = host.service("node_exporter")
+    p = s.systemd_properties
+    assert p.get("ProtectHome") == "yes"
+
+
 def test_socket(host):
     s = host.socket("tcp://0.0.0.0:9100")
     assert s.is_listening
diff --git a/roles/node_exporter/templates/node_exporter.service.j2 b/roles/node_exporter/templates/node_exporter.service.j2
@@ -38,11 +38,11 @@ Restart=always
 RestartSec=1
 StartLimitInterval=0
 
-{% set protect_home = 'yes' %}
+{% set ns = namespace(protect_home = 'yes') %}
 {% for m in ansible_mounts if m.mount.startswith('/home') %}
-{%   set protect_home = 'read-only' %}
+{%   set ns.protect_home = 'read-only' %}
 {% endfor %}
-ProtectHome={{ protect_home }}
+ProtectHome={{ ns.protect_home }}
 NoNewPrivileges=yes
 
 {% if (ansible_facts.packages.systemd | first).version is version('232', '>=') %}