From 043522789b997c51b9eb2de84add68896f917860 Mon Sep 17 00:00:00 2001
From: Guillaume DELVIT <guiguid@free.fr>
Date: Sun, 29 Oct 2023 21:46:35 +0100
Subject: nixos/services/netdata: add systemd-journald plugin as a privileged
 wrapper

https://learn.netdata.cloud/docs/logs/systemd-journal/
need acces to

    Kernel Logs (dmesg):
        Capability: CAP_SYSLOG
        Description: This capability allows the program to read kernel logs using the dmesg command or by reading the /dev/kmsg file.

    System Logs (e.g., /var/log/syslog):
        Capability: CAP_DAC_READ_SEARCH
        Description: This capability allows the program to read system logs located in directories such as /var/log/.

    User Logs (e.g., /var/log/auth.log):
        Capability: CAP_DAC_READ_SEARCH
        Description: This capability allows the program to read user logs located in directories such as /var/log/.
---
 nixos/modules/services/monitoring/netdata.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

(limited to 'nixos')

diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index 3833418b5ad..de0e044453e 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -12,6 +12,7 @@ let
     ln -s /run/wrappers/bin/perf.plugin $out/libexec/netdata/plugins.d/perf.plugin
     ln -s /run/wrappers/bin/slabinfo.plugin $out/libexec/netdata/plugins.d/slabinfo.plugin
     ln -s /run/wrappers/bin/freeipmi.plugin $out/libexec/netdata/plugins.d/freeipmi.plugin
+    ln -s /run/wrappers/bin/systemd-journal.plugin $out/libexec/netdata/plugins.d/systemd-journal.plugin
   '';
 
   plugins = [
@@ -254,7 +255,7 @@ in {
         # Capabilities
         CapabilityBoundingSet = [
           "CAP_DAC_OVERRIDE"      # is required for freeipmi and slabinfo plugins
-          "CAP_DAC_READ_SEARCH"   # is required for apps plugin
+          "CAP_DAC_READ_SEARCH"   # is required for apps and systemd-journal plugin
           "CAP_FOWNER"            # is required for freeipmi plugin
           "CAP_SETPCAP"           # is required for apps, perf and slabinfo plugins
           "CAP_SYS_ADMIN"         # is required for perf plugin
@@ -263,6 +264,7 @@ in {
           "CAP_NET_RAW"           # is required for fping app
           "CAP_SYS_CHROOT"        # is required for cgroups plugin
           "CAP_SETUID"            # is required for cgroups and cgroups-network plugins
+          "CAP_SYSLOG"            # is required for systemd-journal plugin
         ];
         # Sandboxing
         ProtectSystem = "full";
@@ -318,6 +320,14 @@ in {
         permissions = "u+rx,g+x,o-rwx";
       };
 
+      "systemd-journal.plugin" = {
+        source = "${cfg.package}/libexec/netdata/plugins.d/systemd-journal.plugin.org";
+        capabilities = "cap_dac_read_search,cap_syslog+ep";
+        owner = cfg.user;
+        group = cfg.group;
+        permissions = "u+rx,g+x,o-rwx";
+      };
+
       "slabinfo.plugin" = {
         source = "${cfg.package}/libexec/netdata/plugins.d/slabinfo.plugin.org";
         capabilities = "cap_dac_override+ep";
-- 
cgit 1.4.1


From c4d3afef06956e9748fb09309240b5efe4d6b39c Mon Sep 17 00:00:00 2001
From: Caleb <caleb.isaac.bowman@gmail.com>
Date: Wed, 8 Nov 2023 07:34:26 -0500
Subject: wyoming-faster-whisper fix CUDA devices not being detected. (#266167)

This change enables CUDA support by allowing access to /dev/nvidia0.
---
 nixos/modules/services/audio/wyoming/faster-whisper.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'nixos')

diff --git a/nixos/modules/services/audio/wyoming/faster-whisper.nix b/nixos/modules/services/audio/wyoming/faster-whisper.nix
index f156e8314a9..2d56acdc1b4 100644
--- a/nixos/modules/services/audio/wyoming/faster-whisper.nix
+++ b/nixos/modules/services/audio/wyoming/faster-whisper.nix
@@ -146,6 +146,8 @@ in
           CapabilityBoundingSet = "";
           DeviceAllow = if builtins.elem options.device [ "cuda" "auto" ] then [
             # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+            # CUDA not working? Check DeviceAllow and PrivateDevices first!
+            "/dev/nvidia0"
             "/dev/nvidia1"
             "/dev/nvidia2"
             "/dev/nvidia3"
@@ -160,7 +162,6 @@ in
           DevicePolicy = "closed";
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
-          PrivateDevices = true;
           PrivateUsers = true;
           ProtectHome = true;
           ProtectHostname = true;
-- 
cgit 1.4.1