diff --git a/package/alertmanager/alertmanager.mk b/package/alertmanager/alertmanager.mk index 2c35159..89f87f0 100644 --- a/package/alertmanager/alertmanager.mk +++ b/package/alertmanager/alertmanager.mk @@ -19,6 +19,12 @@ define ALERTMANAGER_INSTALL_TARGET_CMDS $(INSTALL) -m u=rwx,go=rx $(@D)/alertmanager $(TARGET_DIR)/usr/sbin endef +define ALERTMANAGER_INSTALL_INIT_SYSTEMD + $(INSTALL) -D -m u=rw,go=r \ + $(BR2_EXTERNAL_metricspi_PATH)/package/alertmanager/alertmanager.service \ + $(TARGET_DIR)/usr/lib/systemd/system/alertmanager.service +endef + define ALERTMANAGER_USERS alertmanager -1 alertmanager -1 * - - - Prometheus Alertmanager endef diff --git a/package/alertmanager/alertmanager.service b/package/alertmanager/alertmanager.service new file mode 100644 index 0000000..df779ac --- /dev/null +++ b/package/alertmanager/alertmanager.service @@ -0,0 +1,49 @@ +[Unit] +Description=Prometheus AlertManager +Documentation=https://github.com/prometheus/alertmanager/blob/main/README.md +After=network-online.target +Wants=network-online.target + +[Service] +Type=exec +Environment=CLUSTER_LISTEN_ADDRESS= +Environment=WEB_LISTEN_ADDRESS=[::1]:9093 +EnvironmentFile=-/etc/sysconfig/alertmanager +ExecStart=/usr/sbin/alertmanager \ + --config.file=/etc/prometheus/alertmanager.yml \ + --cluster.listen-address=${CLUSTER_LISTEN_ADDRESS} \ + --web.listen-address=${WEB_LISTEN_ADDRESS} +ExecReload=/bin/kill -HUP $MAINPID +Restart=on-failure + +CapabilityBoundingSet= +DeviceAllow= +DevicePolicy=closed +DynamicUser=yes +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +PrivateDevices=yes +PrivateUsers=yes +PrivateTmp=yes +ProcSubset=pid +ProtectClock=yes +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectProc=invisible +ProtectSystem=strict +RestrictAddressFamilies=AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallFilter=@system-service +SystemCallFilter=~@privileged @resources +UMask=0027 + +[Install] +WantedBy=multi-user.target