diff options
| author | Dennis Fink | 2026-09-30 18:50:01 +0200 |
|---|---|---|
| committer | Dennis Fink | 2026-09-30 18:50:01 +0200 |
| commit | 138074a6a1148fd40b1d48d85f76b762dcb7ec5f (patch) | |
| tree | 7cc24ed80d45ca86061e41ea14e784854f8056f7 /contrib | |
| parent | dfad705061e40e1564ff9dff6b8ec8d6465fcf1a (diff) | |
| download | prometheus-borgmatic-exporter-138074a6a1148fd40b1d48d85f76b762dcb7ec5f.tar.gz prometheus-borgmatic-exporter-138074a6a1148fd40b1d48d85f76b762dcb7ec5f.zip | |
fix(systemd): retry failed exporter runs
Retry transient exporter failures up to five times while avoiding
retries for invalid command-line usage.
Tighten the service sandbox with filesystem protection, required address
families, and a corrected capability set, and leave activation solely to
the timer unit.
Diffstat (limited to '')
| -rw-r--r-- | contrib/prometheus-borgmatic-exporter.service | 23 | ||||
| -rw-r--r-- | contrib/prometheus-borgmatic-exporter.timer | 2 |
2 files changed, 14 insertions, 11 deletions
diff --git a/contrib/prometheus-borgmatic-exporter.service b/contrib/prometheus-borgmatic-exporter.service index 706a4f5..54a5f4e 100644 --- a/contrib/prometheus-borgmatic-exporter.service +++ b/contrib/prometheus-borgmatic-exporter.service @@ -3,11 +3,20 @@ Description=Borgmatic Prometheus metrics exporter After=network-online.target Wants=network-online.target +# Allow the initial attempt plus five retries. +StartLimitIntervalSec=2h +StartLimitBurst=6 + + [Service] Type=oneshot EnvironmentFile=/etc/conf.d/prometheus-borgmatic-exporter ExecStart=/usr/bin/prometheus-borgmatic-exporter $PROMETHEUS_BORGMATIC_EXPORTER_ARGS +Restart=on-failure +RestartPreventExitStatus=2 +RestartSec=10min + User=root Group=root @@ -19,7 +28,8 @@ ReadWritePaths=/root/.cache/borg PrivateTmp=true # Mount a minimal /dev without the access to raw block or character devices PrivateDevices=true -# ProtectSystem and ProtectHome are ineffective for root and intentionally omitted +ProtectSystem=full +ProtectHome=false # Hide other processes in /proc ProtectProc=invisible @@ -29,7 +39,7 @@ ProcSubset=pid UMask=0022 # Restrict to the address families needed for SSH and local communication -RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK # Kernel and system hardening ProtectKernelTunables=true @@ -45,11 +55,9 @@ LockPersonality=true MemoryDenyWriteExecute=true RemoveIPC=true -# Capabilites +# Capabilities # Root always holds capabilites, but we restrict what child processes can inherit -# CAP_DAC_OVERRIDE: needed by borg for file acess -# CAP_NET_RAW: needed for SSH connections -CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_NET_RAW +CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_FOWNER CAP_NET_RAW AmbientCapabilities= # NoNewPrivileges is intentionally omitted as borg needs to exec SSH @@ -58,6 +66,3 @@ SystemCallArchitectures=native SystemCallFilter=@system-service SystemCallFilter=~@privileged @resources @mount @swap @reboot SystemCallFilter=setfsuid setfsgid - -[Install] -WantedBy=multi-user.target diff --git a/contrib/prometheus-borgmatic-exporter.timer b/contrib/prometheus-borgmatic-exporter.timer index 951a774..7c2c2d5 100644 --- a/contrib/prometheus-borgmatic-exporter.timer +++ b/contrib/prometheus-borgmatic-exporter.timer @@ -1,7 +1,5 @@ [Unit] Description=Run Borgmatic Prometheus metrics exporter daily -After=network-online.target -Wants=network-online.target [Timer] OnCalendar=daily |