...

1 files changed, 6 insertions, 0 deletions

diff --git a/hosts/surtr/prometheus/default.nix b/hosts/surtr/prometheus/default.nix
index 0f0cf586..685d117b 100644
--- a/hosts/surtr/prometheus/default.nix
+++ b/hosts/surtr/prometheus/default.nix
@@ -203,6 +203,12 @@ in {
       };
     };
 
+    systemd.services.prometheus = {
+      serviceConfig = {
+        SystemCallFilter = mkForce [ "@system-service" "~@privileged" ];
+      };
+    };
+
     sops.secrets."prometheus.key" = {
       format = "binary";
       sopsFile = ./tls.key;