From 663f28bbabed1058336c1ef7bf22fd2f9492501c Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Thu, 29 Dec 2022 20:57:10 +0100
Subject: ...

---
 hosts/vidhar/prometheus/default.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

(limited to 'hosts/vidhar')

diff --git a/hosts/vidhar/prometheus/default.nix b/hosts/vidhar/prometheus/default.nix
index ea185788..13eec1b1 100644
--- a/hosts/vidhar/prometheus/default.nix
+++ b/hosts/vidhar/prometheus/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 
 with lib;
 
@@ -395,10 +395,13 @@ in {
     systemd.services."prometheus-systemd-exporter" = let
       cfg = config.services.prometheus.exporters.systemd;
     in {
-      serviceConfig.ExecStart = mkForce  ''
-        ${pkgs.prometheus-systemd-exporter}/bin/systemd_exporter \
-          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} ${concatStringsSep " " cfg.extraFlags}
-      '';
+      serviceConfig = {
+        ExecStart = mkForce "${pkgs.prometheus-systemd-exporter}/bin/systemd_exporter ${utils.escapeSystemdExecArgs [
+            "--web.listen-address" "${cfg.listenAddress}:${toString cfg.port}"
+          ] ++ cfg.extraFlags}";
+        ReadWritePaths = ["/run/dbus/system_bus_socket"];
+        BindReadOnlyPaths = ["/proc"];
+      };
     };
 
     services.nginx = {
-- 
cgit v1.2.3