puyak: enable blackbox prometheus exporter, use it to ping internal and external hosts

1 files changed, 19 insertions, 0 deletions

diff --git a/krebs/2configs/shack/prometheus/blackbox.nix b/krebs/2configs/shack/prometheus/blackbox.nix
new file mode 100644
index 000000000..82ce003e8
--- /dev/null
+++ b/krebs/2configs/shack/prometheus/blackbox.nix
@@ -0,0 +1,19 @@
+{pkgs, ... }:
+{
+  systemd.services.prometheus-blackbox-exporter.serviceConfig = {
+    CapabilityBoundingSet = ["CAP_NET_RAW"]; # icmp allow
+    AmbientCapabilities = ["CAP_NET_RAW"];
+  };
+  services.prometheus.exporters.blackbox = {
+    enable = true;
+    # openFirewall = true; # not requred if running on the same host as prometheus
+    port = 9115;
+    configFile = pkgs.writeText "icmp" ''
+      modules:
+        icmp:
+          prober: icmp
+          icmp:
+            preferred_ip_protocol: ip4
+    '';
+  };
+}