mail: enrol the host in ymr.serviceSandbox (nix-config#932) #1965

Merged

hermes merged 1 commit from kb/NCFG-932-mail-sandbox into main 2026-10-13 06:55:41 -06:00

Conversation 0 Commits 1 Files changed 1 +45

hermes commented 2026-10-13 06:45:49 -06:00

Collaborator

Copy link

Kanban card nix-config#932 (child of nix-config#928, split by the disjointness referee).

What

Enable ymr.serviceSandbox on mail and enrol the units whose write paths were
measured on the host (cutover from nix-config#896 §9 step 2; template = the vpn-mx
cutover, nix-config#909).

Measured on mail 2026-10-13 with systemctl show <unit> -p ExecStart -p StateDirectory:

unit	writes
prometheus-node-exporter	(none — reads /proc + /sys)
prometheus-process-exporter	(none — reads /proc)
prometheus-systemd-exporter	(none — reads the bus)
vmagent	/var/cache/vmagent (-remoteWrite.tmpDataPath)
vlagent	/var/lib/vlagent (tmpDataPath + file checkpoints)
systemd-journal-upload	/var/lib/systemd/journal-upload (--save-state)

prometheus-node-exporter carries the required per-host delta
SystemCallFilter = [ "@system-service" "@clock" ] — node_exporter's timex
collector calls adjtimex(2), which the module's default @system-service
excludes; without it every scrape dies with SIGSYS and the unit crash-loops
(measured on vpn-mx: sig=31 syscall=171, NRestarts=16 in 13 min).

postgres / dovecot / postfix / caddy stay out (module exception register —
mail + ingress writers need measured paths first, one host at a time); the CI runners
are excluded outright; grafana/listmonk/atticd are later cutovers.

The module's table is applied at lib.mkOverride 1500, so each unit's own stronger
declaration wins (the nixpkgs exporters already declare ProtectSystem=strict,
ProtectHome, PrivateTmp, NoNewPrivileges; vlagent declared none and now gains
the full table).

DoD

• CI green on the head SHA
• merged (merge commit, not squash)
• deployed to mail
• verified LIVE on mail: systemctl show <unit> shows the table, every enrolled
  unit active with NRestarts=0, /etc/fleet-service-sandbox.policy present, and a
  real /metrics scrape returns 200

Offline evidence

• nix eval .#nixosConfigurations.mail.config.ymr.serviceSandbox.enrolledUnits
  → the six units above
• nix eval .#nixosConfigurations.mail.config.systemd.services.<unit>.serviceConfig
  → the hardening keys + ReadWritePaths
• full config.system.build.toplevel.drvPath evaluates (assertions pass)

Kanban card nix-config#932 (child of nix-config#928, split by the disjointness referee). ## What Enable `ymr.serviceSandbox` on **mail** and enrol the units whose write paths were measured on the host (cutover from nix-config#896 §9 step 2; template = the vpn-mx cutover, nix-config#909). Measured on mail 2026-10-13 with `systemctl show <unit> -p ExecStart -p StateDirectory`: | unit | writes | | --- | --- | | prometheus-node-exporter | (none — reads /proc + /sys) | | prometheus-process-exporter | (none — reads /proc) | | prometheus-systemd-exporter | (none — reads the bus) | | vmagent | `/var/cache/vmagent` (`-remoteWrite.tmpDataPath`) | | vlagent | `/var/lib/vlagent` (tmpDataPath + file checkpoints) | | systemd-journal-upload | `/var/lib/systemd/journal-upload` (`--save-state`) | `prometheus-node-exporter` carries the required per-host delta `SystemCallFilter = [ "@system-service" "@clock" ]` — node_exporter's `timex` collector calls `adjtimex(2)`, which the module's default `@system-service` excludes; without it every scrape dies with SIGSYS and the unit crash-loops (measured on vpn-mx: `sig=31 syscall=171`, NRestarts=16 in 13 min). `postgres` / `dovecot` / `postfix` / `caddy` stay out (module exception register — mail + ingress writers need measured paths first, one host at a time); the CI runners are excluded outright; grafana/listmonk/atticd are later cutovers. The module's table is applied at `lib.mkOverride 1500`, so each unit's own stronger declaration wins (the nixpkgs exporters already declare `ProtectSystem=strict`, `ProtectHome`, `PrivateTmp`, `NoNewPrivileges`; vlagent declared none and now gains the full table). ## DoD - [ ] CI green on the head SHA - [ ] merged (merge commit, not squash) - [ ] deployed to mail - [ ] verified LIVE on mail: `systemctl show <unit>` shows the table, every enrolled unit active with NRestarts=0, `/etc/fleet-service-sandbox.policy` present, and a real `/metrics` scrape returns 200 ## Offline evidence - `nix eval .#nixosConfigurations.mail.config.ymr.serviceSandbox.enrolledUnits` → the six units above - `nix eval .#nixosConfigurations.mail.config.systemd.services.<unit>.serviceConfig` → the hardening keys + ReadWritePaths - full `config.system.build.toplevel.drvPath` evaluates (assertions pass)

hermes added 1 commit 2026-10-13 06:45:49 -06:00

mail: enrol the host in ymr.serviceSandbox (nix-config#932) ... 71d7c4746d

Enable the fleet service sandbox on mail and enrol the units whose write
paths were measured on the host: the three prometheus exporters (no
writes), vmagent (/var/cache/vmagent), vlagent (/var/lib/vlagent) and
systemd-journal-upload (/var/lib/systemd/journal-upload). node-exporter
keeps the required @clock syscall delta (timex/adjtimex).

Cutover from nix-config#896 section 9 step 2; template from the vpn-mx
cutover (nix-config#909). postgres/dovecot/postfix/caddy stay out (module
exception register).

hermes force-pushed kb/NCFG-932-mail-sandbox from 71d7c4746d to 5a09b36272 2026-10-13 06:47:55 -06:00 Compare

hermes merged commit ee539e1177 into main 2026-10-13 06:55:41 -06:00

hermes referenced this pull request from a commit 2026-10-13 06:55:42 -06:00

Merge pull request #1965 from kb/NCFG-932-mail-sandbox

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backlog

  

bug

  

enhancement

  

in-progress

  

review

  

todo

No labels

backlog

bug

enhancement

in-progress

review

todo

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ymrtech/nix-config!1965

No description provided.