nixos/glances: init module

nixos/doc/manual/release-notes/rl-2411.section.md

···
 
 - [Zapret](https://github.com/bol-van/zapret), a DPI bypass tool. Available as [services.zapret](option.html#opt-services.zapret.enable).
 
+- [Glances](https://github.com/nicolargo/glances), an open-source system cross-platform monitoring tool. Available as [services.glances](option.html#opt-services.glances).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - Nixpkgs now requires Nix 2.3.17 or newer to allow for zstd compressed binary artifacts.

nixos/modules/module-list.nix

···
   ./services/monitoring/do-agent.nix
   ./services/monitoring/fusion-inventory.nix
   ./services/monitoring/gatus.nix
+  ./services/monitoring/glances.nix
   ./services/monitoring/goss.nix
   ./services/monitoring/grafana-agent.nix
   ./services/monitoring/grafana-image-renderer.nix

nixos/modules/services/monitoring/glances.md

···
+# Glances {#module-serives-glances}
+
+Glances an Eye on your system. A top/htop alternative for GNU/Linux, BSD, Mac OS
+and Windows operating systems.
+
+Visit [the Glances project page](https://github.com/nicolargo/glances) to learn
+more about it.
+
+# Quickstart {#module-serives-glances-quickstart}
+
+Use the following configuration to start a public instance of Glances locally:
+
+```nix
+{
+  services.glances = {
+    enable = true;
+    openFirewall = true;
+  };
+};
+```

nixos/modules/services/monitoring/glances.nix

···
+{
+  pkgs,
+  config,
+  lib,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.glances;
+
+  inherit (lib)
+    getExe
+    maintainers
+    mkEnableOption
+    mkOption
+    mkIf
+    mkPackageOption
+    ;
+
+  inherit (lib.types)
+    bool
+    listOf
+    port
+    str
+    ;
+
+  inherit (utils)
+    escapeSystemdExecArgs
+    ;
+
+in
+{
+  options.services.glances = {
+    enable = mkEnableOption "Glances";
+
+    package = mkPackageOption pkgs "glances" { };
+
+    port = mkOption {
+      description = "Port the server will isten on.";
+      type = port;
+      default = 61208;
+    };
+
+    openFirewall = mkOption {
+      description = "Open port in the firewall for glances.";
+      type = bool;
+      default = false;
+    };
+
+    extraArgs = mkOption {
+      type = listOf str;
+      default = [ "--webserver" ];
+      example = [
+        "--webserver"
+        "--disable-webui"
+      ];
+      description = ''
+        Extra command-line arguments to pass to glances.
+
+        See https://glances.readthedocs.io/en/latest/cmds.html for all available options.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services."glances" = {
+      description = "Glances";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        DynamicUser = true;
+        ExecStart = "${getExe cfg.package} --port ${toString cfg.port} ${escapeSystemdExecArgs cfg.extraArgs}";
+        Restart = "on-failure";
+
+        NoNewPrivileges = true;
+        ProtectSystem = "full";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+          "AF_UNIX"
+        ];
+        LockPersonality = true;
+        RestrictRealtime = true;
+        ProtectClock = true;
+        ReadWritePaths = [ "/var/log" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        SystemCallFilter = [ "@system-service" ];
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+  };
+
+  meta.maintainers = with maintainers; [ claha ];
+}

nixos/tests/all-tests.nix

···
   gitolite = handleTest ./gitolite.nix {};
   gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix {};
   glance = runTest ./glance.nix;
+  glances = runTest ./glances.nix;
   glusterfs = handleTest ./glusterfs.nix {};
   gnome = handleTest ./gnome.nix {};
   gnome-extensions = handleTest ./gnome-extensions.nix {};

nixos/tests/glances.nix

···
+{ lib, ... }:
+
+{
+  name = "glances";
+
+  nodes = {
+    machine_default =
+      { pkgs, ... }:
+      {
+        services.glances = {
+          enable = true;
+        };
+      };
+
+    machine_custom_port =
+      { pkgs, ... }:
+      {
+        services.glances = {
+          enable = true;
+          port = 5678;
+        };
+      };
+  };
+
+  testScript = ''
+    machine_default.start()
+    machine_default.wait_for_unit("glances.service")
+    machine_default.wait_for_open_port(61208)
+
+    machine_custom_port.start()
+    machine_custom_port.wait_for_unit("glances.service")
+    machine_custom_port.wait_for_open_port(5678)
+  '';
+
+  meta.maintainers = [ lib.maintainers.claha ];
+}

pkgs/applications/system/glances/default.nix

···
   packaging,
   psutil,
   setuptools,
+  pydantic,
+  nixosTests,
   # Optional dependencies:
   fastapi,
   jinja2,
···
     jinja2
     prometheus-client
   ] ++ lib.optional stdenv.hostPlatform.isLinux hddtemp;
+
+  passthru.tests = {
+    service = nixosTests.glances;
+  };
 
   meta = {
     homepage = "https://nicolargo.github.io/glances/";