nixos/beszel: allow S.M.A.R.T monitoring by hatch01 · Pull Request #460730 · NixOS/nixpkgs

hatch01 · 2025-11-11T18:14:53Z

Update to beszel 0.15.5 and allow systemd monitoring following this pr merged : henrygd/beszel#1153
following this comment in the module init : #380731 (comment)

Also allow smart monitoring highly copied from nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix

@Bot-wxt1221
@arunoruto
@BonusPlay

Things done

Add a 👍 reaction to pull requests you find important.

hatch01 · 2025-11-11T18:23:49Z

Still not tested as the release 0.15.5 is not out for now.

arunoruto · 2025-11-13T11:32:37Z

15.5 isn't coming out, but 16.0 just released. I am still not sure if it can be built tho due to the version of the go toolchain...

hatch01 · 2025-11-13T13:47:52Z

`nixpkgs-review` result

Generated using nixpkgs-review-gha

Command: nixpkgs-review pr 460730
Commit: 00771eeba274893dc4e2e208c31b97cccc1f3e7d (subsequent changes)
Merge: bbca80dd0a77b488d0da7bc5715f3a64b9af96c2

Logs: https://github.com/hatch01/nixpkgs-review-gha/actions/runs/19332611268

`x86_64-linux`

⏩ 2 packages blacklisted:

nixos-install-tools
tests.nixos-functions.nixos-test

✅ 1 package built:

beszel

`aarch64-linux`

⏩ 2 packages blacklisted:

nixos-install-tools
tests.nixos-functions.nixos-test

✅ 1 package built:

beszel

`x86_64-darwin` (sandbox = relaxed)

❌ 1 package failed to build:

beszel

Error logs: `x86_64-darwin`

beszel

        server_test.go:176: 
            	Error Trace:	/nix/build/nix-9522-410436637/source/agent/server_test.go:176
            	Error:      	Received unexpected error:
            	            	dial tcp :45987: connect: operation not permitted
            	Test:       	TestStartServer/good_key_still_good
2025/11/13 13:47:19 WARN Data directory not found
2025/11/13 13:47:19 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:47:19 WARN Data directory not found
2025/11/13 13:47:19 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:47:19 WARN Data directory not found
2025/11/13 13:47:19 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:47:19 WARN Data directory not found
2025/11/13 13:47:19 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:47:19 WARN Data directory not found
2025/11/13 13:47:19 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:47:19 WARN Data directory not found
2025/11/13 13:47:19 INFO Root disk mountpoint=/ io=disk0
FAIL
FAIL	github.com/henrygd/beszel/agent	2.067s
FAIL

`aarch64-darwin` (sandbox = relaxed)

❌ 1 package failed to build:

beszel

Error logs: `aarch64-darwin`

beszel

        server_test.go:176: 
            	Error Trace:	/nix/build/nix-5370-692541792/source/agent/server_test.go:176
            	Error:      	Received unexpected error:
            	            	dial tcp :45987: connect: operation not permitted
            	Test:       	TestStartServer/good_key_still_good
2025/11/13 13:39:44 WARN Data directory not found
2025/11/13 13:39:44 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:39:44 WARN Data directory not found
2025/11/13 13:39:44 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:39:44 WARN Data directory not found
2025/11/13 13:39:44 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:39:44 WARN Data directory not found
2025/11/13 13:39:44 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:39:44 WARN Data directory not found
2025/11/13 13:39:44 INFO Root disk mountpoint=/ io=disk0
2025/11/13 13:39:45 WARN Data directory not found
2025/11/13 13:39:45 INFO Root disk mountpoint=/ io=disk0
FAIL
FAIL	github.com/henrygd/beszel/agent	1.371s
FAIL

hatch01 · 2025-11-13T13:50:27Z

I need to wait for go 1.25.3 to be merged in nixos-unstable to test on my server

hatch01 · 2025-11-13T14:01:00Z

May I need to fix the tests on darwin with something like :

  checkFlags = lib.optionals.stdenv.isDarwin [
    # Disable tests that require a running server on darwin
    "-run=^(Test(?!StartServer))"
  ];

Or is this normal ?

karlprieb · 2025-11-13T14:38:21Z

Just tested it in linux x86_64 and aarch64 and it works.

karlprieb · 2025-11-13T14:40:11Z

nixos/modules/services/monitoring/beszel-agent.nix

+        # Capabilities needed for SMART disk monitoring
+        AmbientCapabilities = [
+          "CAP_SYS_RAWIO"
+          "CAP_SYS_ADMIN"
+        ];
+        CapabilityBoundingSet = [
+          "CAP_SYS_RAWIO"
+          "CAP_SYS_ADMIN"
+        ];
+
+        # Device access for SMART monitoring
+        DevicePolicy = "closed";
+        DeviceAllow = [
+          "block-blkext rw"
+          "block-sd rw"
+          "char-nvme rw"
+        ];


Maybe these should be optional, including the smartmontools package.
For those who are not interested in SMART stats these settings are not needed and the security aspect we had before can be kept.

Agreed, adding an option for such a purpose would be ideal or somehow manage it via env variables. I will look into this later.

Having an option for this is definitely a good idea, but I’m not entirely sure whether it should default to true or false.

Pros of setting it to true by default:

Improves discoverability of Beszel’s features.

Prevents potential warnings if Beszel tries to access a disk without the proper permissions.

Could alert users to disk issues they might not have been aware of.

Pros of setting it to false by default:

Avoids interfering with users’ drive sleep schedules, which can be important for some setups.

nixos/modules/services/monitoring/beszel-agent.nix

arunoruto · 2025-11-13T17:35:56Z

Here are a few points:

I guess that the update to 16.0 will happen automatically like beszel: 0.14.1 -> 0.15.4 #461038, I am just waiting for 1.25.3 to hit unstable so there isn't one more package that is staling the propagation to the final branches.
This means this PR will probably drop the package update, and we can just concentrate to merge the smartmon tools. We need a good way of handling this. Like @karlprieb mentioned, this should be optional and shouldn't be forced to everyone. This can mess up with someones schedule to make drives sleep, so we need to be very careful!
With that said, systemd monitoring is a bit beyond the scope of this PR then, especially since we do not know what is needed to make it run correctly on NixOS. I would suggest to postpone this to a separate PR where we can tackle it :)

Points 1. and 3. both need go-1.25.3 (https://nixpk.gs/pr-tracker.html?pr=451802), so lets wait until it hits unstable.

Regarding 2., what would be the main point of this PR (IMHO):
Maybe a custom option services.beszel-agent.smartmon would be appropriate with enable and package options. If there is a better or more elegant way, I am open for suggestions.

hatch01 · 2025-11-13T18:09:44Z

Ok I will split this PR into 3 PR (keeping update to 0.16.0 to be faster than r-ryantm)

arunoruto · 2025-11-13T18:30:16Z

Ok I will split this PR into 3 PR (keeping update to 0.16.0 to be faster than r-ryantm)

You are right, but r-ryantm can be merged by a package maintainer, your PR has to be merged by someone with a commit bit. But we will see what will happen faster. I think there is a way to enforce a r-ryantm PR, but I will have to look into that :)

BonusPlay · 2025-11-15T15:55:32Z

Any specific reason for mkForce in PrivateDevices? I think modules should use mkDefault and mkForce should be almost strictly reserved for end user to override config when needed.

hatch01 · 2025-11-15T16:06:37Z

I stole it at :

nixos/modules/services/monitoring/prometheus/exporters/smartctl.nix
67:      PrivateDevices = lib.mkForce false;

But yes, I agree that just using mkDefault should be enough.

hatch01 · 2025-11-15T16:11:06Z

No hint on why this is forced in the PR from Prometheus (#147056), so let's stay with mkDefault.

BonusPlay · 2025-11-23T11:57:59Z

Note to commiters: this PR is waiting for relevant package update.

hatch01 · 2025-11-24T07:11:18Z

Note to commiters: this PR is waiting for relevant package update.

This is not true anymore; S.M.A.R.T. support is included in Beszel since v0.15.0, and the current Beszel in Nixpkgs (unstable) is 0.15.4.
So this PR is ready for merge I think.

BonusPlay

Oh right, I meant the systemd is waiting for 0.16. We can merge this one.

nixos-discourse · 2025-12-03T12:46:53Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/6130

nixos/modules/services/monitoring/beszel-agent.nix

hatch01 · 2026-01-19T11:39:12Z

@arunoruto is this PR good for you, or are there still things to fix?

arunoruto

I am not sure about the systemd settings, someone else should take a look at it if its fine. But I have been using the PR for a time now and it has been working. This doesn't mean the security can't be tighten further ;)

nixos/modules/services/monitoring/beszel-agent.nix

nixos-discourse · 2026-01-22T19:07:15Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/6301

nixpkgs-ci · 2026-02-06T17:33:54Z

Successfully created backport PR for release-25.11:

[Backport release-25.11] nixos/beszel: allow S.M.A.R.T monitoring #487703

hatch01 force-pushed the beszel branch from f952612 to 5f527f0 Compare November 11, 2025 18:19

hatch01 force-pushed the beszel branch from 8df9fb0 to 9cc985b Compare November 11, 2025 18:23

hatch01 changed the title ~~beszel: 0.14.1 -> 0.15.5~~ beszel: 0.14.1 -> 0.16.0 Nov 13, 2025

hatch01 marked this pull request as ready for review November 13, 2025 13:05

hatch01 force-pushed the beszel branch 2 times, most recently from e5d4611 to 00771ee Compare November 13, 2025 13:30

nixpkgs-ci bot requested review from Bot-wxt1221 and arunoruto November 13, 2025 13:37

karlprieb reviewed Nov 13, 2025

View reviewed changes

arunoruto reviewed Nov 13, 2025

View reviewed changes

nixos/modules/services/monitoring/beszel-agent.nix Outdated Show resolved Hide resolved

hatch01 force-pushed the beszel branch from 00771ee to 16bfeb3 Compare November 13, 2025 18:20

hatch01 changed the title ~~beszel: 0.14.1 -> 0.16.0~~ nixos/beszel: allow S.M.A.R.T monitoring Nov 13, 2025

nixpkgs-ci bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. and removed 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-darwin: 1 This PR causes 1 package to rebuild on Darwin. labels Nov 13, 2025

hatch01 force-pushed the beszel branch from 16bfeb3 to 6e6aa02 Compare November 14, 2025 09:26

hatch01 force-pushed the beszel branch from 76bf4fb to 20eb29b Compare November 15, 2025 16:07

BonusPlay approved these changes Nov 24, 2025

View reviewed changes

nixpkgs-ci bot added the 12.approvals: 1 This PR was reviewed and approved by one person. label Nov 24, 2025

hatch01 force-pushed the beszel branch from 20eb29b to a282cb5 Compare December 3, 2025 12:33

pio2398 reviewed Dec 21, 2025

View reviewed changes

nixos/modules/services/monitoring/beszel-agent.nix Outdated Show resolved Hide resolved

hatch01 force-pushed the beszel branch 2 times, most recently from 8d58269 to 1ada542 Compare January 6, 2026 16:59

Bot-wxt1221 approved these changes Jan 9, 2026

View reviewed changes

nixpkgs-ci bot added 12.approvals: 2 This PR was reviewed and approved by two persons. and removed 12.approvals: 1 This PR was reviewed and approved by one person. labels Jan 9, 2026

hatch01 force-pushed the beszel branch 2 times, most recently from 4cd0042 to c0b6939 Compare January 19, 2026 11:43

arunoruto reviewed Jan 22, 2026

View reviewed changes

nixos/modules/services/monitoring/beszel-agent.nix Outdated Show resolved Hide resolved

nixos/beszel: allow S.M.A.R.T monitoring

a11465f

hatch01 force-pushed the beszel branch from c0b6939 to a11465f Compare January 22, 2026 19:05

SuperSandro2000 added this pull request to the merge queue Jan 23, 2026

Merged via the queue into NixOS:master with commit 1f80148 Jan 23, 2026
29 of 31 checks passed

MakiseKurisu added the backport release-25.11 Backport PR automatically label Feb 6, 2026

nixpkgs-ci bot mentioned this pull request Feb 6, 2026

[Backport release-25.11] nixos/beszel: allow S.M.A.R.T monitoring #487703

Merged

github-actions bot added the 8.has: port to stable This PR already has a backport to the stable release. label Feb 6, 2026

Uh oh!

Conversation

hatch01 commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

hatch01 commented Nov 11, 2025

Uh oh!

arunoruto commented Nov 13, 2025

Uh oh!

hatch01 commented Nov 13, 2025

nixpkgs-review result

x86_64-linux

aarch64-linux

x86_64-darwin (sandbox = relaxed)

aarch64-darwin (sandbox = relaxed)

Uh oh!

hatch01 commented Nov 13, 2025

Uh oh!

hatch01 commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

karlprieb commented Nov 13, 2025

Uh oh!

karlprieb Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

arunoruto Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

hatch01 Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

arunoruto commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hatch01 commented Nov 13, 2025

Uh oh!

arunoruto commented Nov 13, 2025

Uh oh!

BonusPlay commented Nov 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hatch01 commented Nov 15, 2025

Uh oh!

hatch01 commented Nov 15, 2025

Uh oh!

BonusPlay commented Nov 23, 2025

Uh oh!

hatch01 commented Nov 24, 2025

Uh oh!

BonusPlay left a comment

Choose a reason for hiding this comment

Uh oh!

nixos-discourse commented Dec 3, 2025

Uh oh!

Uh oh!

hatch01 commented Jan 19, 2026

Uh oh!

arunoruto left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nixos-discourse commented Jan 22, 2026

Uh oh!

Uh oh!

nixpkgs-ci bot commented Feb 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

hatch01 commented Nov 11, 2025 •

edited

Loading

`nixpkgs-review` result

`x86_64-linux`

`aarch64-linux`

`x86_64-darwin` (sandbox = relaxed)

`aarch64-darwin` (sandbox = relaxed)

hatch01 commented Nov 13, 2025 •

edited

Loading

arunoruto commented Nov 13, 2025 •

edited

Loading

BonusPlay commented Nov 15, 2025 •

edited

Loading