nixos/loki: skip config validation when it's impossible to validate

This is a follow-up to 8d7f3c9dbde7d235f3e256f2dc13ec07e68f60f6 and
ae48735c531aaa01fb083333b1ec7e538c04b99d.

Running the config validation in the build sandbox is impossible and
will fail when using `cfg.configFile` or `-config.expand-env=true`.

`cfg.configFile` is a string of a path which is simply not available to
the build sandbox.

Similarly, one may opt to use `cfg.configuration` with environment
variables in combination with `-config.expand-env=true`.

The environment variables referenced that way are also not available
in the build sandbox.

So we skip the validation when it's impossible (`cfg.configFile`) or
likely impossible (`-config.expand-env=true`).

An alternative approach would be something like nixos/prometheus'
`services.prometheus.checkConfig` that takes a boolean and makes
toggling the config validation user-facing.

1 files changed, 7 insertions, 2 deletions

diff --git a/nixos/modules/services/monitoring/loki.nix b/nixos/modules/services/monitoring/loki.nix
index 9af1de6aa11f9..de4f1bc7aa23e 100644
--- a/nixos/modules/services/monitoring/loki.nix
+++ b/nixos/modules/services/monitoring/loki.nix
@@ -97,7 +97,12 @@ in {
 
       serviceConfig = let
         conf = if cfg.configFile == null
-               then prettyJSON cfg.configuration
+               then
+                 # Config validation may fail when using extraFlags = [ "-config.expand-env=true" ].
+                 # To work around this, we simply skip it when extraFlags is not empty.
+                 if cfg.extraFlags == []
+                 then validateConfig (prettyJSON cfg.configuration)
+                 else prettyJSON cfg.configuration
                else cfg.configFile;
         validateConfig = file:
         pkgs.runCommand "validate-loki-conf" {
@@ -108,7 +113,7 @@ in {
           '';
       in
       {
-        ExecStart = "${cfg.package}/bin/loki --config.file=${validateConfig conf} ${escapeShellArgs cfg.extraFlags}";
+        ExecStart = "${cfg.package}/bin/loki --config.file=${conf} ${escapeShellArgs cfg.extraFlags}";
         User = cfg.user;
         Restart = "always";
         PrivateTmp = true;