exporters: set /usr/bin/nologin as shell

data/Debian.yaml

@@ -1,2 +1,3 @@
 ---
 prometheus::env_file_path: '/etc/default'
+prometheus::usershell: '/usr/sbin/nologin'

data/RedHat.yaml

@@ -1,2 +1,3 @@
 ---
 prometheus::env_file_path: '/etc/sysconfig'
+prometheus::usershell: '/sbin/nologin'

data/defaults.yaml

@@ -1,4 +1,5 @@
 ---
+prometheus::usershell: '/usr/bin/nologin'
 prometheus::configname: 'prometheus.yaml'
 prometheus::service_enable: true
 prometheus::service_ensure: 'running'

manifests/daemon.pp

@@ -89,6 +89,7 @@
   Stdlib::Host $scrape_host            = $facts['fqdn'],
   Optional[Stdlib::Port] $scrape_port  = undef,
   String[1] $scrape_job_name           = $name,
+  Stdlib::Absolutepath $usershell      = $prometheus::usershell,
 ) {
 
   case $install_method {
@@ -148,6 +149,7 @@
       ensure => 'present',
       system => true,
       groups => $extra_groups,
+      shell  => $usershell,
     })
 
     if $manage_group {

manifests/init.pp

@@ -146,6 +146,10 @@
 #  Defaults to `undef`, but set to a large integer to override your default OS limit.
 #  Currently only implemented for systemd based service.
 #
+#  [*usershell*]
+#  if requested, we create a user for prometheus or the exporters. The default
+#  shell is nologin. It can be overwritten to any valid path.
+#
 # Actions:
 #
 # Requires: see Modulefile
@@ -193,6 +197,7 @@
   Boolean $manage_user,
   Optional[String[1]] $extract_command,
   Boolean $manage_config,
+  Stdlib::Absolutepath $usershell,
   Hash $extra_alerts    = {},
   Hash $config_hash     = {},
   Hash $config_defaults = {},

manifests/install.pp

@@ -72,6 +72,7 @@
       ensure => 'present',
       system => true,
       groups => $prometheus::server::extra_groups,
+      shell  => $prometheus::server::usershell,
     })
 
     if $prometheus::server::manage_group {

manifests/server.pp

@@ -45,6 +45,7 @@
   Boolean $manage_config                                                        = $prometheus::manage_config,
   Optional[Variant[Stdlib::HTTPurl, Stdlib::Unixpath, String[1]]] $external_url = $prometheus::external_url,
   Optional[Array[Hash[String[1], Any]]] $collect_scrape_jobs                    = $prometheus::collect_scrape_jobs,
+  Stdlib::Absolutepath $usershell                                               = $prometheus::usershell,
 ) inherits prometheus {
 
   if( versioncmp($version, '1.0.0') == -1 ){