nixos/prometheus: Fix match groups

[srhb]

Motivation for this change

Attempt to fix #126083 without reverting the entire environment substitution mechanism.

This needs a backport to 21.05 to unbreak Prometheus configs using match groups, so please consider if my "transition scheme" wrt. assertions and options are acceptable for that purpose.

Things done

• Test for match groups (which currently fails on unstable and 21.05) and substitution
• Switch to GNU gettext envsubst -- I believe I've mostly preserved the semantics of the current option, but hopefully someone who uses it can test that. @pkern could you help? 🙂
• Added a new option environmentVariables which explicitly needs to mention every variable that needs to be substituted. This is then fed to envsubst.
• Added an assertion that hopefully protects anyone already using environmentFile from breaking their config in the opposite manner, by forgetting to mention the environment variables.

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• 21.11 Release Notes
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[pkern]

Kudos to attempting to fix it this way and thanks a lot for pointing out the issue in the first place - and apologies for the work necessary to deal with it. I will admit that this PR actually fixed a bug in my configuration as well (${1} being wrongly expanded). I tested your change and it does what it says on the tin. There doesn't seem to be much prior art beyond one instance where environmentVariables is actually a map. I guess I'd also not necessarily have expected the variables to be prefixed with $.

As it looks like there was a recent effort to add token file support to all service discovery methods on the Prometheus side, a rollback of my change might actually be cleaner. That was still missing from 20.09, but 21.05 has a recent enough version (>2.25). So passwords and bearer tokens are solved by password_file and bearer_token_file respectively.

(I'm not a maintainer though.)

[srhb]

Thanks for the comments. Yes, if it's the case that upstream has proper support for decoupling secrets from the config now, I'm inclined to revert instead. I'll open a PR when I have time later if no one beats me to it.

[srhb]

Opened #128731 instead