cmd/bosun: define rule vars in sysconfig

kylebrandt · web-flow · commit c699b451e282 · 2017-04-04T16:03:54.000-04:00
diff --git a/cmd/bosun/conf/conf.go b/cmd/bosun/conf/conf.go
@@ -34,6 +34,8 @@ type SystemConfProvider interface {
 	GetTLSCertFile() string
 	GetTLSKeyFile() string
 
+	GetRuleVars() map[string]string
+
 	GetSMTPHost() string
 	GetSMTPUsername() string // SMTP username
 	GetSMTPPassword() string // SMTP password
diff --git a/cmd/bosun/conf/rule/modify.go b/cmd/bosun/conf/rule/modify.go
@@ -15,7 +15,7 @@ import (
 // will not be saved. If the savehook fails to run or returns an error thaen the orginal config
 // will be restored and the reload will not take place.
 func (c *Conf) SaveRawText(rawConfig, diff, user, message string, args ...string) error {
-	newConf, err := NewConf(c.Name, c.backends, rawConfig)
+	newConf, err := NewConf(c.Name, c.backends, c.sysVars, rawConfig)
 	if err != nil {
 		return err
 	}
@@ -101,7 +101,7 @@ func (c *Conf) BulkEdit(edits conf.BulkEditRequest) error {
 		} else {
 			rawConf = writeSection(l, newConf.RawText, edit.Text)
 		}
-		newConf, err = NewConf(c.Name, c.backends, rawConf)
+		newConf, err = NewConf(c.Name, c.backends, c.sysVars, rawConf)
 		if err != nil {
 			return fmt.Errorf("could not create new conf: failed on step %v:%v : %v", edit.Type, edit.Name, err)
 		}
diff --git a/cmd/bosun/conf/rule/rule.go b/cmd/bosun/conf/rule/rule.go
@@ -45,6 +45,8 @@ type Conf struct {
 	reload   func() error
 	backends conf.EnabledBackends
 
+	sysVars map[string]string
+
 	tree            *parse.Tree
 	node            parse.Node
 	unknownTemplate string
@@ -125,19 +127,19 @@ func (c *Conf) parseNotifications(v string) (map[string]*conf.Notification, erro
 	return ns, nil
 }
 
-func ParseFile(fname string, backends conf.EnabledBackends) (*Conf, error) {
+func ParseFile(fname string, backends conf.EnabledBackends, sysVars map[string]string) (*Conf, error) {
 	f, err := ioutil.ReadFile(fname)
 	if err != nil {
 		return nil, err
 	}
-	return NewConf(fname, backends, string(f))
+	return NewConf(fname, backends, sysVars, string(f))
 }
 
 func (c *Conf) SaveConf(newConf *Conf) error {
 	return ioutil.WriteFile(c.Name, []byte(newConf.RawText), os.FileMode(int(0640)))
 }
 
-func NewConf(name string, backends conf.EnabledBackends, text string) (c *Conf, err error) {
+func NewConf(name string, backends conf.EnabledBackends, sysVars map[string]string, text string) (c *Conf, err error) {
 	defer errRecover(&err)
 	c = &Conf{
 		Name:             name,
@@ -153,6 +155,7 @@ func NewConf(name string, backends conf.EnabledBackends, text string) (c *Conf,
 		writeLock:        make(chan bool, 1),
 		deferredSections: make(map[string][]deferredSection),
 		backends:         backends,
+		sysVars:          sysVars,
 	}
 	c.tree, err = parse.Parse(name, text)
 	if err != nil {
@@ -776,6 +779,8 @@ func (c *Conf) Expand(v string, vars map[string]string, ignoreBadExpand bool) st
 			n = _n
 		} else if strings.HasPrefix(s, "$env.") {
 			n = os.Getenv(s[5:])
+		} else if strings.HasPrefix(s, "$sys.") {
+			n = c.sysVars[s[5:]]
 		} else if ignoreBadExpand {
 			return s
 		} else {
diff --git a/cmd/bosun/conf/rule/rule_test.go b/cmd/bosun/conf/rule/rule_test.go
@@ -18,7 +18,7 @@ func TestPrint(t *testing.T) {
 	if err := os.Setenv("env", "1"); err != nil {
 		t.Fatal(err)
 	}
-	c, err := NewConf(fname, conf.EnabledBackends{OpenTSDB: true}, string(b))
+	c, err := NewConf(fname, conf.EnabledBackends{OpenTSDB: true}, nil, string(b))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -79,7 +79,7 @@ func TestInvalid(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		_, err = NewConf(fname, conf.EnabledBackends{OpenTSDB: true}, string(b))
+		_, err = NewConf(fname, conf.EnabledBackends{OpenTSDB: true}, nil, string(b))
 		if err == nil {
 			t.Error("expected error in", path)
 			continue
diff --git a/cmd/bosun/conf/system.go b/cmd/bosun/conf/system.go
@@ -39,6 +39,8 @@ type SystemConf struct {
 
 	SMTPConf SMTPConf
 
+	RuleVars map[string]string
+
 	OpenTSDBConf OpenTSDBConf
 	GraphiteConf GraphiteConf
 	InfluxConf   InfluxConf
@@ -333,6 +335,12 @@ func (sc *SystemConf) GetAuthConf() *AuthConf {
 	return sc.AuthConf
 }
 
+// GetRuleVars user defined variables that will be available to the rule configuration
+// under "$sys.". This is so values with secrets can be defined in the system configuration
+func (sc *SystemConf) GetRuleVars() map[string]string {
+	return sc.RuleVars
+}
+
 // GetTimeAndDate returns the http://www.timeanddate.com/ that should be available to the UI
 // so it can show links to translate UTC times to various timezones. This feature is only
 // for creating UI Links as Bosun is expected to be running on a machine that is set to UTC
diff --git a/cmd/bosun/main.go b/cmd/bosun/main.go
@@ -114,7 +114,7 @@ func main() {
 	if err != nil {
 		slog.Fatal(err)
 	}
-	ruleConf, err := rule.ParseFile(sysProvider.GetRuleFilePath(), systemConf.EnabledBackends())
+	ruleConf, err := rule.ParseFile(sysProvider.GetRuleFilePath(), systemConf.EnabledBackends(), systemConf.GetRuleVars())
 	if err != nil {
 		slog.Fatalf("couldn't read rules: %v", err)
 	}
@@ -219,7 +219,7 @@ func main() {
 		defer func() {
 			<-reloading
 		}()
-		newConf, err := rule.ParseFile(sysProvider.GetRuleFilePath(), sysProvider.EnabledBackends())
+		newConf, err := rule.ParseFile(sysProvider.GetRuleFilePath(), sysProvider.EnabledBackends(), sysProvider.GetRuleVars())
 		if err != nil {
 			return err
 		}
diff --git a/cmd/bosun/sched/check_test.go b/cmd/bosun/sched/check_test.go
@@ -17,7 +17,7 @@ import (
 
 func TestCheckFlapping(t *testing.T) {
 	defer setup()()
-	c, err := rule.NewConf("", conf.EnabledBackends{}, `
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, `
 		template t {
 			subject = 1
 		}
@@ -106,7 +106,7 @@ func TestCheckSilence(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
 		template t {
 			subject = "test"
 			body = "test"
@@ -143,7 +143,7 @@ func TestCheckSilence(t *testing.T) {
 
 func TestIncidentIds(t *testing.T) {
 	defer setup()()
-	c, err := rule.NewConf("", conf.EnabledBackends{}, `
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, `
 		alert a {
 			crit = 1
 		}
@@ -201,7 +201,7 @@ func TestCheckNotify(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
 		template t {
 			subject = {{.Last.Status}}
 		}
@@ -245,7 +245,7 @@ func TestCheckNotifyUnknown(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
 		template t {
 			subject = {{.Name}}: {{.Group | len}} unknown alerts
 		}
@@ -308,7 +308,7 @@ func TestCheckNotifyUnknownDefault(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
 		template t {
 			subject = template
 		}
@@ -369,7 +369,7 @@ func TestCheckNotifyLog(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
 		template t {
 			subject = {{.Alert.Name}}
 		}
diff --git a/cmd/bosun/sched/notification_test.go b/cmd/bosun/sched/notification_test.go
@@ -11,7 +11,7 @@ import (
 )
 
 func TestActionNotificationTemplates(t *testing.T) {
-	c, err := rule.NewConf("", conf.EnabledBackends{}, ``)
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, ``)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -53,7 +53,7 @@ func TestActionNotificationTemplates(t *testing.T) {
 
 func TestActionNotificationGrouping(t *testing.T) {
 	defer setup()()
-	c, err := rule.NewConf("", conf.EnabledBackends{}, `
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, `
 		template t{
 			subject = 2
 		}
diff --git a/cmd/bosun/sched/sched_test.go b/cmd/bosun/sched/sched_test.go
@@ -98,7 +98,7 @@ func testSched(t *testing.T, st *schedTest) (s *Schedule) {
 		t.Fatal(err)
 	}
 	//confs := "tsdbHost = " + u.Host + "\n" + st.conf
-	c, err := rule.NewConf("testconf", conf.EnabledBackends{OpenTSDB: true}, st.conf)
+	c, err := rule.NewConf("testconf", conf.EnabledBackends{OpenTSDB: true}, nil, st.conf)
 	if err != nil {
 		t.Error(err)
 		t.Logf("conf:\n%s", st.conf)
diff --git a/cmd/bosun/web/expr.go b/cmd/bosun/web/expr.go
@@ -448,7 +448,7 @@ func buildConfig(r *http.Request) (c conf.RuleConfProvider, a *conf.Alert, hash
 	if err != nil {
 		return nil, nil, "", err
 	}
-	c, err = rule.NewConf("Test Config", schedule.SystemConf.EnabledBackends(), string(config))
+	c, err = rule.NewConf("Test Config", schedule.SystemConf.EnabledBackends(), schedule.SystemConf.GetRuleVars(), string(config))
 	if err != nil {
 		return nil, nil, "", err
 	}
diff --git a/cmd/bosun/web/web.go b/cmd/bosun/web/web.go
@@ -840,7 +840,7 @@ func ConfigTest(t miniprofiler.Timer, w http.ResponseWriter, r *http.Request) (i
 	if len(b) == 0 {
 		return nil, fmt.Errorf("empty config")
 	}
-	_, err = rule.NewConf("test", schedule.SystemConf.EnabledBackends(), string(b))
+	_, err = rule.NewConf("test", schedule.SystemConf.EnabledBackends(), schedule.SystemConf.GetRuleVars(), string(b))
 	if err != nil {
 		fmt.Fprintf(w, err.Error())
 	}
diff --git a/cmd/bosun/web/web_test.go b/cmd/bosun/web/web_test.go
@@ -9,7 +9,7 @@ import (
 )
 
 func TestErrorTemplate(t *testing.T) {
-	c, err := rule.NewConf("", conf.EnabledBackends{}, `
+	c, err := rule.NewConf("", conf.EnabledBackends{}, nil, `
 		template t {
 			body = {{.Eval "invalid"}}
 		}
diff --git a/docs/system_configuration.md b/docs/system_configuration.md
@@ -65,7 +65,7 @@ Example:
 `CheckFrequency = "1m"`
 
 ### DefaultRunEvery
-By default, alert checks are run at every [`CheckFrequency`](/system_configuration#checkevery) multiplied by the `DefaultRunEvery` value. This can be overridden in an alert definition with the [`runEvery` keyword](http://localhost:4000/definitions#runevery). This defaults to 1.
+By default, alert checks are run at every [`CheckFrequency`](/system_configuration#checkevery) multiplied by the `DefaultRunEvery` value. This can be overridden in an alert definition with the [`runEvery` keyword](/definitions#runevery). This defaults to 1.
  
 So for example if you have a `CheckFrequency` of "1m" and a `DefaultRunEvery` of 5, alerts by default will run every 5 minutes. But you could have some run as frequent as every "1m", and others that run less often (any multiple of "1m").
 
@@ -150,6 +150,28 @@ But not sure I trust that.
 ## Configuration Sections
 All your key value pairs must be defined before any sections are defined. Sections are used for things that have multiple values to configure them. In particular the various time series database providers.
 
+### RuleVars
+Rule vars lets you define variables that will then be turned into [global variables](/definitions#global-variables) available to definitions under `$sys.`. This is designed for when you have some secrets you don't want exposed in the definitions file. The values of these variables *can* still be accessed from Bosun's rule editor and expression UI, so this only helps hide them so you don't accidentally include them in screenshots or when copying and pasting your config.
+
+Example: 
+
+```
+[RuleVars]
+    CHAT = "https://chat.example.com/1?key=mySecretKey"
+    foo = "baz"
+```
+
+The above could then be used in the rule configuration like:
+
+```
+notification chat {
+    post = ${sys.CHAT}
+    runOnActions = false
+}
+```
+
+They can also be accessed in templates with the [`V()` function](/definitions#vstring-string)
+
 ### DBConf
 `DBConf` defines what internal storage Bosun should use. There are currently two choices, a built-in redis like server called ledis or redis. Redis is recommended for production setups. 
 

Original file line number	Diff line number	Diff line change
`@@ -15,7 +15,7 @@ import (`
`15`	`15`	`// will not be saved. If the savehook fails to run or returns an error thaen the orginal config`
`16`	`16`	`// will be restored and the reload will not take place.`
`17`	`17`	`func (c *Conf) SaveRawText(rawConfig, diff, user, message string, args ...string) error {`
`18`		`- newConf, err := NewConf(c.Name, c.backends, rawConfig)`
	`18`	`+ newConf, err := NewConf(c.Name, c.backends, c.sysVars, rawConfig)`
`19`	`19`	`if err != nil {`
`20`	`20`	`return err`
`21`	`21`	`}`
`@@ -101,7 +101,7 @@ func (c *Conf) BulkEdit(edits conf.BulkEditRequest) error {`
`101`	`101`	`} else {`
`102`	`102`	`rawConf = writeSection(l, newConf.RawText, edit.Text)`
`103`	`103`	`}`
`104`		`- newConf, err = NewConf(c.Name, c.backends, rawConf)`
	`104`	`+ newConf, err = NewConf(c.Name, c.backends, c.sysVars, rawConf)`
`105`	`105`	`if err != nil {`
`106`	`106`	`return fmt.Errorf("could not create new conf: failed on step %v:%v : %v", edit.Type, edit.Name, err)`
`107`	`107`	`}`
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ func TestPrint(t *testing.T) {`
`18`	`18`	`if err := os.Setenv("env", "1"); err != nil {`
`19`	`19`	`t.Fatal(err)`
`20`	`20`	`}`
`21`		`- c, err := NewConf(fname, conf.EnabledBackends{OpenTSDB: true}, string(b))`
	`21`	`+ c, err := NewConf(fname, conf.EnabledBackends{OpenTSDB: true}, nil, string(b))`
`22`	`22`	`if err != nil {`
`23`	`23`	`t.Fatal(err)`
`24`	`24`	`}`
`@@ -79,7 +79,7 @@ func TestInvalid(t *testing.T) {`
`79`	`79`	`if err != nil {`
`80`	`80`	`t.Fatal(err)`
`81`	`81`	`}`
`82`		`- _, err = NewConf(fname, conf.EnabledBackends{OpenTSDB: true}, string(b))`
	`82`	`+ _, err = NewConf(fname, conf.EnabledBackends{OpenTSDB: true}, nil, string(b))`
`83`	`83`	`if err == nil {`
`84`	`84`	`t.Error("expected error in", path)`
`85`	`85`	`continue`
Original file line number	Diff line number	Diff line change
`@@ -114,7 +114,7 @@ func main() {`
`114`	`114`	`if err != nil {`
`115`	`115`	`slog.Fatal(err)`
`116`	`116`	`}`
`117`		`- ruleConf, err := rule.ParseFile(sysProvider.GetRuleFilePath(), systemConf.EnabledBackends())`
	`117`	`+ ruleConf, err := rule.ParseFile(sysProvider.GetRuleFilePath(), systemConf.EnabledBackends(), systemConf.GetRuleVars())`
`118`	`118`	`if err != nil {`
`119`	`119`	`slog.Fatalf("couldn't read rules: %v", err)`
`120`	`120`	`}`
`@@ -219,7 +219,7 @@ func main() {`
`219`	`219`	`defer func() {`
`220`	`220`	`<-reloading`
`221`	`221`	`}()`
`222`		`- newConf, err := rule.ParseFile(sysProvider.GetRuleFilePath(), sysProvider.EnabledBackends())`
	`222`	`+ newConf, err := rule.ParseFile(sysProvider.GetRuleFilePath(), sysProvider.EnabledBackends(), sysProvider.GetRuleVars())`
`223`	`223`	`if err != nil {`
`224`	`224`	`return err`
`225`	`225`	`}`
Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ import (`
`17`	`17`
`18`	`18`	`func TestCheckFlapping(t *testing.T) {`
`19`	`19`	`defer setup()()`
`20`		- c, err := rule.NewConf("", conf.EnabledBackends{}, `
	`20`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, `
`21`	`21`	`template t {`
`22`	`22`	`subject = 1`
`23`	`23`	`}`
`@@ -106,7 +106,7 @@ func TestCheckSilence(t *testing.T) {`
`106`	`106`	`if err != nil {`
`107`	`107`	`t.Fatal(err)`
`108`	`108`	`}`
`109`		- c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
	`109`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
`110`	`110`	`template t {`
`111`	`111`	`subject = "test"`
`112`	`112`	`body = "test"`
`@@ -143,7 +143,7 @@ func TestCheckSilence(t *testing.T) {`
`143`	`143`
`144`	`144`	`func TestIncidentIds(t *testing.T) {`
`145`	`145`	`defer setup()()`
`146`		- c, err := rule.NewConf("", conf.EnabledBackends{}, `
	`146`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, `
`147`	`147`	`alert a {`
`148`	`148`	`crit = 1`
`149`	`149`	`}`
`@@ -201,7 +201,7 @@ func TestCheckNotify(t *testing.T) {`
`201`	`201`	`if err != nil {`
`202`	`202`	`t.Fatal(err)`
`203`	`203`	`}`
`204`		- c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
	`204`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
`205`	`205`	`template t {`
`206`	`206`	`subject = {{.Last.Status}}`
`207`	`207`	`}`
`@@ -245,7 +245,7 @@ func TestCheckNotifyUnknown(t *testing.T) {`
`245`	`245`	`if err != nil {`
`246`	`246`	`t.Fatal(err)`
`247`	`247`	`}`
`248`		- c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
	`248`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
`249`	`249`	`template t {`
`250`	`250`	`subject = {{.Name}}: {{.Group \| len}} unknown alerts`
`251`	`251`	`}`
`@@ -308,7 +308,7 @@ func TestCheckNotifyUnknownDefault(t *testing.T) {`
`308`	`308`	`if err != nil {`
`309`	`309`	`t.Fatal(err)`
`310`	`310`	`}`
`311`		- c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
	`311`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
`312`	`312`	`template t {`
`313`	`313`	`subject = template`
`314`	`314`	`}`
`@@ -369,7 +369,7 @@ func TestCheckNotifyLog(t *testing.T) {`
`369`	`369`	`if err != nil {`
`370`	`370`	`t.Fatal(err)`
`371`	`371`	`}`
`372`		- c, err := rule.NewConf("", conf.EnabledBackends{}, fmt.Sprintf(`
	`372`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, fmt.Sprintf(`
`373`	`373`	`template t {`
`374`	`374`	`subject = {{.Alert.Name}}`
`375`	`375`	`}`
Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@ import (`
`11`	`11`	`)`
`12`	`12`
`13`	`13`	`func TestActionNotificationTemplates(t *testing.T) {`
`14`		- c, err := rule.NewConf("", conf.EnabledBackends{}, ``)
	`14`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, ``)
`15`	`15`	`if err != nil {`
`16`	`16`	`t.Fatal(err)`
`17`	`17`	`}`
`@@ -53,7 +53,7 @@ func TestActionNotificationTemplates(t *testing.T) {`
`53`	`53`
`54`	`54`	`func TestActionNotificationGrouping(t *testing.T) {`
`55`	`55`	`defer setup()()`
`56`		- c, err := rule.NewConf("", conf.EnabledBackends{}, `
	`56`	+ c, err := rule.NewConf("", conf.EnabledBackends{}, nil, `
`57`	`57`	`template t{`
`58`	`58`	`subject = 2`
`59`	`59`	`}`
Original file line number	Diff line number	Diff line change
`@@ -98,7 +98,7 @@ func testSched(t testing.T, st schedTest) (s *Schedule) {`
`98`	`98`	`t.Fatal(err)`
`99`	`99`	`}`
`100`	`100`	`//confs := "tsdbHost = " + u.Host + "\n" + st.conf`
`101`		`- c, err := rule.NewConf("testconf", conf.EnabledBackends{OpenTSDB: true}, st.conf)`
	`101`	`+ c, err := rule.NewConf("testconf", conf.EnabledBackends{OpenTSDB: true}, nil, st.conf)`
`102`	`102`	`if err != nil {`
`103`	`103`	`t.Error(err)`
`104`	`104`	`t.Logf("conf:\n%s", st.conf)`
Original file line number	Diff line number	Diff line change
`@@ -448,7 +448,7 @@ func buildConfig(r http.Request) (c conf.RuleConfProvider, a conf.Alert, hash`
`448`	`448`	`if err != nil {`
`449`	`449`	`return nil, nil, "", err`
`450`	`450`	`}`
`451`		`- c, err = rule.NewConf("Test Config", schedule.SystemConf.EnabledBackends(), string(config))`
	`451`	`+ c, err = rule.NewConf("Test Config", schedule.SystemConf.EnabledBackends(), schedule.SystemConf.GetRuleVars(), string(config))`
`452`	`452`	`if err != nil {`
`453`	`453`	`return nil, nil, "", err`
`454`	`454`	`}`