graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/ansible/roles/monitor
History
Exact
Graham McIntire d3f4278133
Enable incident.io alerts on all Icinga2 hosts and services 
Add vars.enable_incidentio = true to every host template (generic-host,
server, mikrotik, ap-ubnt, netonix, edgeswitch, ap-epmp, af11, af24)
and the generic-service template — all ~80 hosts and their services
are now covered via template inheritance.
2026-07-24 16:37:46 -05:00
..
defaults resolvers: NXDOMAIN blocklist via RPZ; fix Ansible deprecations 2026-06-07 10:32:42 -05:00
files Enable incident.io alerts on all Icinga2 hosts and services 2026-07-24 16:37:46 -05:00
handlers ansible: add 'monitor' role mirroring live monitor.vntx.net (Icinga2 + Web 2) 2026-05-08 13:00:53 -05:00
tasks Add incident.io alert integration for Icinga2 2026-07-24 16:36:49 -05:00
templates Add incident.io alert integration for Icinga2 2026-07-24 16:36:49 -05:00
README.md Add incident.io alert integration for Icinga2 2026-07-24 16:36:49 -05:00

README.md

monitor role

Builds an Icinga2 master + Icinga Web 2 stack matching the live install on monitor.vntx.net:

  • Ubuntu 22.04 + Apache 2.4 + mod_php + MariaDB 10.6 + Icinga 2.16
  • Single zone, master-only (no satellites configured but zones.conf is templated to add them later)
  • IDO-MySQL backend; icinga2 daemon writes status, icinga user read-only-selects for the Web 2 UI, icingaweb2 user owns the UI's own DB
  • 25 dormant conf.d/* host + service files shipped under files/ and copied verbatim. The live install has include_recursive "conf.d" commented out (a node-setup CLI artifact); this role mirrors that. Set icinga2_load_confd: true in host_vars to rehydrate them.

Required vault variables

Encrypt these with ansible-vault (e.g. host_vars/monitor.vntx.net/vault.yml):

# Icinga API users (api-users.conf)
icinga2_api_user_root_password: "..."
icinga2_api_user_icingaweb2_password: "..."

# Icinga2 daemon → IDO database
icinga2_ido_db_password: "..."

# icingaweb2 UI → its own database
icingaweb2_db_password: "..."

# icingaweb2 UI → IDO database (separate read-only user)
icingaweb2_ido_db_password: "..."

# Constants
icinga2_iftraffic_snmp_community: "..."
icinga2_ticket_salt: ""        # only needed for distributed setups

# PagerDuty integration keys
icinga2_pagerduty_key: "..."
icinga2_pagerduty_servers_key: "..."

# incident.io alert integration token (Bearer token for the HTTP alert source)
icinga2_incidentio_token: "..."

# icingaweb2 admin user (web UI password). Generate the hash on any host
# with PHP installed:  php -r 'echo password_hash("plaintext", PASSWORD_DEFAULT);'
icingaweb2_admin_password_hash: "$2y$10$..."

What the role does NOT manage

  • Let's Encrypt certificate provisioning. The live install used certbot --apache; this role assumes the cert already exists at /etc/letsencrypt/live/<host>/. Run certbot once by hand.
  • The icingaweb2 schema is imported once on first install. Schema upgrades after Icinga Web 2 minor version bumps are not handled here — see /usr/share/icingaweb2/schema/upgrades/ and run the matching upgrade SQL by hand.
  • Distributed monitoring satellites. The role provisions a single-node master; add Endpoint/Zone objects in zones.d/ (or extend zones.conf.j2) when you wire satellites in.