graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/ansible/roles/monitor
History
Graham McIntire c64f59929e
resolvers: NXDOMAIN blocklist via RPZ; fix Ansible deprecations 
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a
set of domains (and subdomains) and logs only those matches under rpz-log
tag "blocklist". Domains are templated from resolver_blocked_domains
(single source of truth) into /etc/unbound/blocklist.rpz; respip module
enabled for RPZ support.

Fix deprecation warnings across the Ansible tree:
- apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana),
  removing stale .list files and adding update_cache where deb822 drops it
- community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml
- top-level facts -> ansible_facts[...] (ansible_os_family,
  distribution_release, fqdn, architecture, default_ipv4) repo-wide
2026-06-07 10:32:42 -05:00
..
defaults resolvers: NXDOMAIN blocklist via RPZ; fix Ansible deprecations 2026-06-07 10:32:42 -05:00
files ansible: add 'monitor' role mirroring live monitor.vntx.net (Icinga2 + Web 2) 2026-05-08 13:00:53 -05:00
handlers ansible: add 'monitor' role mirroring live monitor.vntx.net (Icinga2 + Web 2) 2026-05-08 13:00:53 -05:00
tasks resolvers: NXDOMAIN blocklist via RPZ; fix Ansible deprecations 2026-06-07 10:32:42 -05:00
templates update 2026-06-01 10:53:23 -05:00
README.md ansible: add 'monitor' role mirroring live monitor.vntx.net (Icinga2 + Web 2) 2026-05-08 13:00:53 -05:00

README.md

monitor role

Builds an Icinga2 master + Icinga Web 2 stack matching the live install on monitor.vntx.net:

  • Ubuntu 22.04 + Apache 2.4 + mod_php + MariaDB 10.6 + Icinga 2.16
  • Single zone, master-only (no satellites configured but zones.conf is templated to add them later)
  • IDO-MySQL backend; icinga2 daemon writes status, icinga user read-only-selects for the Web 2 UI, icingaweb2 user owns the UI's own DB
  • 25 dormant conf.d/* host + service files shipped under files/ and copied verbatim. The live install has include_recursive "conf.d" commented out (a node-setup CLI artifact); this role mirrors that. Set icinga2_load_confd: true in host_vars to rehydrate them.

Required vault variables

Encrypt these with ansible-vault (e.g. host_vars/monitor.vntx.net/vault.yml):

# Icinga API users (api-users.conf)
icinga2_api_user_root_password: "..."
icinga2_api_user_icingaweb2_password: "..."

# Icinga2 daemon → IDO database
icinga2_ido_db_password: "..."

# icingaweb2 UI → its own database
icingaweb2_db_password: "..."

# icingaweb2 UI → IDO database (separate read-only user)
icingaweb2_ido_db_password: "..."

# Constants
icinga2_iftraffic_snmp_community: "..."
icinga2_ticket_salt: ""        # only needed for distributed setups

# PagerDuty integration keys
icinga2_pagerduty_key: "..."
icinga2_pagerduty_servers_key: "..."

# icingaweb2 admin user (web UI password). Generate the hash on any host
# with PHP installed:  php -r 'echo password_hash("plaintext", PASSWORD_DEFAULT);'
icingaweb2_admin_password_hash: "$2y$10$..."

What the role does NOT manage

  • Let's Encrypt certificate provisioning. The live install used certbot --apache; this role assumes the cert already exists at /etc/letsencrypt/live/<host>/. Run certbot once by hand.
  • The icingaweb2 schema is imported once on first install. Schema upgrades after Icinga Web 2 minor version bumps are not handled here — see /usr/share/icingaweb2/schema/upgrades/ and run the matching upgrade SQL by hand.
  • Distributed monitoring satellites. The role provisions a single-node master; add Endpoint/Zone objects in zones.d/ (or extend zones.conf.j2) when you wire satellites in.