Codifies the bare-metal Icinga2 master + Icinga Web 2 stack on
monitor.vntx.net (Ubuntu 22.04, Apache + mod_php, MariaDB 10.6, Icinga
2.16, IDO-MySQL backend). Re-running the role against the live host
should produce a near-identical configuration.
Role includes:
- Icinga apt repo + full package set (icinga2, ido-mysql, icingaweb2,
monitoring-plugins, nagios-plugins-contrib, php + apache deps).
- MariaDB DB + user provisioning for both icinga2 (IDO daemon) and
icingaweb2 (UI), plus a separate read-only `icinga` user that the UI
uses to read the IDO. Schema bootstrapped only on first install.
- Templated icinga2 config (constants/zones/icinga2.conf), features-
enabled symlinks (api/checker/command/ido-mysql/mainlog), and the
three secret-bearing conf.d files (api-users, pagerduty x2) wired to
vault vars.
- 23 dormant conf.d/* host + service definitions copied verbatim under
files/. The live install has `include_recursive "conf.d"` commented
out (a node-setup CLI artifact); role mirrors that. Set
`icinga2_load_confd: true` in host_vars to rehydrate them.
- Icinga Web 2 ini files (config/auth/groups/roles/modules) + templated
resources.ini for DB credentials. monitoring module enabled via
symlink. icingaweb2 admin user bootstrapped on first install via a
one-shot insert into icingaweb_user (gated on schema-not-yet-imported).
- Apache rewrite + ssl modules. Vhost itself is left to certbot --apache
(Let's Encrypt cert is operator-managed, role doesn't manage it).
Cluster-wide cleanup:
- Gut roles/general/tasks/debian/icinga2.yml down to the uninstall
safety net (kept the sweep that removes icinga2 from non-monitoring
hosts). The previous master-side install + cert-distribution tasks
referenced templates that never existed in the role; the new monitor
role replaces them properly.
Operator action before first apply:
- Create host_vars/monitor.vntx.net/vault.yml with the seven required
secrets (see roles/monitor/README.md). Live values can be pulled from
/etc/icinga2/conf.d/{api-users,pagerduty-*,ido-mysql}.conf and
/etc/icingaweb2/resources.ini on the live host.
- Generate the icingaweb2 admin password hash via
`php -r 'echo password_hash("plaintext", PASSWORD_DEFAULT);'`.
- Run --check --diff before applying; the role is meant to be idempotent
but hasn't been verified against the live install.
204 lines
5.6 KiB
Text
204 lines
5.6 KiB
Text
/* Command objects */
|
|
|
|
/* Notification Commands
|
|
*
|
|
* Please check the documentation for all required and
|
|
* optional parameters.
|
|
*/
|
|
|
|
object NotificationCommand "mail-host-notification" {
|
|
command = [ ConfigDir + "/scripts/mail-host-notification.sh" ]
|
|
|
|
arguments += {
|
|
"-4" = "$notification_address$"
|
|
"-6" = "$notification_address6$"
|
|
"-b" = "$notification_author$"
|
|
"-c" = "$notification_comment$"
|
|
"-d" = {
|
|
required = true
|
|
value = "$notification_date$"
|
|
}
|
|
"-f" = {
|
|
value = "$notification_from$"
|
|
description = "Set from address. Requires GNU mailutils (Debian/Ubuntu) or mailx (RHEL/SUSE)"
|
|
}
|
|
"-i" = "$notification_icingaweb2url$"
|
|
"-l" = {
|
|
required = true
|
|
value = "$notification_hostname$"
|
|
}
|
|
"-n" = {
|
|
required = true
|
|
value = "$notification_hostdisplayname$"
|
|
}
|
|
"-o" = {
|
|
required = true
|
|
value = "$notification_hostoutput$"
|
|
}
|
|
"-r" = {
|
|
required = true
|
|
value = "$notification_useremail$"
|
|
}
|
|
"-s" = {
|
|
required = true
|
|
value = "$notification_hoststate$"
|
|
}
|
|
"-t" = {
|
|
required = true
|
|
value = "$notification_type$"
|
|
}
|
|
"-v" = "$notification_logtosyslog$"
|
|
}
|
|
|
|
vars += {
|
|
notification_address = "$address$"
|
|
notification_address6 = "$address6$"
|
|
notification_author = "$notification.author$"
|
|
notification_comment = "$notification.comment$"
|
|
notification_type = "$notification.type$"
|
|
notification_date = "$icinga.long_date_time$"
|
|
notification_hostname = "$host.name$"
|
|
notification_hostdisplayname = "$host.display_name$"
|
|
notification_hostoutput = "$host.output$"
|
|
notification_hoststate = "$host.state$"
|
|
notification_useremail = "$user.email$"
|
|
}
|
|
}
|
|
|
|
object NotificationCommand "mail-service-notification" {
|
|
command = [ ConfigDir + "/scripts/mail-service-notification.sh" ]
|
|
|
|
arguments += {
|
|
"-4" = "$notification_address$"
|
|
"-6" = "$notification_address6$"
|
|
"-b" = "$notification_author$"
|
|
"-c" = "$notification_comment$"
|
|
"-d" = {
|
|
required = true
|
|
value = "$notification_date$"
|
|
}
|
|
"-e" = {
|
|
required = true
|
|
value = "$notification_servicename$"
|
|
}
|
|
"-f" = {
|
|
value = "$notification_from$"
|
|
description = "Set from address. Requires GNU mailutils (Debian/Ubuntu) or mailx (RHEL/SUSE)"
|
|
}
|
|
"-i" = "$notification_icingaweb2url$"
|
|
"-l" = {
|
|
required = true
|
|
value = "$notification_hostname$"
|
|
}
|
|
"-n" = {
|
|
required = true
|
|
value = "$notification_hostdisplayname$"
|
|
}
|
|
"-o" = {
|
|
required = true
|
|
value = "$notification_serviceoutput$"
|
|
}
|
|
"-r" = {
|
|
required = true
|
|
value = "$notification_useremail$"
|
|
}
|
|
"-s" = {
|
|
required = true
|
|
value = "$notification_servicestate$"
|
|
}
|
|
"-t" = {
|
|
required = true
|
|
value = "$notification_type$"
|
|
}
|
|
"-u" = {
|
|
required = true
|
|
value = "$notification_servicedisplayname$"
|
|
}
|
|
"-v" = "$notification_logtosyslog$"
|
|
}
|
|
|
|
vars += {
|
|
notification_address = "$address$"
|
|
notification_address6 = "$address6$"
|
|
notification_author = "$notification.author$"
|
|
notification_comment = "$notification.comment$"
|
|
notification_type = "$notification.type$"
|
|
notification_date = "$icinga.long_date_time$"
|
|
notification_hostname = "$host.name$"
|
|
notification_hostdisplayname = "$host.display_name$"
|
|
notification_servicename = "$service.name$"
|
|
notification_serviceoutput = "$service.output$"
|
|
notification_servicestate = "$service.state$"
|
|
notification_useremail = "$user.email$"
|
|
notification_servicedisplayname = "$service.display_name$"
|
|
}
|
|
}
|
|
|
|
/*
|
|
* If you prefer to use the notification scripts with environment
|
|
* variables instead of command line parameters, you can use
|
|
* the following commands. They have been updated from < 2.7
|
|
* to support the new notification scripts and should help
|
|
* with an upgrade.
|
|
* Remove the comment blocks and comment the notification commands above.
|
|
*/
|
|
|
|
/*
|
|
|
|
object NotificationCommand "mail-host-notification" {
|
|
command = [ ConfigDir + "/scripts/mail-host-notification.sh" ]
|
|
|
|
env = {
|
|
NOTIFICATIONTYPE = "$notification.type$"
|
|
HOSTDISPLAYNAME = "$host.display_name$"
|
|
HOSTNAME = "$host.name$"
|
|
HOSTADDRESS = "$address$"
|
|
HOSTSTATE = "$host.state$"
|
|
LONGDATETIME = "$icinga.long_date_time$"
|
|
HOSTOUTPUT = "$host.output$"
|
|
NOTIFICATIONAUTHORNAME = "$notification.author$"
|
|
NOTIFICATIONCOMMENT = "$notification.comment$"
|
|
HOSTDISPLAYNAME = "$host.display_name$"
|
|
USEREMAIL = "$user.email$"
|
|
}
|
|
}
|
|
|
|
object NotificationCommand "mail-service-notification" {
|
|
command = [ ConfigDir + "/scripts/mail-service-notification.sh" ]
|
|
|
|
env = {
|
|
NOTIFICATIONTYPE = "$notification.type$"
|
|
SERVICENAME = "$service.name$"
|
|
HOSTNAME = "$host.name$"
|
|
HOSTDISPLAYNAME = "$host.display_name$"
|
|
HOSTADDRESS = "$address$"
|
|
SERVICESTATE = "$service.state$"
|
|
LONGDATETIME = "$icinga.long_date_time$"
|
|
SERVICEOUTPUT = "$service.output$"
|
|
NOTIFICATIONAUTHORNAME = "$notification.author$"
|
|
NOTIFICATIONCOMMENT = "$notification.comment$"
|
|
HOSTDISPLAYNAME = "$host.display_name$"
|
|
SERVICEDISPLAYNAME = "$service.display_name$"
|
|
USEREMAIL = "$user.email$"
|
|
}
|
|
}
|
|
|
|
*/
|
|
|
|
object CheckCommand "check_snmp" {
|
|
import "plugin-check-command"
|
|
command = [ PluginDir + "/check_snmp" ]
|
|
arguments = {
|
|
"-H" = "$snmpv3_address$"
|
|
"-P" = "$snmp_port$"
|
|
"-o" = "$snmpv3_oid$"
|
|
"-C" = "$snmp_community$"
|
|
"-V" = "$snmp_version$"
|
|
"-U" = "$snmpv3_user$"
|
|
"-L" = "$snmpv3_seclevel$"
|
|
"-a" = "$snmpv3_auth_alg$"
|
|
"-x" = "$snmpv3_priv_alg$"
|
|
"-A" = "$snmpv3_auth_key$"
|
|
"-X" = "$snmpv3_priv_key$"
|
|
}
|
|
}
|