Graham McIntire
88bdbbe88f
Codifies the bare-metal Icinga2 master + Icinga Web 2 stack on
monitor.vntx.net (Ubuntu 22.04, Apache + mod_php, MariaDB 10.6, Icinga
2.16, IDO-MySQL backend). Re-running the role against the live host
should produce a near-identical configuration.
Role includes:
- Icinga apt repo + full package set (icinga2, ido-mysql, icingaweb2,
monitoring-plugins, nagios-plugins-contrib, php + apache deps).
- MariaDB DB + user provisioning for both icinga2 (IDO daemon) and
icingaweb2 (UI), plus a separate read-only `icinga` user that the UI
uses to read the IDO. Schema bootstrapped only on first install.
- Templated icinga2 config (constants/zones/icinga2.conf), features-
enabled symlinks (api/checker/command/ido-mysql/mainlog), and the
three secret-bearing conf.d files (api-users, pagerduty x2) wired to
vault vars.
- 23 dormant conf.d/* host + service definitions copied verbatim under
files/. The live install has `include_recursive "conf.d"` commented
out (a node-setup CLI artifact); role mirrors that. Set
`icinga2_load_confd: true` in host_vars to rehydrate them.
- Icinga Web 2 ini files (config/auth/groups/roles/modules) + templated
resources.ini for DB credentials. monitoring module enabled via
symlink. icingaweb2 admin user bootstrapped on first install via a
one-shot insert into icingaweb_user (gated on schema-not-yet-imported).
- Apache rewrite + ssl modules. Vhost itself is left to certbot --apache
(Let's Encrypt cert is operator-managed, role doesn't manage it).
Cluster-wide cleanup:
- Gut roles/general/tasks/debian/icinga2.yml down to the uninstall
safety net (kept the sweep that removes icinga2 from non-monitoring
hosts). The previous master-side install + cert-distribution tasks
referenced templates that never existed in the role; the new monitor
role replaces them properly.
Operator action before first apply:
- Create host_vars/monitor.vntx.net/vault.yml with the seven required
secrets (see roles/monitor/README.md). Live values can be pulled from
/etc/icinga2/conf.d/{api-users,pagerduty-*,ido-mysql}.conf and
/etc/icingaweb2/resources.ini on the live host.
- Generate the icingaweb2 admin password hash via
`php -r 'echo password_hash("plaintext", PASSWORD_DEFAULT);'`.
- Run --check --diff before applying; the role is meant to be idempotent
but hasn't been verified against the live install.
87 lines
1.9 KiB
Text
87 lines
1.9 KiB
Text
object Host "culleoka-router" {
|
|
import "mikrotik"
|
|
address = "10.254.254.104"
|
|
vars.tower = "Culleoka"
|
|
}
|
|
|
|
object Host "culleoka-ubnt-ac1" {
|
|
import "ap-ubnt"
|
|
address = "10.10.111.1"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|
|
|
|
object Host "culleoka-ubnt-ac2" {
|
|
import "ap-ubnt"
|
|
address = "10.10.111.2"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|
|
|
|
//object Host "culleoka-ubnt-se" {
|
|
// import "ap-ubnt"
|
|
// address = "10.10.111.11"
|
|
// vars.tower = "Culleoka"
|
|
//}
|
|
object Host "culleoka-ubnt-sw" {
|
|
import "ap-ubnt"
|
|
address = "10.10.111.12"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|
|
object Host "culleoka-n" {
|
|
import "ap-ubnt"
|
|
address = "10.10.111.14"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|
|
object Host "culleoka-epmp-n" {
|
|
import "ap-epmp"
|
|
address = "10.10.111.30"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|
|
object Host "culleoka-epmp-se" {
|
|
import "ap-epmp"
|
|
address = "10.10.111.31"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|
|
object Host "culleoka-epmp-sw" {
|
|
import "ap-epmp"
|
|
address = "10.10.111.32"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|
|
object Host "culleoka-epmp-ne" {
|
|
import "ap-epmp"
|
|
address = "10.10.111.33"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|
|
|
|
//object Host "culleoka-ac-power" {
|
|
// import "generic-host"
|
|
// address = "100.64.27.252"
|
|
// vars.tower = "Culleoka"
|
|
// vars.parents = "10.254.254.104"
|
|
//}
|
|
|
|
//object Host "culleoka-climax-af11" {
|
|
// import "af11"
|
|
// address = "10.250.1.10"
|
|
// vars.tower = "Culleoka"
|
|
// vars.parents = "10.254.254.104"
|
|
//}
|
|
//object Host "clayton-ap" {
|
|
// import "ap-ubnt"
|
|
// address = "10.10.111.50"
|
|
// vars.tower = "Culleoka"
|
|
//}
|
|
|
|
object Host "culleoka-clayton-bh" {
|
|
import "ap-ubnt"
|
|
address = "10.10.111.61"
|
|
vars.tower = "Culleoka"
|
|
vars.parents = "10.254.254.104"
|
|
}
|