Graham McIntire
88bdbbe88f
Codifies the bare-metal Icinga2 master + Icinga Web 2 stack on
monitor.vntx.net (Ubuntu 22.04, Apache + mod_php, MariaDB 10.6, Icinga
2.16, IDO-MySQL backend). Re-running the role against the live host
should produce a near-identical configuration.
Role includes:
- Icinga apt repo + full package set (icinga2, ido-mysql, icingaweb2,
monitoring-plugins, nagios-plugins-contrib, php + apache deps).
- MariaDB DB + user provisioning for both icinga2 (IDO daemon) and
icingaweb2 (UI), plus a separate read-only `icinga` user that the UI
uses to read the IDO. Schema bootstrapped only on first install.
- Templated icinga2 config (constants/zones/icinga2.conf), features-
enabled symlinks (api/checker/command/ido-mysql/mainlog), and the
three secret-bearing conf.d files (api-users, pagerduty x2) wired to
vault vars.
- 23 dormant conf.d/* host + service definitions copied verbatim under
files/. The live install has `include_recursive "conf.d"` commented
out (a node-setup CLI artifact); role mirrors that. Set
`icinga2_load_confd: true` in host_vars to rehydrate them.
- Icinga Web 2 ini files (config/auth/groups/roles/modules) + templated
resources.ini for DB credentials. monitoring module enabled via
symlink. icingaweb2 admin user bootstrapped on first install via a
one-shot insert into icingaweb_user (gated on schema-not-yet-imported).
- Apache rewrite + ssl modules. Vhost itself is left to certbot --apache
(Let's Encrypt cert is operator-managed, role doesn't manage it).
Cluster-wide cleanup:
- Gut roles/general/tasks/debian/icinga2.yml down to the uninstall
safety net (kept the sweep that removes icinga2 from non-monitoring
hosts). The previous master-side install + cert-distribution tasks
referenced templates that never existed in the role; the new monitor
role replaces them properly.
Operator action before first apply:
- Create host_vars/monitor.vntx.net/vault.yml with the seven required
secrets (see roles/monitor/README.md). Live values can be pulled from
/etc/icinga2/conf.d/{api-users,pagerduty-*,ido-mysql}.conf and
/etc/icingaweb2/resources.ini on the live host.
- Generate the icingaweb2 admin password hash via
`php -r 'echo password_hash("plaintext", PASSWORD_DEFAULT);'`.
- Run --check --diff before applying; the role is meant to be idempotent
but hasn't been verified against the live install.
117 lines
2.1 KiB
Text
117 lines
2.1 KiB
Text
/*
|
|
* Service apply rules.
|
|
*
|
|
* The CheckCommand objects `ping4`, `ping6`, etc
|
|
* are provided by the plugin check command templates.
|
|
* Check the documentation for details.
|
|
*
|
|
* Tip: Use `icinga2 object list --type Service` to
|
|
* list all service objects after running
|
|
* configuration validation (`icinga2 daemon -C`).
|
|
*/
|
|
|
|
/*
|
|
* This is an example host based on your
|
|
* local host's FQDN. Specify the NodeName
|
|
* constant in `constants.conf` or use your
|
|
* own description, e.g. "db-host-1".
|
|
*/
|
|
|
|
/*
|
|
* These are generic `ping4` and `ping6`
|
|
* checks applied to all hosts having the
|
|
* `address` resp. `address6` attribute
|
|
* defined.
|
|
*/
|
|
apply Service "ping4" {
|
|
import "generic-service"
|
|
|
|
check_command = "ping4"
|
|
|
|
assign where host.address
|
|
}
|
|
|
|
apply Service "ping6" {
|
|
import "generic-service"
|
|
|
|
check_command = "ping6"
|
|
|
|
assign where host.address6
|
|
}
|
|
|
|
/*
|
|
* Apply the `ssh` service to all hosts
|
|
* with the `address` attribute defined and
|
|
* the custom variable `os` set to `Linux`.
|
|
*/
|
|
/*
|
|
apply Service "ssh" {
|
|
import "generic-service"
|
|
|
|
check_command = "ssh"
|
|
|
|
assign where (host.address || host.address6) && host.vars.os == "Linux"
|
|
}
|
|
*/
|
|
|
|
|
|
|
|
apply Service for (http_vhost => config in host.vars.http_vhosts) {
|
|
import "generic-service"
|
|
|
|
check_command = "http"
|
|
|
|
vars += config
|
|
}
|
|
|
|
apply Service for (disk => config in host.vars.disks) {
|
|
import "generic-service"
|
|
|
|
check_command = "disk"
|
|
|
|
vars += config
|
|
}
|
|
|
|
apply Service "icinga" {
|
|
import "generic-service"
|
|
|
|
check_command = "icinga"
|
|
|
|
assign where host.name == NodeName
|
|
}
|
|
|
|
apply Service "load" {
|
|
import "generic-service"
|
|
|
|
check_command = "load"
|
|
|
|
/* Used by the ScheduledDowntime apply rule in `downtimes.conf`. */
|
|
vars.backup_downtime = "02:00-03:00"
|
|
|
|
assign where host.name == NodeName
|
|
}
|
|
|
|
//apply Service "procs" {
|
|
// import "generic-service"
|
|
//
|
|
// check_command = "procs"
|
|
//
|
|
// assign where host.name == NodeName
|
|
//}
|
|
|
|
apply Service "swap" {
|
|
import "generic-service"
|
|
|
|
check_command = "swap"
|
|
|
|
assign where host.name == NodeName
|
|
}
|
|
|
|
apply Service "users" {
|
|
import "generic-service"
|
|
|
|
check_command = "users"
|
|
|
|
assign where host.name == NodeName
|
|
}
|
|
|