Graham McIntire
88bdbbe88f
Codifies the bare-metal Icinga2 master + Icinga Web 2 stack on
monitor.vntx.net (Ubuntu 22.04, Apache + mod_php, MariaDB 10.6, Icinga
2.16, IDO-MySQL backend). Re-running the role against the live host
should produce a near-identical configuration.
Role includes:
- Icinga apt repo + full package set (icinga2, ido-mysql, icingaweb2,
monitoring-plugins, nagios-plugins-contrib, php + apache deps).
- MariaDB DB + user provisioning for both icinga2 (IDO daemon) and
icingaweb2 (UI), plus a separate read-only `icinga` user that the UI
uses to read the IDO. Schema bootstrapped only on first install.
- Templated icinga2 config (constants/zones/icinga2.conf), features-
enabled symlinks (api/checker/command/ido-mysql/mainlog), and the
three secret-bearing conf.d files (api-users, pagerduty x2) wired to
vault vars.
- 23 dormant conf.d/* host + service definitions copied verbatim under
files/. The live install has `include_recursive "conf.d"` commented
out (a node-setup CLI artifact); role mirrors that. Set
`icinga2_load_confd: true` in host_vars to rehydrate them.
- Icinga Web 2 ini files (config/auth/groups/roles/modules) + templated
resources.ini for DB credentials. monitoring module enabled via
symlink. icingaweb2 admin user bootstrapped on first install via a
one-shot insert into icingaweb_user (gated on schema-not-yet-imported).
- Apache rewrite + ssl modules. Vhost itself is left to certbot --apache
(Let's Encrypt cert is operator-managed, role doesn't manage it).
Cluster-wide cleanup:
- Gut roles/general/tasks/debian/icinga2.yml down to the uninstall
safety net (kept the sweep that removes icinga2 from non-monitoring
hosts). The previous master-side install + cert-distribution tasks
referenced templates that never existed in the role; the new monitor
role replaces them properly.
Operator action before first apply:
- Create host_vars/monitor.vntx.net/vault.yml with the seven required
secrets (see roles/monitor/README.md). Live values can be pulled from
/etc/icinga2/conf.d/{api-users,pagerduty-*,ido-mysql}.conf and
/etc/icingaweb2/resources.ini on the live host.
- Generate the icingaweb2 admin password hash via
`php -r 'echo password_hash("plaintext", PASSWORD_DEFAULT);'`.
- Run --check --diff before applying; the role is meant to be idempotent
but hasn't been verified against the live install.
160 lines
3.4 KiB
Text
160 lines
3.4 KiB
Text
/*
|
|
* Generic template examples.
|
|
*/
|
|
|
|
|
|
/**
|
|
* Provides default settings for hosts. By convention
|
|
* all hosts should import this template.
|
|
*
|
|
* The CheckCommand object `hostalive` is provided by
|
|
* the plugin check command templates.
|
|
* Check the documentation for details.
|
|
*/
|
|
template Host "generic-host" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = true
|
|
vars.enable_pagerduty_servers = false
|
|
}
|
|
|
|
template Host "server" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = false
|
|
vars.enable_pagerduty_servers = true
|
|
}
|
|
|
|
template Host "mikrotik" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = true
|
|
}
|
|
|
|
template Host "ap-ubnt" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = true
|
|
}
|
|
|
|
template Host "netonix" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = true
|
|
}
|
|
|
|
template Host "edgeswitch" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = true
|
|
}
|
|
|
|
template Host "ap-epmp" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = true
|
|
}
|
|
|
|
template Host "af11" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = true
|
|
}
|
|
|
|
template Host "af24" {
|
|
max_check_attempts = 3
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
|
|
check_command = "hostalive"
|
|
vars.enable_pagerduty = true
|
|
}
|
|
|
|
/**
|
|
* Provides default settings for services. By convention
|
|
* all services should import this template.
|
|
*/
|
|
template Service "generic-service" {
|
|
max_check_attempts = 5
|
|
check_interval = 1m
|
|
retry_interval = 30s
|
|
vars.enable_pagerduty = true
|
|
}
|
|
|
|
/**
|
|
* Provides default settings for users. By convention
|
|
* all users should inherit from this template.
|
|
*/
|
|
|
|
template User "generic-user" {
|
|
|
|
}
|
|
|
|
/**
|
|
* Provides default settings for host notifications.
|
|
* By convention all host notifications should import
|
|
* this template.
|
|
*/
|
|
template Notification "mail-host-notification" {
|
|
command = "mail-host-notification"
|
|
|
|
states = [ Up, Down ]
|
|
types = [ Problem, Acknowledgement, Recovery, Custom,
|
|
FlappingStart, FlappingEnd,
|
|
DowntimeStart, DowntimeEnd, DowntimeRemoved ]
|
|
|
|
vars += {
|
|
// notification_icingaweb2url = "https://www.example.com/icingaweb2"
|
|
// notification_from = "Icinga 2 Host Monitoring <icinga@example.com>"
|
|
notification_logtosyslog = false
|
|
}
|
|
|
|
period = "24x7"
|
|
}
|
|
|
|
/**
|
|
* Provides default settings for service notifications.
|
|
* By convention all service notifications should import
|
|
* this template.
|
|
*/
|
|
template Notification "mail-service-notification" {
|
|
command = "mail-service-notification"
|
|
|
|
states = [ OK, Warning, Critical, Unknown ]
|
|
types = [ Problem, Acknowledgement, Recovery, Custom,
|
|
FlappingStart, FlappingEnd,
|
|
DowntimeStart, DowntimeEnd, DowntimeRemoved ]
|
|
|
|
vars += {
|
|
// notification_icingaweb2url = "https://www.example.com/icingaweb2"
|
|
// notification_from = "Icinga 2 Service Monitoring <icinga@example.com>"
|
|
notification_logtosyslog = false
|
|
}
|
|
|
|
period = "24x7"
|
|
}
|
|
|