Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
103 lines
3.2 KiB
YAML
103 lines
3.2 KiB
YAML
---
|
|
# Master Icinga2 + Icinga Web 2 stack. Mirrors the live install on
|
|
# monitor.vntx.net (Ubuntu 22.04, Apache + mod_php, MariaDB 10.6, single
|
|
# zone, IDO-MySQL backend). Per-host overrides (ALLOWED_HOSTS-equivalent,
|
|
# zone names, etc.) live in host_vars; secrets in ansible-vault.
|
|
|
|
# Icinga repo + packages
|
|
icinga2_apt_key_url: "https://packages.icinga.com/icinga.key"
|
|
icinga2_apt_keyring: "/etc/apt/keyrings/icinga-archive-keyring.gpg"
|
|
|
|
# PagerDuty agent repo + packages
|
|
pdagent_apt_key_url: "https://packages.pagerduty.com/GPG-KEY-pagerduty"
|
|
pdagent_apt_keyring: "/etc/apt/keyrings/pagerduty-archive-keyring.gpg"
|
|
pdagent_packages:
|
|
- pdagent
|
|
- pdagent-integrations
|
|
|
|
icinga2_packages:
|
|
- icinga2
|
|
- icinga2-ido-mysql
|
|
- monitoring-plugins
|
|
- nagios-plugins-contrib
|
|
- vim-icinga2
|
|
- icingaweb2
|
|
- icingaweb2-common
|
|
- icingacli
|
|
- icinga-php-library
|
|
- icinga-php-thirdparty
|
|
|
|
# Web stack — apache + mod_php (matches live install, not php-fpm).
|
|
icinga2_web_packages:
|
|
- apache2
|
|
- libapache2-mod-php
|
|
- php
|
|
- php-curl
|
|
- php-gd
|
|
- php-intl
|
|
- php-ldap
|
|
- php-mbstring
|
|
- php-mysql
|
|
- php-xml
|
|
- php-zip
|
|
- python3-certbot-apache
|
|
|
|
# Database stack
|
|
icinga2_db_packages:
|
|
- mariadb-server
|
|
- mariadb-client
|
|
|
|
# Cluster identity
|
|
icinga2_node_name: "{{ inventory_hostname }}"
|
|
icinga2_zone_name: "{{ inventory_hostname }}"
|
|
icinga2_master_zone_name: "master"
|
|
|
|
# Constants — vault-backed
|
|
# icinga2_ticket_salt: "" # set in vault if generating signed certs for satellites
|
|
# icinga2_iftraffic_snmp_community: "" # vault-only
|
|
|
|
# IDO database (icinga2 daemon writes status here)
|
|
icinga2_ido_db_host: "localhost"
|
|
icinga2_ido_db_name: "icinga2"
|
|
icinga2_ido_db_user: "icinga2"
|
|
# icinga2_ido_db_password: vault-only
|
|
|
|
# icingaweb2 database (UI's own data)
|
|
icingaweb2_db_host: "localhost"
|
|
icingaweb2_db_name: "icingaweb2"
|
|
icingaweb2_db_user: "icingaweb2"
|
|
# icingaweb2_db_password: vault-only
|
|
|
|
# How icingaweb2 reads the IDO. Live install uses a separate `icinga` user
|
|
# rather than reusing `icinga2`; keep that separation.
|
|
icingaweb2_ido_db_host: "localhost"
|
|
icingaweb2_ido_db_name: "icinga2"
|
|
icingaweb2_ido_db_user: "icinga"
|
|
# icingaweb2_ido_db_password: vault-only (live install reuses the icingaweb2
|
|
# password; default both the same value in vault unless rotating)
|
|
|
|
# Whether to load conf.d/* host/service definitions. Default to false for
|
|
# safety (empty config). Set in host_vars for hosts with real definitions.
|
|
icinga2_load_confd: false
|
|
|
|
# IDO schema bootstrap — only runs on first install, gated by a marker.
|
|
icinga2_ido_schema_path: /usr/share/icinga2-ido-mysql/schema/mysql.sql
|
|
|
|
# Apache vhost (Let's Encrypt managed externally via certbot — this role
|
|
# just ensures apache + the icingaweb2 alias config are in place).
|
|
icinga2_apache_server_name: "{{ inventory_hostname }}"
|
|
|
|
# Features to enable on the master. Order matches live install.
|
|
icinga2_enabled_features:
|
|
- api
|
|
- checker
|
|
- command
|
|
- ido-mysql
|
|
- mainlog
|
|
- notification
|
|
|
|
# icingaweb2 admin user (Web UI password is set as a bcrypt hash directly
|
|
# in the icingaweb2 DB; this role bootstraps it on first install).
|
|
icingaweb2_admin_user: "graham"
|
|
# icingaweb2_admin_password_hash: vault-only — generate with:
|
|
# php -r 'echo password_hash("plaintext", PASSWORD_DEFAULT);'
|