dkirwan/infra-ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

Zabbix: Move internal proxy checks from Nagios

Browse source 
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
This commit is contained in:
Greg Sutcliffe 2026-05-28 11:08:35 +01:00
commit e3d9be210e
Signed by: gwmngilfen
SSH key fingerprint: SHA256:dNHcz65ApR68w2TkCIAXDBdt4oNL62Fyx48U7dXWuk0
3 changed files with 196 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
roles/httpd/proxy/files/zabbix-selinux.te Normal file
View file

@ -0,0 +1,11 @@
module zabbix_proxy 1.1;
require {
type unreserved_port_t;
type zabbix_agent_t;
class tcp_socket name_connect;
}
#============= zabbix_agent_t ==============
allow zabbix_agent_t unreserved_port_t:tcp_socket name_connect;

109
roles/httpd/proxy/files/zabbix-template-internal.yml Normal file
View file

@ -0,0 +1,109 @@
zabbix_export:
version: '7.0'
template_groups:
- uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec
name: Fedora
templates:
- uuid: 847dc5c32ea342e5b20659747516f19d
template: 'Proxy checks - internal'
name: 'Proxy checks - internal'
description: 'Checks that only internal proxies can run'
groups:
- name: Fedora
items:
- uuid: e7604e57aa8a4b3caa474d95f49bec7e
name: 'Mirrorlist Docker Container TCP check'
type: ZABBIX_ACTIVE
key: 'net.tcp.service[tcp,,18081]'
tags:
- tag: component
value: mirrorlist
triggers:
- uuid: 08fcae0ec58145609e85c2fc128e1861
expression: 'last(/Proxy checks - internal/net.tcp.service[tcp,,18081])=0'
name: 'Mirrorlist Docker Container TCP check failed'
priority: AVERAGE
- uuid: 1f917349a49440c78e24daae9ac25b1f
name: http-fmn-api
type: ZABBIX_ACTIVE
key: 'web.page.regexp[https://fmn-api.apps.ocp.fedoraproject.org/api/v1/healthz/ready,,,OK]'
delay: 5m
value_type: CHAR
trends: '0'
timeout: 6s
tags:
- tag: component
value: http
triggers:
- uuid: 0e93bf5f3449458fa24795fa03d1e0af
expression: 'last(/Proxy checks - internal/web.page.regexp[https://fmn-api.apps.ocp.fedoraproject.org/api/v1/healthz/ready,,,OK])<>"OK"'
name: 'http-fmn-api connection failed'
priority: AVERAGE
tags:
- tag: scope
value: availability
- tag: scope
value: connectivity
- uuid: 1f0eba5fb89b47b1bc380a9f699c8564
name: http-fmn-web
type: ZABBIX_ACTIVE
key: 'web.page.regexp[https://notifications.fedoraproject.org/,,,FMN]'
delay: 5m
value_type: CHAR
trends: '0'
timeout: 6s
tags:
- tag: component
value: http
triggers:
- uuid: 96a1590776a74dc68736083d3b51319c
expression: 'last(/Proxy checks - internal/web.page.regexp[https://notifications.fedoraproject.org/,,,FMN])<>"FMN"'
name: 'http-fmn-web connection failed'
priority: AVERAGE
tags:
- tag: scope
value: availability
- tag: scope
value: connectivity
- uuid: de4cb57caa0a4776846c0327c4a1e2ac
name: http-oci-registry-webui
type: ZABBIX_ACTIVE
key: 'web.page.regexp[https://registry.fedoraproject.org/v2/fedora/tags/list,,,rawhide]'
delay: 5m
value_type: CHAR
trends: '0'
timeout: 6s
tags:
- tag: component
value: http
triggers:
- uuid: 515fd69090b349e391be581c6e4dc82c
expression: 'last(/Proxy checks - internal/web.page.regexp[https://registry.fedoraproject.org/v2/fedora/tags/list,,,rawhide])<>"rawhide"'
name: 'http-oci-registry-webui connection failed'
priority: AVERAGE
tags:
- tag: scope
value: availability
- tag: scope
value: connectivity
- uuid: 44286da1dca046b89d205f8db0a0cb56
name: http-oci-registry-api
type: ZABBIX_ACTIVE
key: 'web.page.regexp[https://registry.fedoraproject.org/v2/_catalog?last=fedora,,,fedora]'
delay: 5m
value_type: CHAR
trends: '0'
timeout: 30s
tags:
- tag: component
value: http
triggers:
- uuid: afe0d6921c074089869e11ec59e6fe35
expression: 'last(/Proxy checks - internal/web.page.regexp[https://registry.fedoraproject.org/v2/_catalog?last=fedora,,,fedora])<>"fedora"'
name: 'http-oci-registry-api connection failed'
priority: AVERAGE
tags:
- tag: scope
value: availability
- tag: scope
value: connectivity

76
roles/httpd/proxy/tasks/monitoring.yml Normal file
View file

@ -0,0 +1,76 @@
# Custom SELinux requirements for Zabbix to run TCP port checks
- name: Ensure a directory exists for Proxy+Zabbix selinux module
ansible.builtin.file:
path: /usr/local/share/zabbix
state: directory
mode: '0755'
tags:
- selinux
- httpd/proxy
- zabbix_agent
- name: Copy Proxy Zabbix SELinux module
ansible.builtin.copy:
src: zabbix-selinux.te
dest: /usr/local/share/zabbix/zabbix_proxy.te
owner: root
group: root
mode: '0644'
register: selinux_zabbix_file
tags:
- selinux
- httpd/proxy
- zabbix_agent
- name: Compile and install SELinux module
ansible.builtin.include_tasks: "{{ tasks_path }}/compile-selinux.yml"
vars:
selinux_module_dir: /usr/local/share/zabbix
selinux_module_name: zabbix_proxy
when: selinux_zabbix_file.changed # noqa: no-handler
tags:
- selinux
- httpd/proxy
- zabbix_agent
# Zabbix monitoring of the proxy sites & ticketkeys
- name: Zabbix API Block
vars:
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
ansible_network_os: "{{ zabbix_network_os }}"
ansible_connection: "{{ zabbix_connection }}"
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
ansible_host: "{{ zabbix_server }}"
ansible_zabbix_url_path: "{{ zabbix_url_path }}"
tags:
- httpd/proxy
- zabbix_api
block:
- name: Import Proxy checks template
community.zabbix.zabbix_template:
template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}"
state: present
run_once: true
- name: Import Proxy internal checks template
community.zabbix.zabbix_template:
template_yaml: "{{ lookup('file', 'zabbix-template-internal.yml') }}"
state: present
run_once: true
- name: Add self to Proxy checks template in Zabbix
community.zabbix.zabbix_host:
host_name: "{{ inventory_hostname }}"
link_templates: Proxy checks
force: false
run_once: true
- name: Add self to Proxy internal checks template in Zabbix
community.zabbix.zabbix_host:
host_name: "{{ inventory_hostname }}"
link_templates: Proxy checks - internal
force: false
run_once: true
when: "'proxies_rdu3' in group_names"