forked from infra/ansible
116 lines
4 KiB
YAML
116 lines
4 KiB
YAML
---
|
|
|
|
# This is a workaround for a specific Nagios plugin that the
|
|
# Zabbix agent can't execute for some reason :/
|
|
# TBD rewrite this in Zabbix style
|
|
- name: Install old Nagios-style postfix plugin where Zabbix can find it
|
|
ansible.builtin.copy:
|
|
src: nagios-systemd-plugin.sh
|
|
dest: /usr/lib/zabbix/check_systemd_units.sh
|
|
owner: zabbix
|
|
group: zabbix
|
|
mode: '0755'
|
|
tags:
|
|
- pagure
|
|
- zabbix_agent
|
|
|
|
- name: Deploy cron to run old Nagios plugin
|
|
ansible.builtin.cron:
|
|
name: "Run Pagure systemd-check Nagios script"
|
|
minute: "*/5"
|
|
user: root
|
|
job: "/usr/lib/zabbix/check_systemd_units.sh 2>&1 > /etc/zabbix/pagure-zabbix.log"
|
|
tags:
|
|
- pagure
|
|
- zabbix_agent
|
|
|
|
- name: Zabbix API Block
|
|
vars:
|
|
ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
|
|
ansible_network_os: "{{ zabbix_network_os }}"
|
|
ansible_connection: "{{ zabbix_connection }}"
|
|
ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
|
|
ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
|
|
ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
|
|
ansible_host: "{{ zabbix_server }}"
|
|
ansible_zabbix_url_path: "{{ zabbix_url_path }}"
|
|
tags:
|
|
- zabbix_agent
|
|
- zabbix_api
|
|
- pagure
|
|
block:
|
|
# Set & use IP for monitoring as (stg.)pagure.io resolves internally but http does not listen there
|
|
- name: Set Pagure IP fact
|
|
ansible.builtin.set_fact:
|
|
pagure_ip: "{{ (env == 'production') | ternary('38.145.32.40', '38.145.32.39') }}"
|
|
|
|
- name: Create cert age item for {{ inventory_hostname }}
|
|
community.zabbix.zabbix_item:
|
|
name: "{{ inventory_hostname }} SSL Certificate time remaining"
|
|
host_name: "{{ inventory_hostname }}"
|
|
params:
|
|
type: external_check
|
|
key: "zext_ssl_cert.sh[{{ pagure_ip }},443]"
|
|
value_type: numeric_unsigned
|
|
units: 'days'
|
|
timeout: '10s'
|
|
interval: '12h'
|
|
tags:
|
|
- tag: application
|
|
value: pagure
|
|
- tag: component
|
|
value: ssl
|
|
|
|
- name: Create 30day trigger for {{ inventory_hostname }}
|
|
community.zabbix.zabbix_trigger:
|
|
name: "{{ inventory_hostname }} SSL Certificate expires in 30d"
|
|
host_name: "{{ inventory_hostname }}"
|
|
params:
|
|
severity: average
|
|
expression: "last(/{{ inventory_hostname }}/zext_ssl_cert.sh[{{ pagure_ip }},443])<30"
|
|
comments: "Time to renew this certificate"
|
|
enabled: true
|
|
manual_close: true
|
|
tags:
|
|
- tag: scope
|
|
value: availability
|
|
|
|
- name: Create 7day trigger for {{ inventory_hostname }}
|
|
community.zabbix.zabbix_trigger:
|
|
name: "{{ inventory_hostname }} SSL Certificate expires in 7d"
|
|
host_name: "{{ inventory_hostname }}"
|
|
params:
|
|
severity: high
|
|
expression: "last(/{{ inventory_hostname }}/zext_ssl_cert.sh[{{ pagure_ip }},443])<7"
|
|
comments: "Renew this certificate urgently"
|
|
enabled: true
|
|
manual_close: true
|
|
tags:
|
|
- tag: scope
|
|
value: availability
|
|
|
|
- name: Create 0day trigger for {{ inventory_hostname }}
|
|
community.zabbix.zabbix_trigger:
|
|
name: "{{ inventory_hostname }} SSL Certificate expired!"
|
|
host_name: "{{ inventory_hostname }}"
|
|
params:
|
|
severity: disaster
|
|
expression: "last(/{{ inventory_hostname }}/zext_ssl_cert.sh[{{ pagure_ip }},443])<1"
|
|
comments: "Renew this certificate now!"
|
|
enabled: true
|
|
manual_close: true
|
|
tags:
|
|
- tag: scope
|
|
value: availability
|
|
|
|
- name: Import Pagure Zabbix template file
|
|
community.zabbix.zabbix_template:
|
|
template_yaml: "{{ lookup('file', 'zabbix-template.yml') }}"
|
|
state: present
|
|
run_once: true
|
|
|
|
- name: Add self to Postfix in Zabbix
|
|
community.zabbix.zabbix_host:
|
|
host_name: "{{ inventory_hostname }}"
|
|
link_templates: Pagure checks
|
|
force: false
|