Zabbix: Migrate SSH connectivity checks from Nagios

Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>

roles/batcave/files/zabbix-ssh-agent.conf

@@ -0,0 +1 @@
+UserParameter=ssh.discovery,awk 'BEGIN{printf "{\"data\":["}; {printf c"{\"{#SSH_HOST}\":\""$1"\"}";c=","}; END{print "]}"}' /etc/zabbix/ssh-targets.txt 2>/dev/null

roles/batcave/files/zabbix-ssh-list.cron

@@ -0,0 +1,16 @@
+#!/bin/bash
+# Generate the host list Zabbix should monitor for SSH access from the Ansible
+# inventory data
+
+# Right now this just gets all the virtservers which matches Nagios, but we
+# should probably expand it to all known-available hosts
+
+TMP_FILE=$(mktemp)
+/usr/bin/ansible '*virtserver*' --list-hosts |grep -v "hosts.*:"|tr -d " " > "$TMP_FILE"
+
+if [ -s "$TMP_FILE" ]; then
+    mv "$TMP_FILE" /etc/zabbix/ssh-targets.txt
+    chmod 644 /etc/zabbix/ssh-targets.txt
+else
+    rm -f "$TMP_FILE"
+fi

roles/batcave/files/zabbix-ssh-template.yml

@@ -0,0 +1,61 @@
+zabbix_export:
+  version: '7.0'
+  template_groups:
+    - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec
+      name: Fedora
+  templates:
+    - uuid: f5dbfadc0ccd42c4b04172f09268481f
+      template: 'SSH access from Batcave'
+      name: 'SSH access from Batcave'
+      description: 'Only applies to Batcave and tests SSH access works. Uses discovery from a file populated from the Ansible inventory in /etc/zabbix/ssh-targets.txt via a cronjob.'
+      groups:
+        - name: Fedora
+      discovery_rules:
+        - uuid: ad85fd77593f4f2aa8073ced51d943a7
+          name: 'SSH Target discovery'
+          type: ZABBIX_ACTIVE
+          key: ssh.discovery
+          delay: 1h
+          enabled_lifetime_type: DISABLE_NEVER
+          item_prototypes:
+            - uuid: 1f78c9bd8e894f799bea27e8f0429b8c
+              name: 'SSH host {#SSH_HOST} response time'
+              type: ZABBIX_ACTIVE
+              key: 'net.tcp.service.perf[ssh,{#SSH_HOST},22]'
+              delay: 5m
+              value_type: FLOAT
+              units: ms
+              valuemap:
+                name: 'Service status'
+              preprocessing:
+                - type: MULTIPLIER
+                  parameters:
+                    - '1000'
+              tags:
+                - tag: application
+                  value: ssh
+            - uuid: 8fe6bedbdcc9480a8c00bfa1ead93400
+              name: 'SSH host {#SSH_HOST} port access'
+              type: ZABBIX_ACTIVE
+              key: 'net.tcp.service[ssh,{#SSH_HOST},22]'
+              delay: 5m
+              valuemap:
+                name: 'Service status'
+              tags:
+                - tag: application
+                  value: ssh
+              trigger_prototypes:
+                - uuid: 40b9cea515c6423fbcac99624676c1d0
+                  expression: 'last(/SSH access from Batcave/net.tcp.service[ssh,{#SSH_HOST},22]) = 0'
+                  name: 'SSH host {#SSH_HOST} not reachable on 22'
+                  tags:
+                    - tag: scope
+                      value: availability
+      valuemaps:
+        - uuid: a1b16e35c8e84f1c965fcfdde805297a
+          name: 'Service status'
+          mappings:
+            - value: '0'
+              newvalue: Down
+            - value: '1'
+              newvalue: Up

roles/batcave/tasks/main.yml

@@ -705,3 +705,52 @@
   tags:
   - batcave
   - config
+
+# Monitoring setup for Batcave
+- name: Setup cron for generating SSH monitoring hostlist
+  ansible.builtin.copy:
+    src: zabbix-ssh-list.cron
+    dest: /etc/cron.hourly/zabbix-ssh-list.cron
+    mode: '0755'
+  tags:
+  - batcave
+  - ssh
+  - zabbix_agent
+
+- name: Install Zabbix agent config drop-in
+  ansible.builtin.copy:
+    src: zabbix-ssh-agent.conf
+    dest: /etc/zabbix/zabbix_agentd.d/ssh-targets.conf
+    mode: '0644'
+  tags:
+    - batcave
+    - ssh
+    - zabbix_agent
+  notify:
+    - Restart zabbix agent
+
+- name: Zabbix API Block
+  vars:
+    ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
+    ansible_network_os: "{{ zabbix_network_os }}"
+    ansible_connection: "{{ zabbix_connection }}"
+    ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
+    ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
+    ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
+    ansible_host: "{{ zabbix_server }}"
+    ansible_zabbix_url_path: "{{ zabbix_url_path }}"
+  tags:
+    - zabbix_api
+    - batcave
+    - ssh
+  block:
+    - name: Import Batcave SSH template file
+      community.zabbix.zabbix_template:
+        template_yaml: "{{ lookup('file', 'zabbix-ssh-template.yml') }}"
+        state: present
+
+    - name: Add self to SSH template in Zabbix
+      community.zabbix.zabbix_host:
+        host_name: "{{ inventory_hostname }}"
+        link_templates: SSH access from Batcave
+        force: false

roles/nagios_server/files/nagios/services/ssh.cfg

@@ -1,10 +1,3 @@
-define service {
-  hostgroup_name		virtservers
-  service_description		SSH-virtservers
-  check_command			check_ssh
-  use				defaulttemplate
-}
-
 define service {
   hostgroup_name		bastion
   service_description		SSH-bastion