Fixes #13021 - Zabbix: Add OpenVPN Client cert monitoring

Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>

roles/openvpn/client/files/zabbix/cron-openvpn-cert

@@ -0,0 +1,20 @@
+#!/usr/bin/bash
+# A script to report days-left on the openvpn cert to zabbix
+
+# Configuration
+CERT_FILE="/etc/openvpn/client/client.crt"
+
+# Get certificate expiry
+EXPIRY=$(openssl x509 -in "$CERT_FILE" -noout -enddate | cut -d= -f2)
+
+if [ -z "$EXPIRY" ]; then
+  echo "problem reading $CERT_FILE"
+  exit 1
+fi
+
+# Convert to epoch and calculate days remaining
+EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
+NOW_EPOCH=$(date +%s)
+DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))
+
+/usr/bin/zabbix_sender -c /etc/zabbix/zabbix_agentd.conf -k openvpn.cert_date -o "$DAYS_LEFT"  > /dev/null

roles/openvpn/client/files/zabbix/template-openvpn.yml

@@ -0,0 +1,47 @@
+zabbix_export:
+  version: '7.0'
+  template_groups:
+    - uuid: a333cbd6a3ad44baaa4eee4b0c0b1bec
+      name: Fedora
+  templates:
+    - uuid: 01a1d2dc827f4e1cbf803d3948237c1b
+      template: 'OpenVPN Client'
+      name: 'OpenVPN Client'
+      description: 'Uses zabbix-sender on the host to report the number of days left on the OpenVPN client certificate'
+      groups:
+        - name: Fedora
+      items:
+        - uuid: 93da423abd37459e9d5478e183048bd9
+          name: 'Time left on OpenVPN Cert'
+          type: TRAP
+          key: openvpn.cert_date
+          delay: '0'
+          trends: '0'
+          triggers:
+            - uuid: d62edd1dd4a74cada65855c2e133afe6
+              expression: 'last(/OpenVPN Client/openvpn.cert_date)<1'
+              name: 'OpenVPN Client cert expired'
+              priority: HIGH
+              tags:
+                - tag: service
+                  value: openvpn
+            - uuid: b5fc3fd5fae346f8b247f4323838bbe9
+              expression: 'last(/OpenVPN Client/openvpn.cert_date)<7'
+              name: 'OpenVPN Client cert has less than 7 days left'
+              priority: AVERAGE
+              dependencies:
+                - name: 'OpenVPN Client cert expired'
+                  expression: 'last(/OpenVPN Client/openvpn.cert_date)<1'
+              tags:
+                - tag: service
+                  value: openvpn
+            - uuid: 45e56e7945ec41789976dd29d7ec9e53
+              expression: 'last(/OpenVPN Client/openvpn.cert_date)<30'
+              name: 'OpenVPN Client cert has less than 30 days left'
+              priority: WARNING
+              dependencies:
+                - name: 'OpenVPN Client cert has less than 7 days left'
+                  expression: 'last(/OpenVPN Client/openvpn.cert_date)<7'
+              tags:
+                - tag: service
+                  value: openvpn

roles/openvpn/client/tasks/main.yml

@@ -65,3 +65,42 @@
   tags:
   - service
   - openvpn
+
+# Zabbix monitoring of the OpenVPN client
+
+# OpenVPN certs have restrcited permissions, so we use a zabbix-sender cronjob
+# for this, which runs as root once per day
+- name: Setup OpenVPN monitoring cron job
+  ansible.builtin.copy:
+    src: zabbix/cron-openvpn-cert
+    dest: /etc/cron.daily/zabbix-openvpn-cert
+    owner: root
+    group: root
+    mode: "0755"
+  tags:
+  - openvpn
+  - zabbix_agent
+
+- name: Zabbix API Block
+  vars:
+    ansible_zabbix_auth_key: "{{ zabbix_auth_key }}"
+    ansible_network_os: "{{ zabbix_network_os }}"
+    ansible_connection: "{{ zabbix_connection }}"
+    ansible_httpapi_port: "{{ zabbix_httpapi_port }}"
+    ansible_httpapi_use_ssl: "{{ zabbix_httpapi_use_ssl }}"
+    ansible_httpapi_validate_certs: "{{ zabbix_httpapi_validate_certs }}"
+    ansible_host: "{{ zabbix_server }}"
+    ansible_zabbix_url_path: "{{ zabbix_url_path }}"
+  tags:
+    - openvpn
+    - zabbix_api
+  block:
+    - name: Import OpenVPN template file
+      community.zabbix.zabbix_template:
+        template_yaml: "{{ lookup('file', 'zabbix/template-openvpn.yml') }}"
+        state: present
+    - name: Add self to OpenVPN template in Zabbix
+      community.zabbix.zabbix_host:
+        host_name: "{{ inventory_hostname }}"
+        link_templates: OpenVPN Client
+        force: false