Merge branch 'develop'

24 files changed, 808 insertions, 0 deletions

diff --git a/puppet/modules/check_mk b/puppet/modules/check_mk
deleted file mode 160000
-Subproject aa02571537af90ac73309e6e216c9417802548c
diff --git a/puppet/modules/check_mk/manifests/agent.pp b/puppet/modules/check_mk/manifests/agent.pp
new file mode 100644
index 00000000..64109ae9
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent.pp
@@ -0,0 +1,70 @@
+class check_mk::agent (
+  $filestore    = undef,
+  $host_tags    = undef,
+  $ip_whitelist = undef,
+  $port         = '6556',
+  $server_dir   = '/usr/bin',
+  $keydir       = '/omd/sites/monitoring',
+  $authdir      = '/omd/sites/monitoring',
+  $authfile     = undef,
+  $use_cache    = false,
+  $user         = 'root',
+  $version      = undef,
+  $workspace    = '/root/check_mk',
+  $agent_package_name           = 'check_mk-agent',
+  $agent_logwatch_package_name  = 'check_mk-agent-logwatch',
+  $method                       = 'xinetd',
+  $generate_sshkey              = false,
+  $sshuser                      = undef,
+  $use_ssh_tag                  = 'ssh',
+  $hostname                     = $::fqdn,
+  $register_agent               = true
+) {
+
+  case $method {
+    'xinetd': {
+      $tags = $host_tags
+      include check_mk::agent::service
+    }
+    'ssh': {
+      if ( $host_tags == undef ) or ( $host_tags == '' ) {
+        $tags = $use_ssh_tag
+      } else {
+        $tags = "${host_tags}|${use_ssh_tag}"
+      }
+    }
+    default: {}
+  }
+
+  class { 'check_mk::agent::install':
+    version                     => $version,
+    filestore                   => $filestore,
+    workspace                   => $workspace,
+    agent_package_name          => $agent_package_name,
+    agent_logwatch_package_name => $agent_logwatch_package_name,
+    method                      => $method
+  }
+
+  class { 'check_mk::agent::config':
+    ip_whitelist    => $ip_whitelist,
+    port            => $port,
+    server_dir      => $server_dir,
+    keydir          => $keydir,
+    authdir         => $authdir,
+    authfile        => $authfile,
+    use_cache       => $use_cache,
+    user            => $user,
+    method          => $method,
+    generate_sshkey => $generate_sshkey,
+    sshuser         => $sshuser,
+    hostname        => $hostname,
+    require         => Class['check_mk::agent::install'],
+  }
+
+  if ( $register_agent ) {
+    class { 'check_mk::agent::register':
+      host_tags => $tags,
+      hostname  => $hostname,
+    }
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/config.pp b/puppet/modules/check_mk/manifests/agent/config.pp
new file mode 100644
index 00000000..8ee5f185
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/config.pp
@@ -0,0 +1,59 @@
+class check_mk::agent::config (
+  $ip_whitelist    = '',
+  $port,
+  $server_dir,
+  $keydir,
+  $authdir,
+  $authfile        = undef,
+  $use_cache,
+  $user,
+  $method          = 'xinetd',
+  $generate_sshkey = false,
+  $sshuser         = undef,
+  $hostname        = $::fqdn
+) {
+  if $use_cache {
+    $server = "${server_dir}/check_mk_caching_agent"
+  } else {
+    $server = "${server_dir}/check_mk_agent"
+  }
+
+  case $method {
+    'xinetd': {
+      if $ip_whitelist {
+        $only_from = join($ip_whitelist, ' ')
+      } else {
+        $only_from = undef
+      }
+
+      file { '/etc/xinetd.d/check_mk':
+        ensure  => present,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0444',
+        content => template('check_mk/agent/check_mk.erb'),
+        require => Package['check_mk-agent','check_mk-agent-logwatch'],
+        notify  => Class['check_mk::agent::service'],
+      }
+    }
+
+    'ssh': {
+      if $generate_sshkey {
+        check_mk::agent::generate_sshkey { "check_mk_key_${hostname}":
+          keydir   => $keydir,
+          authdir  => $authdir,
+          authfile => $authfile,
+          sshuser  => $sshuser,
+          hostname => $hostname
+        }
+      }
+
+      # make sure the xinetd method is not configured
+      file { '/etc/xinetd.d/check_mk':
+        ensure  => absent;
+      }
+    }
+
+    default : {}
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/generate_sshkey.pp b/puppet/modules/check_mk/manifests/agent/generate_sshkey.pp
new file mode 100644
index 00000000..b00271f5
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/generate_sshkey.pp
@@ -0,0 +1,70 @@
+define check_mk::agent::generate_sshkey (
+  # dir on the check-mk-server where the collected key pairs are stored
+  $keydir,
+  # user/group the key should be owned by on the check-mk-server
+  $keyuser          = 'nagios',
+  $keygroup         = 'nagios',
+  # dir on the check-mk-agent where the authorized_keys file is stored
+  $authdir,
+  # name of the authorized_keys file
+  $authfile         = undef,
+  # dir on the puppetmaster where keys are stored
+  # FIXME: need a way to ensure this dir is setup on the puppetmaster correctly
+  #$ssh_key_basepath = "${common::moduledir::module_dir_path}/check_mk/keys",
+  #  for now use a dir we know works
+  $ssh_key_basepath = '/etc/puppet/modules/check_mk/keys',
+  # user on the client the check_mk server will ssh to, to run the agent
+  $sshuser          = 'root',
+  $hostname         = $::fqdn,
+  $check_mk_tag     = 'check_mk_sshkey'
+){
+
+  # generate check-mk ssh keypair, stored on puppetmaster
+  $ssh_key_name = "${hostname}_id_rsa"
+  $ssh_keys     = ssh_keygen("${ssh_key_basepath}/${ssh_key_name}")
+  $public       = split($ssh_keys[1],' ')
+  $public_type  = $public[0]
+  $public_key   = $public[1]
+  $secret_key   = $ssh_keys[0]
+
+  # if we're not root we need to use sudo
+  if $sshuser != 'root' {
+    $command = 'sudo /usr/bin/check_mk_agent'
+  } else {
+    $command = '/usr/bin/check_mk_agent'
+  }
+
+  # setup the public half of the key in authorized_keys on the agent
+  #  and restrict it to running only the agent
+  if $authdir or $authfile {
+    # if $authkey or $authdir are set, override authorized_keys path and file
+    # and also override using the built-in ssh_authorized_key since it may
+    # not be able to write to $authdir
+    sshd::ssh_authorized_key { $ssh_key_name:
+        type             => 'ssh-rsa',
+        key              => $public_key,
+        user             => $sshuser,
+        target           => "${authdir}/${authfile}",
+        override_builtin => true,
+        options          => "command=\"${command}\"";
+    }
+  } else {
+    # otherwise use the defaults
+    sshd::ssh_authorized_key { $ssh_key_name:
+        type    => 'ssh-rsa',
+        key     => $public_key,
+        user    => $sshuser,
+        options => "command=\"${command}\"";
+    }
+  }
+
+  # resource collector for the private half of the keys, these end up on
+  #  the check-mk-server host, and the user running check-mk needs access
+  @@file { "${keydir}/${ssh_key_name}":
+    content => $secret_key,
+    owner   => $keyuser,
+    group   => $keygroup,
+    mode    => '0600',
+    tag     => $check_mk_tag;
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/install.pp b/puppet/modules/check_mk/manifests/agent/install.pp
new file mode 100644
index 00000000..5c0b56ef
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/install.pp
@@ -0,0 +1,70 @@
+class check_mk::agent::install (
+  $version = '',
+  $filestore = '',
+  $workspace,
+  $agent_package_name,
+  $agent_logwatch_package_name,
+  $method = 'xinetd',
+) {
+  if $method == 'xinetd' {
+    if ! defined($require_method) {
+      package { 'xinetd':
+        ensure => latest,
+      }
+    }
+    $require_method = 'Package[\'xinetd\']'
+  } else {
+    $require_method = undef
+  }
+
+  if $filestore {
+    if ! defined(File[$workspace]) {
+      file { $workspace:
+        ensure => directory,
+      }
+    }
+    file { "${workspace}/check_mk-agent-${version}.noarch.rpm":
+      ensure  => latest,
+      source  => "${filestore}/check_mk-agent-${version}.noarch.rpm",
+      require => $require_method,
+    }
+    file { "${workspace}/check_mk-agent-logwatch-${version}.noarch.rpm":
+      ensure  => latest,
+      source  => "${filestore}/check_mk-agent-logwatch-${version}.noarch.rpm",
+      require => $require_method,
+    }
+    package { 'check_mk-agent':
+      ensure   => latest,
+      provider => 'rpm',
+      source   => "${workspace}/check_mk-agent-${version}.noarch.rpm",
+      require  => File["${workspace}/check_mk-agent-${version}.noarch.rpm"],
+    }
+    package { 'check_mk-agent-logwatch':
+      ensure   => latest,
+      provider => 'rpm',
+      source   => "${workspace}/check_mk-agent-logwatch-${version}.noarch.rpm",
+      require  => [
+        File["${workspace}/check_mk-agent-logwatch-${version}.noarch.rpm"],
+        Package['check_mk-agent'],
+      ],
+    }
+  }
+  else {
+    if $version {
+      $agent_package_version = $version
+    } else {
+      $agent_package_version = latest
+    }
+
+    package { 'check_mk-agent':
+      ensure  => $agent_package_version,
+      name    => $agent_package_name,
+      require => $require_method,
+    }
+    package { 'check_mk-agent-logwatch':
+      ensure  => $agent_package_version,
+      name    => $agent_logwatch_package_name,
+      require => Package['check_mk-agent'],
+    }
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/install_local.pp b/puppet/modules/check_mk/manifests/agent/install_local.pp
new file mode 100644
index 00000000..7238440f
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/install_local.pp
@@ -0,0 +1,12 @@
+define check_mk::agent::install_local($source=undef, $content=undef, $ensure='present') {
+  @file { "/usr/lib/check_mk_agent/local/${name}" :
+    ensure  => $ensure,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0755',
+    content => $content,
+    source  => $source,
+    tag     => 'check_mk::local',
+    require => Package['check-mk-agent'],
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/local_checks.pp b/puppet/modules/check_mk/manifests/agent/local_checks.pp
new file mode 100644
index 00000000..04896b0a
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/local_checks.pp
@@ -0,0 +1,11 @@
+class check_mk::agent::local_checks{
+  file { '/usr/lib/check_mk_agent/local':
+    ensure  => directory,
+    source  => [
+      'puppet:///modules/site_check_mk/agent/local_checks/all_hosts',
+      'puppet:///modules/check_mk/agent/local_checks/all_hosts' ],
+    recurse => true,
+    require => Package['check_mk-agent'],
+  }
+
+}
diff --git a/puppet/modules/check_mk/manifests/agent/mrpe.pp b/puppet/modules/check_mk/manifests/agent/mrpe.pp
new file mode 100644
index 00000000..5bc5f331
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/mrpe.pp
@@ -0,0 +1,19 @@
+class check_mk::agent::mrpe {
+  # check_mk can use standard nagios plugins using
+  # a wrapper called mrpe
+  # see http://mathias-kettner.de/checkmk_mrpe.html
+  # this subclass is provided to be included by checks that use mrpe
+
+  # FIXME: this is Debian specific and should be made more generic
+  if !defined(Package['nagios-plugins-basic']) {
+    package { 'nagios-plugins-basic':
+      ensure => latest,
+    }
+  }
+
+  # ensure the config file exists, individual checks will add lines to it
+  file { '/etc/check_mk/mrpe.cfg':
+    ensure  => present,
+    require => Package['check-mk-agent']
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/ps.pp b/puppet/modules/check_mk/manifests/agent/ps.pp
new file mode 100644
index 00000000..67a999f5
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/ps.pp
@@ -0,0 +1,17 @@
+define check_mk::agent::ps (
+  # procname and levels have defaults in check_mk::ps
+  $procname = undef,
+  $levels = undef,
+  # user is optional
+  $user = undef
+) {
+
+  @@check_mk::ps { "${::fqdn}_${name}":
+    desc     => $name,
+    host     => $::fqdn,
+    procname => $procname,
+    user     => $user,
+    levels   => $levels,
+    tag      => 'check_mk_ps';
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/register.pp b/puppet/modules/check_mk/manifests/agent/register.pp
new file mode 100644
index 00000000..46cdeaee
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/register.pp
@@ -0,0 +1,8 @@
+class check_mk::agent::register (
+  $host_tags = '',
+  $hostname  = $::fqdn
+) {
+  @@check_mk::host { $hostname:
+    host_tags => $host_tags,
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/service.pp b/puppet/modules/check_mk/manifests/agent/service.pp
new file mode 100644
index 00000000..0f707082
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/service.pp
@@ -0,0 +1,8 @@
+class check_mk::agent::service {
+  if ! defined(Service['xinetd']) {
+    service { 'xinetd':
+      ensure => 'running',
+      enable => true,
+    }
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/config.pp b/puppet/modules/check_mk/manifests/config.pp
new file mode 100644
index 00000000..fba68361
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/config.pp
@@ -0,0 +1,109 @@
+# Deploy check_mk config
+class check_mk::config (
+  $site,
+  $host_groups               = undef,
+  $etc_dir                   = "/omd/sites/${site}/etc",
+  $nagios_subdir             = 'nagios',
+  $bin_dir                   = "/omd/sites/${site}/bin",
+  $use_storedconfigs         = true,
+  $inventory_only_on_changes = true
+) {
+  file {
+    # for local check_mk checks
+    "${etc_dir}/${nagios_subdir}/local":
+      ensure => directory;
+
+    # package provided and check_mk generated files, defined so the nagios
+    #  module doesn't purge them
+    "${etc_dir}/${nagios_subdir}/conf.d":
+      ensure => directory;
+    "${etc_dir}/${nagios_subdir}/conf.d/check_mk":
+      ensure => directory;
+  }
+  file_line { 'nagios-add-check_mk-cfg_dir':
+    ensure  => present,
+    line    => "cfg_dir=${etc_dir}/${nagios_subdir}/local",
+    path    => "${etc_dir}/${nagios_subdir}/nagios.cfg",
+    require => File["${etc_dir}/${nagios_subdir}/local"],
+    #notify  => Class['check_mk::service'],
+  }
+  file_line { 'add-guest-users':
+    ensure => present,
+    line   => 'guest_users = [ "guest" ]',
+    path   => "${etc_dir}/check_mk/multisite.mk",
+    #notify => Class['check_mk::service'],
+  }
+  concat { "${etc_dir}/check_mk/main.mk":
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0644',
+    notify => Exec['check_mk-refresh'],
+  }
+  # all_hosts
+  concat::fragment { 'all_hosts-header':
+    target  => "${etc_dir}/check_mk/main.mk",
+    content => "all_hosts = [\n",
+    order   => 10,
+  }
+  concat::fragment { 'all_hosts-footer':
+    target  => "${etc_dir}/check_mk/main.mk",
+    content => "]\n",
+    order   => 19,
+  }
+  if ( $use_storedconfigs ) {
+    class { 'check_mk::server::collect_hosts': }
+    class { 'check_mk::server::collect_ps': }
+  }
+
+
+  # local list of hosts is in /omd/sites/${site}/etc/check_mk/all_hosts_static and is appended
+  concat::fragment { 'all-hosts-static':
+    ensure => "${etc_dir}/check_mk/all_hosts_static",
+    target => "${etc_dir}/check_mk/main.mk",
+    order  => 18,
+  }
+  # host_groups
+  if $host_groups {
+    file { "${etc_dir}/nagios/local/hostgroups":
+      ensure => directory,
+    }
+    concat::fragment { 'host_groups-header':
+      target  => "${etc_dir}/check_mk/main.mk",
+      content => "host_groups = [\n",
+      order   => 20,
+    }
+    concat::fragment { 'host_groups-footer':
+      target  => "${etc_dir}/check_mk/main.mk",
+      content => "]\n",
+      order   => 29,
+    }
+    $groups = keys($host_groups)
+    check_mk::hostgroup { $groups:
+      dir        => "${etc_dir}/nagios/local/hostgroups",
+      hostgroups => $host_groups,
+      target     => "${etc_dir}/check_mk/main.mk",
+      notify     => Exec['check_mk-refresh']
+    }
+  }
+  # local config is in /omd/sites/${site}/etc/check_mk/main.mk.local and is appended
+  concat::fragment { 'check_mk-local-config':
+    ensure => "${etc_dir}/check_mk/main.mk.local",
+    target => "${etc_dir}/check_mk/main.mk",
+    order  => 99,
+  }
+  # re-read config if it changes
+  exec { 'check_mk-refresh':
+    command     => "/bin/su -l -c '${bin_dir}/check_mk -II' ${site}",
+    refreshonly => $inventory_only_on_changes,
+    notify      => Exec['check_mk-reload'],
+  }
+  exec { 'check_mk-reload':
+    command     => "/bin/su -l -c '${bin_dir}/check_mk -O' ${site}",
+    refreshonly => $inventory_only_on_changes,
+  }
+  # re-read inventory at least daily
+  exec { 'check_mk-refresh-inventory-daily':
+    command  => "/bin/su -l -c '${bin_dir}/check_mk -O' ${site}",
+    schedule => 'daily',
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/host.pp b/puppet/modules/check_mk/manifests/host.pp
new file mode 100644
index 00000000..49f038b5
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/host.pp
@@ -0,0 +1,18 @@
+define check_mk::host (
+  $target,
+  $host_tags = [],
+) {
+  $host = $title
+  if size($host_tags) > 0 {
+    $taglist = join(any2array($host_tags),'|')
+    $entry = "${host}|${taglist}"
+  }
+  else {
+    $entry = $host
+  }
+  concat::fragment { "check_mk-${host}":
+    target  => $target,
+    content => "  '${entry}',\n",
+    order   => 11,
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/hostgroup.pp b/puppet/modules/check_mk/manifests/hostgroup.pp
new file mode 100644
index 00000000..baec45f9
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/hostgroup.pp
@@ -0,0 +1,24 @@
+define check_mk::hostgroup (
+  $dir,
+  $hostgroups,
+  $target,
+) {
+  $group = $title
+  $group_tags = sprintf("'%s'", join($hostgroups[$group]['host_tags'], "', '"))
+  concat::fragment { "check_mk-hostgroup-${group}":
+    target  => $target,
+    content => "  ( '${group}', [ ${group_tags} ], ALL_HOSTS ),\n",
+    order   => 21,
+  }
+  if $hostgroups[$group]['description'] {
+    $description = $hostgroups[$group]['description']
+  }
+  else {
+    $description = regsubst($group, '_', ' ')
+  }
+  file { "${dir}/${group}.cfg":
+    ensure  => present,
+    content => "define hostgroup {\n  hostgroup_name ${group}\n  alias ${description}\n}\n",
+    require => File[$dir],
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/htpasswd.pp b/puppet/modules/check_mk/manifests/htpasswd.pp
new file mode 100644
index 00000000..2bd24cc5
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/htpasswd.pp
@@ -0,0 +1,12 @@
+class check_mk::htpasswd (
+  $password,
+  $username = 'omdadmin',
+  $path = '/opt/omd/sites/monitoring/etc/htpasswd' ) {
+
+  apache::htpasswd_user { $username:
+    ensure   => present,
+    username => $username,
+    password => $password,
+    path     => $path
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/init.pp b/puppet/modules/check_mk/manifests/init.pp
new file mode 100644
index 00000000..4aab837d
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/init.pp
@@ -0,0 +1,44 @@
+# configure check_mk server
+class check_mk (
+  $filestore                 = undef,
+  $host_groups               = undef,
+  $package                   = 'omd-0.56',
+  $site                      = 'monitoring',
+  $workspace                 = '/root/check_mk',
+  $omd_service_name          = 'omd',
+  $http_service_name         = 'httpd',
+  $xinitd_service_name       = 'xinetd',
+  $omdadmin_htpasswd         = undef,
+  $use_ssh                   = false,
+  $shelluser                 = 'monitoring',
+  $shellgroup                = 'monitoring',
+  $use_storedconfigs         = true,
+  $inventory_only_on_changes = true) {
+
+  class { 'check_mk::install':
+    filestore => $filestore,
+    package   => $package,
+    site      => $site,
+    workspace => $workspace,
+  }
+  class { 'check_mk::config':
+    host_groups               => $host_groups,
+    site                      => $site,
+    use_storedconfigs         => $use_storedconfigs,
+    inventory_only_on_changes => $inventory_only_on_changes,
+    require                   => Class['check_mk::install'],
+  }
+  class { 'check_mk::service':
+    require   => Class['check_mk::config'],
+  }
+  if $omdadmin_htpasswd {
+    class { 'check_mk::htpasswd':
+      password => $omdadmin_htpasswd
+    }
+  }
+
+  if ( $use_ssh == true ) {
+    class { 'check_mk::server::configure_ssh': }
+  }
+
+}
diff --git a/puppet/modules/check_mk/manifests/install.pp b/puppet/modules/check_mk/manifests/install.pp
new file mode 100644
index 00000000..5f8a4a0d
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/install.pp
@@ -0,0 +1,50 @@
+class check_mk::install (
+  $filestore = '',
+  $version = '',
+  $package,
+  $site,
+  $workspace,
+) {
+  if $filestore {
+    if ! defined(File[$workspace]) {
+      file { $workspace:
+        ensure => directory,
+      }
+    }
+    file { "${workspace}/${package}":
+      ensure  => latest,
+      source  => "${filestore}/${package}",
+      require => File[$workspace],
+    }
+    # omd-0.56-rh60-29.x86_64.rpm
+    if $package =~ /^(omd-\d+\.\d+)-(.*?)\.(rpm|deb)$/ {
+      $package_name = $1
+      $type         = $3
+      package { $package_name:
+        ensure   => installed,
+        provider => $type,
+        source   => "${workspace}/${package}",
+        require  => File["${workspace}/${package}"],
+      }
+    }
+  }
+  else {
+    $package_name = $package
+
+    if $version {
+      $server_package_version = $version
+    } else {
+      $server_package_version = latest
+    }
+
+    package { $package_name:
+      ensure => $server_package_version,
+    }
+  }
+  $etc_dir = "/omd/sites/${site}/etc"
+  exec { 'omd-create-site':
+    command => "/usr/bin/omd create ${site}",
+    creates => $etc_dir,
+    require => Package[$package_name],
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/install_tarball.pp b/puppet/modules/check_mk/manifests/install_tarball.pp
new file mode 100644
index 00000000..af40a267
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/install_tarball.pp
@@ -0,0 +1,92 @@
+class check_mk::install_tarball (
+  $filestore,
+  $version,
+  $workspace,
+) {
+  package { 'nagios':
+    ensure => present,
+    notify => Exec['set-nagiosadmin-password', 'set-guest-password', 'add-apache-to-nagios-group'],
+  }
+  file { '/etc/nagios/passwd':
+    ensure => present,
+    owner  => 'root',
+    group  => 'apache',
+    mode   => '0640',
+  }
+  exec { 'set-nagiosadmin-password':
+    command     => '/usr/bin/htpasswd -b /etc/nagios/passwd nagiosadmin letmein',
+    refreshonly => true,
+    require     => File['/etc/nagios/passwd'],
+  }
+  exec { 'set-guest-password':
+    command     => '/usr/bin/htpasswd -b /etc/nagios/passwd guest guest',
+    refreshonly => true,
+    require     => File['/etc/nagios/passwd'],
+  }
+  exec { 'add-apache-to-nagios-group':
+    command     => '/usr/sbin/usermod -a -G nagios apache',
+    refreshonly => true,
+  }
+  package { 'nagios-plugins-all':
+    ensure  => present,
+    require => Package['nagios'],
+  }
+  # FIXME: this should get and check $use_ssh before requiring xinetd
+  package { [ 'xinetd', 'mod_python', 'make', 'gcc-c++', 'tar', 'gzip' ]:
+    ensure  => present,
+  }
+  file { "${workspace}/check_mk-${version}.tar.gz":
+    ensure  => present,
+    source  => "${filestore}/check_mk-${version}.tar.gz",
+  }
+  exec { 'unpack-check_mk-tarball':
+    command     => "/bin/tar -zxf ${workspace}/check_mk-${version}.tar.gz",
+    cwd         => $workspace,
+    creates     => "${workspace}/check_mk-${version}",
+    require     => File["${workspace}/check_mk-${version}.tar.gz"],
+  }
+  exec { 'change-setup-config-location':
+    command => "/usr/bin/perl -pi -e 's#^SETUPCONF=.*?$#SETUPCONF=${workspace}/check_mk_setup.conf#' ${workspace}/check_mk-${version}/setup.sh",
+    unless  => "/bin/egrep '^SETUPCONF=${workspace}/check_mk_setup.conf$' ${workspace}/check_mk-${version}/setup.sh",
+    require => Exec['unpack-check_mk-tarball'],
+  }
+  # Avoid header like 'Written by setup of check_mk 1.2.0p3 at Thu Feb  7 12:26:17 GMT 2013'
+  # that changes every time the setup script is run
+  exec { 'remove-setup-header':
+    command => "/usr/bin/perl -pi -e 's#^DIRINFO=.*?$#DIRINFO=#' ${workspace}/check_mk-${version}/setup.sh",
+    unless  => "/bin/egrep '^DIRINFO=$' ${workspace}/check_mk-${version}/setup.sh",
+    require => Exec['unpack-check_mk-tarball'],
+  }
+  file { "${workspace}/check_mk_setup.conf":
+    ensure  => present,
+    content => template('check_mk/setup.conf.erb'),
+    notify  => Exec['check_mk-setup'],
+  }
+  file { '/etc/nagios/check_mk':
+    ensure  => directory,
+    owner   => 'nagios',
+    group   => 'nagios',
+    recurse => true,
+    require => Package['nagios'],
+  }
+  file { '/etc/nagios/check_mk/hostgroups':
+    ensure  => directory,
+    owner   => 'nagios',
+    group   => 'nagios',
+    require => File['/etc/nagios/check_mk'],
+  }
+  exec { 'check_mk-setup':
+    command     => "${workspace}/check_mk-${version}/setup.sh --yes",
+    cwd         => "${workspace}/check_mk-${version}",
+    refreshonly => true,
+    require     => [
+      Exec['change-setup-config-location'],
+      Exec['remove-setup-header'],
+      Exec['unpack-check_mk-tarball'],
+      File["${workspace}/check_mk_setup.conf"],
+      File['/etc/nagios/check_mk'],
+      Package['nagios'],
+    ],
+    notify      => Class['check_mk::service'],
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/omd_repo.pp b/puppet/modules/check_mk/manifests/omd_repo.pp
new file mode 100644
index 00000000..2100f378
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/omd_repo.pp
@@ -0,0 +1,6 @@
+class check_mk::omd_repo {
+  apt::sources_list { 'omd.list':
+    content => "deb http://labs.consol.de/OMD/debian ${::lsbdistcodename} main",
+    before  => Package['omd']
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/ps.pp b/puppet/modules/check_mk/manifests/ps.pp
new file mode 100644
index 00000000..1171a135
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/ps.pp
@@ -0,0 +1,34 @@
+define check_mk::ps (
+  $target,
+  $host,
+  $desc,
+  $procname = "/usr/sbin/${desc}",
+  $levels = '1, 1, 1, 1',
+  $user = undef
+) {
+  # This class is called on check-mk agent machines in order to create
+  # checks using the built-in ps check type. They create stored configs
+  # and then the check_mk::server::collect_ps class on the server
+  # generates the config file to set them up
+
+  # lines in the ps.mk config file look like
+  # ( "foo.example.com", "ps", "NAME", ( "/usr/sbin/foo", 1, 1, 1, 1 ) )
+  # or with a user
+  # ( "foo.example.com", "ps", "NAME", ( "/usr/sbin/foo", "user", 1, 1, 1, 1 ) )
+  if $user {
+    $check = "  ( \"${host}\", \"ps\", \"${desc}\", ( \"${procname}\", ${user}, ${levels} ) ),\n"
+  } else {
+    $check = "  ( \"${host}\", \"ps\", \"${desc}\", ( \"${procname}\", ${levels} ) ),\n"
+  }
+
+  # FIXME: we could be smarter about this and consolidate host checks
+  # that have identical settings and that would make the config file
+  # make more sense for humans. but for now we'll just do separate
+  # lines (which may result in a very large file, but check-mk is fine)
+  concat::fragment { "check_mk_ps-${host}_${desc}":
+    target  => $target,
+    content => $check,
+    order   => 20
+  }
+}
+
diff --git a/puppet/modules/check_mk/manifests/server/collect_hosts.pp b/puppet/modules/check_mk/manifests/server/collect_hosts.pp
new file mode 100644
index 00000000..6d07897b
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/server/collect_hosts.pp
@@ -0,0 +1,6 @@
+class check_mk::server::collect_hosts {
+  Check_mk::Host <<| |>> {
+    target => "${::check_mk::config::etc_dir}/check_mk/main.mk",
+    notify => Exec['check_mk-refresh']
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/server/collect_ps.pp b/puppet/modules/check_mk/manifests/server/collect_ps.pp
new file mode 100644
index 00000000..067a25c9
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/server/collect_ps.pp
@@ -0,0 +1,30 @@
+class check_mk::server::collect_ps (
+  $config = "${::check_mk::config::etc_dir}/check_mk/conf.d/ps.mk"
+) {
+
+  # this class gets run on the check-mk server in order to collect the
+  # stored configs created on clients and assemble the ps.mk config file
+  concat { $config:
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0644',
+    notify => Exec['check_mk-refresh'],
+  }
+
+  concat::fragment{'check_mk_ps_header':
+    target  => $config,
+    content => "checks += [\n",
+    order   => 10,
+  }
+
+  Check_mk::Ps <<| tag == 'check_mk_ps' |>> {
+    target => $config,
+    notify => Exec['check_mk-refresh']
+  }
+
+  concat::fragment{'check_mk_ps_footer':
+    target  => $config,
+    content => "]\n",
+    order   => 90,
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/server/configure_ssh.pp b/puppet/modules/check_mk/manifests/server/configure_ssh.pp
new file mode 100644
index 00000000..987cc7af
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/server/configure_ssh.pp
@@ -0,0 +1,16 @@
+class check_mk::server::configure_ssh (
+  $check_mk_tag     = 'check_mk_sshkey'
+) {
+  # collect exported files from client::generate_sshkey
+  File <<| tag == $check_mk_tag |>>
+
+  # configure ssh access to agents which have 'ssh' tags
+  file { "${check_mk::config::etc_dir}/check_mk/conf.d/use_ssh.mk":
+    source => [ 'puppet:///modules/site_check_mk/use_ssh.mk',
+                'puppet:///modules/check_mk/use_ssh.mk' ],
+    owner  => $::check_mk::shelluser,
+    group  => $::check_mk::shellgroup,
+    mode   => '0644',
+    notify => Exec['check_mk-refresh']
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/service.pp b/puppet/modules/check_mk/manifests/service.pp
new file mode 100644
index 00000000..36fb2d16
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/service.pp
@@ -0,0 +1,23 @@
+class check_mk::service {
+
+  if ! defined(Service[$check_mk::http_service_name]) {
+    service { $check_mk::http_service_name:
+      ensure => 'running',
+      enable => true,
+    }
+  }
+  # FIXME: this should get and check $use_ssh before doing this
+  if ! defined(Service[xinetd]) {
+    service { 'xinetd':
+      ensure    => 'running',
+      name      => $check_mk::xinitd_service_name,
+      hasstatus => false,
+      enable    => true,
+    }
+  }
+  service { 'omd':
+    ensure => 'running',
+    name   => $check_mk::omd_service_name,
+    enable => true,
+  }
+}