Merge branch 'develop' (0.5.0)

Conflicts:
	.gitignore

Change-Id: I778f3e1f1f4832f5894bc149ead67e9a4becf304

15 files changed, 320 insertions, 0 deletions

diff --git a/puppet/modules/site_check_mk/manifests/agent.pp b/puppet/modules/site_check_mk/manifests/agent.pp
new file mode 100644
index 00000000..589041eb
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent.pp
@@ -0,0 +1,28 @@
+class site_check_mk::agent {
+
+  $ssh_hash = hiera('ssh')
+  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
+  $type     = $ssh_hash['authorized_keys']['monitor']['type']
+
+  class { 'site_apt::preferences::check_mk': } ->
+
+  class { 'check_mk::agent':
+    agent_package_name          => 'check-mk-agent',
+    agent_logwatch_package_name => 'check-mk-agent-logwatch',
+    method                      => 'ssh',
+    homedir                     => '/etc/nagios/check_mk',
+    register_agent              => false
+  } ->
+
+  class { 'site_check_mk::agent::mrpe': } ->
+  class { 'site_check_mk::agent::logwatch': } ->
+
+  file {
+    [ '/srv/leap/nagios', '/srv/leap/nagios/plugins' ]:
+      ensure  => directory;
+    '/usr/lib/check_mk_agent/local/run_node_tests.sh':
+      source => 'puppet:///modules/site_check_mk/agent/local_checks/all_hosts/run_node_tests.sh',
+      mode   => '0755';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
new file mode 100644
index 00000000..01e2b886
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
@@ -0,0 +1,36 @@
+class site_check_mk::agent::couchdb {
+
+  # watch logs
+  file { '/etc/check_mk/logwatch.d/bigcouch.cfg':
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/bigcouch.cfg',
+  }
+  concat::fragment { 'syslog_couchdb':
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/couchdb.cfg',
+    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order   => '02';
+  }
+
+
+  # check bigcouch processes
+  file_line {
+    'Bigcouch_epmd_procs':
+      line => 'Bigcouch_epmd_procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/epmd',
+      path => '/etc/check_mk/mrpe.cfg';
+    'Bigcouch_beam_procs':
+      line => 'Bigcouch_beam_procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/beam',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+
+  # check open files for bigcouch proc
+  include site_check_mk::agent::package::perl_plugin
+  file { '/srv/leap/nagios/plugins/check_unix_open_fds.pl':
+    source => 'puppet:///modules/site_check_mk/agent/nagios_plugins/check_unix_open_fds.pl',
+    mode   => '0755'
+  }
+  file_line {
+    'Bigcouch_open_files':
+      line => 'Bigcouch_open_files /srv/leap/nagios/plugins/check_unix_open_fds.pl -a beam -w 750,750 -c 1000,1000',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/haproxy.pp b/puppet/modules/site_check_mk/manifests/agent/haproxy.pp
new file mode 100644
index 00000000..e7986db1
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/haproxy.pp
@@ -0,0 +1,12 @@
+class site_check_mk::agent::haproxy {
+
+  include site_check_mk::agent::package::nagios_plugins_contrib
+
+  # local nagios plugin checks via mrpe
+  file_line {
+    'haproxy':
+      line => 'Haproxy  /usr/lib/nagios/plugins/check_haproxy -u "http://localhost:8000/haproxy;csv"',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/logwatch.pp b/puppet/modules/site_check_mk/manifests/agent/logwatch.pp
new file mode 100644
index 00000000..423cace2
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/logwatch.pp
@@ -0,0 +1,36 @@
+class site_check_mk::agent::logwatch {
+  # Deploy mk_logwatch 1.2.4 so we can split the config
+  # into multiple config files in /etc/check_mk/logwatch.d
+  # see https://leap.se/code/issues/5135
+
+  file { '/usr/lib/check_mk_agent/plugins/mk_logwatch':
+    source  => 'puppet:///modules/site_check_mk/agent/plugins/mk_logwatch.1.2.4',
+    mode    => '0755',
+    require => Package['check-mk-agent-logwatch']
+  }
+
+  # only config files that watch a distinct logfile should go in logwatch.d/
+  file { '/etc/check_mk/logwatch.d':
+    ensure  => directory,
+    recurse => true,
+    purge   => true,
+    require => Package['check-mk-agent-logwatch']
+  }
+
+  # service that share a common logfile (i.e. /var/log/syslog) need to get
+  # concanated in one file, otherwise the last file sourced will override
+  # the config before
+  # see mk_logwatch: "logwatch.cfg overwrites config files in logwatch.d",
+  # https://leap.se/code/issues/5155
+
+  # first, we need to deploy a custom logwatch.cfg that doesn't include
+  # a section about /var/log/syslog
+
+  file { '/etc/check_mk/logwatch.cfg':
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/logwatch.cfg',
+    require => Package['check_mk-agent-logwatch']
+  }
+
+  include concat::setup
+  include site_check_mk::agent::logwatch::syslog
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/logwatch/syslog.pp b/puppet/modules/site_check_mk/manifests/agent/logwatch/syslog.pp
new file mode 100644
index 00000000..c927780d
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/logwatch/syslog.pp
@@ -0,0 +1,18 @@
+class site_check_mk::agent::logwatch::syslog {
+
+  concat { '/etc/check_mk/logwatch.d/syslog.cfg':
+    warn    => true
+  }
+
+  concat::fragment { 'syslog_header':
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/syslog_header.cfg',
+    target => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order  => '01';
+  }
+  concat::fragment { 'syslog_tail':
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/syslog_tail.cfg',
+    target => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order  => '99';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/mrpe.pp b/puppet/modules/site_check_mk/manifests/agent/mrpe.pp
new file mode 100644
index 00000000..6921574f
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/mrpe.pp
@@ -0,0 +1,18 @@
+class site_check_mk::agent::mrpe {
+  # check_mk can use standard nagios plugins using
+  # a wrapper called mrpe
+  # see http://mathias-kettner.de/checkmk_mrpe.html
+
+  package { 'nagios-plugins-basic':
+    ensure => latest,
+  }
+
+  file { '/etc/check_mk/mrpe.cfg':
+    ensure  => present,
+    require => Package['check-mk-agent']
+  } ->
+  file_line { 'Apt':
+    line => 'APT    /usr/lib/nagios/plugins/check_apt',
+    path => '/etc/check_mk/mrpe.cfg',
+  }
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/mx.pp b/puppet/modules/site_check_mk/manifests/agent/mx.pp
new file mode 100644
index 00000000..35a4e9a5
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/mx.pp
@@ -0,0 +1,23 @@
+class site_check_mk::agent::mx {
+
+  # watch logs
+  file { '/etc/check_mk/logwatch.d/leap_mx.cfg':
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/leap_mx.cfg',
+  }
+
+  # local nagios plugin checks via mrpe
+  file_line {
+    'Leap_MX_Procs':
+      line => 'Leap_MX_Procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a leap_mx',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+
+
+  # check stale files in queue dir
+  file { '/usr/lib/check_mk_agent/local/check_leap_mx.sh':
+    source  => 'puppet:///modules/site_check_mk/agent/local_checks/mx/check_leap_mx.sh',
+    mode    => '0755',
+    require => Package['check_mk-agent']
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/openvpn.pp b/puppet/modules/site_check_mk/manifests/agent/openvpn.pp
new file mode 100644
index 00000000..919a408d
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/openvpn.pp
@@ -0,0 +1,10 @@
+class site_check_mk::agent::openvpn {
+
+  # check syslog
+  concat::fragment { 'syslog_openpvn':
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/openvpn.cfg',
+    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order   => '02';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/package/nagios_plugins_contrib.pp b/puppet/modules/site_check_mk/manifests/agent/package/nagios_plugins_contrib.pp
new file mode 100644
index 00000000..95a60d17
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/package/nagios_plugins_contrib.pp
@@ -0,0 +1,5 @@
+class site_check_mk::agent::package::nagios_plugins_contrib  {
+  package { 'nagios-plugins-contrib':
+    ensure => installed,
+  }
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/package/perl_plugin.pp b/puppet/modules/site_check_mk/manifests/agent/package/perl_plugin.pp
new file mode 100644
index 00000000..4feda375
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/package/perl_plugin.pp
@@ -0,0 +1,5 @@
+class site_check_mk::agent::package::perl_plugin  {
+  package { 'libnagios-plugin-perl':
+    ensure => installed,
+  }
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/soledad.pp b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
new file mode 100644
index 00000000..cbae81fe
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
@@ -0,0 +1,14 @@
+class site_check_mk::agent::soledad {
+
+  file { '/etc/check_mk/logwatch.d/soledad.cfg':
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/soledad.cfg',
+  }
+
+  # local nagios plugin checks via mrpe
+  file_line {
+    'Soledad_Procs':
+      line => 'Soledad_Procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a soledad',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/stunnel.pp b/puppet/modules/site_check_mk/manifests/agent/stunnel.pp
new file mode 100644
index 00000000..64022824
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/stunnel.pp
@@ -0,0 +1,9 @@
+class site_check_mk::agent::stunnel {
+
+  concat::fragment { 'syslog_stunnel':
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/stunnel.cfg',
+    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order   => '02';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
new file mode 100644
index 00000000..369ed00b
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
@@ -0,0 +1,16 @@
+class site_check_mk::agent::tapicero {
+
+  concat::fragment { 'syslog_tapicero':
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/tapicero.cfg',
+    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order   => '02';
+  }
+
+  # local nagios plugin checks via mrpe
+  file_line {
+    'Tapicero_Procs':
+      line => 'Tapicero_Procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a tapicero',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/webapp.pp b/puppet/modules/site_check_mk/manifests/agent/webapp.pp
new file mode 100644
index 00000000..64f5ea6d
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/webapp.pp
@@ -0,0 +1,26 @@
+class site_check_mk::agent::webapp {
+
+  # check webapp login + soledad sync
+  package { [ 'python-srp', 'python-requests', 'python-yaml', 'python-u1db' ]:
+    ensure => installed
+  }
+  file { '/usr/lib/check_mk_agent/local/nagios-webapp_login.py':
+    ensure  => link,
+    target  => '/srv/leap/webapp/test/nagios/webapp_login.py',
+    require => Package['check_mk-agent']
+  }
+  file { '/usr/lib/check_mk_agent/local/soledad_sync.py':
+    ensure  => link,
+    target  => '/srv/leap/webapp/test/nagios/soledad_sync.py',
+    require => Package['check_mk-agent']
+  }
+
+
+  # check syslog
+  concat::fragment { 'syslog_webapp':
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/webapp.cfg',
+    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order   => '02';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/server.pp b/puppet/modules/site_check_mk/manifests/server.pp
new file mode 100644
index 00000000..e544ef0d
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/server.pp
@@ -0,0 +1,64 @@
+class site_check_mk::server {
+
+  $ssh_hash = hiera('ssh')
+  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
+  $type     = $ssh_hash['authorized_keys']['monitor']['type']
+  $seckey   = $ssh_hash['monitor']['private_key']
+
+  $nagios_hiera   = hiera_hash('nagios')
+  $nagios_hosts   = $nagios_hiera['hosts']
+
+  $hosts          = hiera_hash('hosts')
+  $all_hosts      = inline_template ('<% @hosts.keys.sort.each do |key| -%>"<%= @hosts[key]["domain_internal"] %>", <% end -%>')
+
+  package { 'check-mk-server':
+    ensure => installed,
+  }
+
+  # override paths to use the system check_mk rather than OMD
+  class { 'check_mk::config':
+    site              => '',
+    etc_dir           => '/etc',
+    nagios_subdir     => 'nagios3',
+    bin_dir           => '/usr/bin',
+    host_groups       => undef,
+    use_storedconfigs => false,
+    require           => Package['check-mk-server']
+  }
+
+  Exec['check_mk-reload'] ->
+    Exec['check_mk-refresh-inventory-daily'] ->
+    Service['nagios']
+
+  file {
+    '/etc/check_mk/conf.d/use_ssh.mk':
+      content => template('site_check_mk/use_ssh.mk'),
+      notify  => Exec['check_mk-refresh'],
+      require => Package['check-mk-server'];
+    '/etc/check_mk/all_hosts_static':
+      content => $all_hosts,
+      notify  => Exec['check_mk-refresh'],
+      require => Package['check-mk-server'];
+    '/etc/check_mk/.ssh':
+      ensure  => directory,
+      require => Package['check-mk-server'];
+    '/etc/check_mk/.ssh/id_rsa':
+      content => $seckey,
+      owner   => 'nagios',
+      mode    => '0600',
+      require => Package['check-mk-server'];
+    '/etc/check_mk/.ssh/id_rsa.pub':
+      content => "${type} ${pubkey} monitor",
+      owner   => 'nagios',
+      mode    => '0644',
+      require => Package['check-mk-server'];
+    # check_icmp must be suid root or called by sudo
+    # see https://leap.se/code/issues/5171
+    '/usr/lib/nagios/plugins/check_icmp':
+      mode    => '4755',
+      require => Package['nagios-plugins-basic'];
+  }
+
+
+  include check_mk::agent::local_checks
+}