From d91494c57bc5929853c5ad0bb99212c98b7c3c95 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 4 Feb 2014 16:19:54 +0100
Subject: added submodule check_mk from
 https://git.codecoop.org/varacanero/puppet_check_mk.git

---
 .gitmodules             | 3 +++
 puppet/modules/check_mk | 1 +
 2 files changed, 4 insertions(+)
 create mode 160000 puppet/modules/check_mk

diff --git a/.gitmodules b/.gitmodules
index cc8afdb5..13b43e88 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -88,3 +88,6 @@
 [submodule "puppet/modules/sysctl"]
 	path = puppet/modules/sysctl
 	url = https://leap.se/git/puppet_sysctl
+[submodule "puppet/modules/check_mk"]
+	path = puppet/modules/check_mk
+	url = https://git.codecoop.org/varacanero/puppet_check_mk.git
diff --git a/puppet/modules/check_mk b/puppet/modules/check_mk
new file mode 160000
index 00000000..4cd47d03
--- /dev/null
+++ b/puppet/modules/check_mk
@@ -0,0 +1 @@
+Subproject commit 4cd47d03c68d8530dcbff37c5bc1cf6a8006d767
-- 
cgit v1.2.3


From dde7b18cc0ad265aa7f7b8ccf4fedd9f0542fc74 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 5 Feb 2014 16:44:23 +0100
Subject: site_nagios::client: install check_mk agent

---
 puppet/modules/site_nagios/manifests/client.pp | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 puppet/modules/site_nagios/manifests/client.pp

diff --git a/puppet/modules/site_nagios/manifests/client.pp b/puppet/modules/site_nagios/manifests/client.pp
new file mode 100644
index 00000000..ea6062a0
--- /dev/null
+++ b/puppet/modules/site_nagios/manifests/client.pp
@@ -0,0 +1,5 @@
+class site_nagios::client {
+  package { [ 'check-mk-agent', 'check-mk-agent-logwatch' ]:
+    ensure => installed,
+  }
+}
-- 
cgit v1.2.3


From 6156db5b5b817d35cfba185923ce2f5e65a0108a Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 5 Feb 2014 17:00:58 +0100
Subject: updated submodule check_mk

---
 puppet/modules/check_mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/check_mk b/puppet/modules/check_mk
index 4cd47d03..b449ad81 160000
--- a/puppet/modules/check_mk
+++ b/puppet/modules/check_mk
@@ -1 +1 @@
-Subproject commit 4cd47d03c68d8530dcbff37c5bc1cf6a8006d767
+Subproject commit b449ad813d8c9672d23393ca30bbfd3dc1dd7fe3
-- 
cgit v1.2.3


From e93ca6ae1ebb794fb72ade75ef2e5b27b86619c8 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 5 Feb 2014 17:14:44 +0100
Subject: include site_nagios::client by default

---
 puppet/modules/site_config/manifests/default.pp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index d85d9c8f..a09a30d2 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -86,4 +86,6 @@ class site_config::default {
   if defined( '::site_custom') {
     include ::site_custom
   }
+
+  include site_nagios::client
 }
-- 
cgit v1.2.3


From db04294845924edb70a6f181f67a49a80cf3a09e Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 5 Feb 2014 17:17:00 +0100
Subject: updated submodule check_mk

---
 puppet/modules/check_mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/check_mk b/puppet/modules/check_mk
index b449ad81..e291b2c0 160000
--- a/puppet/modules/check_mk
+++ b/puppet/modules/check_mk
@@ -1 +1 @@
-Subproject commit b449ad813d8c9672d23393ca30bbfd3dc1dd7fe3
+Subproject commit e291b2c07667ebfd73058cd2cab618d497f25f69
-- 
cgit v1.2.3


From dbca8237f915e2a4d3802d90dcb10aece50a4cc4 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 5 Feb 2014 17:24:49 +0100
Subject: updated submodule check_mk

---
 puppet/modules/check_mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/check_mk b/puppet/modules/check_mk
index e291b2c0..cd99b5b9 160000
--- a/puppet/modules/check_mk
+++ b/puppet/modules/check_mk
@@ -1 +1 @@
-Subproject commit e291b2c07667ebfd73058cd2cab618d497f25f69
+Subproject commit cd99b5b90f8096e0c444aa923692342881346998
-- 
cgit v1.2.3


From 3d22399b2da5fe010ab15de5c641b67f45dc1982 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 5 Feb 2014 17:29:01 +0100
Subject: use check_mk::agent to install check-mk-agent

---
 puppet/modules/site_nagios/manifests/client.pp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/puppet/modules/site_nagios/manifests/client.pp b/puppet/modules/site_nagios/manifests/client.pp
index ea6062a0..82063dc3 100644
--- a/puppet/modules/site_nagios/manifests/client.pp
+++ b/puppet/modules/site_nagios/manifests/client.pp
@@ -1,5 +1,9 @@
 class site_nagios::client {
-  package { [ 'check-mk-agent', 'check-mk-agent-logwatch' ]:
-    ensure => installed,
+  class { 'check_mk::agent':
+    agent_package_name          => 'check-mk-agent',
+    agent_logwatch_package_name => 'check-mk-agent-logwatch',
+    method                      => 'ssh',
+    homedir                     => '/etc/nagios/check_mk',
+    register_agent              => false
   }
 }
-- 
cgit v1.2.3


From 166bf4a33123afe5b17db68c22712408ebfb26ad Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 6 Feb 2014 14:00:42 +0100
Subject: added site_nagios::server::check_mk

---
 .../site_nagios/manifests/server/check_mk.pp       | 24 ++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 puppet/modules/site_nagios/manifests/server/check_mk.pp

diff --git a/puppet/modules/site_nagios/manifests/server/check_mk.pp b/puppet/modules/site_nagios/manifests/server/check_mk.pp
new file mode 100644
index 00000000..c6676d76
--- /dev/null
+++ b/puppet/modules/site_nagios/manifests/server/check_mk.pp
@@ -0,0 +1,24 @@
+class site_nagios::server::check_mk {
+
+  # override paths to use the system check_mk rather than OMD
+  class { 'check_mk::config':
+    site        => '',
+    etc_dir     => '/etc',
+    bin_dir     => '/usr/bin',
+    host_groups => undef
+  }
+
+  file {
+    '/etc/nagios/check_mk':
+      ensure => directory,
+      owner  => root,
+      group  => root,
+      mode   => '0755';
+
+    '/etc/nagios/check_mk/.ssh':
+      ensure => directory,
+      owner  => root,
+      group  => root,
+      mode   => '0755';
+  }
+}
-- 
cgit v1.2.3


From f7d12c8b3c31891635f188a37844e33288429a9f Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 6 Feb 2014 14:05:38 +0100
Subject: added site_nagios::server::apache

---
 puppet/modules/site_nagios/manifests/server.pp        | 1 +
 puppet/modules/site_nagios/manifests/server/apache.pp | 7 +++++++
 2 files changed, 8 insertions(+)
 create mode 100644 puppet/modules/site_nagios/manifests/server/apache.pp

diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index 3e1ef7e7..3cb58f9a 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -37,5 +37,6 @@ class site_nagios::server inherits nagios::base {
 
   create_resources ( site_nagios::add_host, $hosts )
 
+  include site_nagios::apache
   include site_shorewall::monitor
 }
diff --git a/puppet/modules/site_nagios/manifests/server/apache.pp b/puppet/modules/site_nagios/manifests/server/apache.pp
new file mode 100644
index 00000000..8dbc7e9b
--- /dev/null
+++ b/puppet/modules/site_nagios/manifests/server/apache.pp
@@ -0,0 +1,7 @@
+class site_nagios::server::apache {
+  include x509::variables
+  include site_config::x509::commercial::cert
+  include site_config::x509::commercial::key
+  include site_config::x509::commercial::ca
+
+}
-- 
cgit v1.2.3


From 36e5202181452c385b52e183e50166dec6c456d9 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 6 Feb 2014 15:36:12 +0100
Subject: move leap_webapp.conf template to common.conf which is included by
 the nagios and webapp node (#5096)

---
 provider_base/services/monitor.json                |  9 +++
 puppet/modules/site_apache/manifests/common.pp     | 26 ++++++++
 .../site_apache/templates/vhosts.d/common.conf.erb | 72 ++++++++++++++++++++++
 .../templates/vhosts.d/leap_webapp.conf.erb        | 67 --------------------
 puppet/modules/site_nagios/manifests/server.pp     | 22 +++++--
 puppet/modules/site_webapp/manifests/apache.pp     | 18 +-----
 6 files changed, 126 insertions(+), 88 deletions(-)
 create mode 100644 puppet/modules/site_apache/manifests/common.pp
 create mode 100644 puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
 delete mode 100644 puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb

diff --git a/provider_base/services/monitor.json b/provider_base/services/monitor.json
index c3e2b954..142a4b5e 100644
--- a/provider_base/services/monitor.json
+++ b/provider_base/services/monitor.json
@@ -2,5 +2,14 @@
   "nagios": {
     "nagiosadmin_pw": "= secret :nagios_admin_password",
     "hosts": "= nodes_like_me.pick_fields('domain.internal', 'ip_address', 'services', 'openvpn.gateway_address')"
+  },
+  "x509": {
+    "use": true,
+    "ca_cert": "= file :ca_cert, :missing => 'provider CA. Run `leap cert ca`'",
+    "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'",
+    "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'",
+    "commercial_cert": "= file [:commercial_cert, domain.full_suffix]",
+    "commercial_key": "= file [:commercial_key, domain.full_suffix]",
+    "commercial_ca_cert": "= try_file :commercial_ca_cert"
   }
 }
diff --git a/puppet/modules/site_apache/manifests/common.pp b/puppet/modules/site_apache/manifests/common.pp
new file mode 100644
index 00000000..72f24838
--- /dev/null
+++ b/puppet/modules/site_apache/manifests/common.pp
@@ -0,0 +1,26 @@
+class site_apache::common {
+  # installs x509 cert + key and common config
+  # that both nagios + leap webapp use
+
+  $web_domain       = hiera('domain')
+  $domain_name      = $web_domain['name']
+
+  include x509::variables
+  include site_config::x509::commercial::cert
+  include site_config::x509::commercial::key
+  include site_config::x509::commercial::ca
+
+  Class['Site_config::X509::Commercial::Key'] ~> Service[apache]
+  Class['Site_config::X509::Commercial::Cert'] ~> Service[apache]
+  Class['Site_config::X509::Commercial::Ca'] ~> Service[apache]
+
+  include site_apache::module::rewrite
+
+  class { '::apache': no_default_site => true, ssl => true }
+
+  apache::vhost::file {
+    'common':
+      content => template('site_apache/vhosts.d/common.conf.erb')
+  }
+
+}
diff --git a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
new file mode 100644
index 00000000..30f0a6b1
--- /dev/null
+++ b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
@@ -0,0 +1,72 @@
+<VirtualHost *:80>
+  ServerName <%= domain %>
+  ServerAlias www.<%= domain %>
+  RewriteEngine On
+  RewriteRule ^.*$ https://<%= domain -%>%{REQUEST_URI} [R=permanent,L]
+</VirtualHost>
+
+<VirtualHost *:443>
+  ServerName <%= domain_name %>
+  ServerAlias <%= domain %>
+  ServerAlias www.<%= domain %>
+
+  SSLEngine on
+  SSLProtocol -all +SSLv3 +TLSv1
+  SSLCipherSuite HIGH:MEDIUM:!aNULL:!SSLv2:!MD5:@STRENGTH
+  SSLHonorCipherOrder on
+
+  SSLCACertificatePath /etc/ssl/certs
+  SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::commercial_ca_name') %>.crt
+  SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::commercial_cert_name') %>.key
+  SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::commercial_cert_name') %>.crt
+
+  RequestHeader set X_FORWARDED_PROTO 'https'
+
+  <IfModule mod_headers.c>
+<% if (defined? @services) and (@services.include? 'webapp') and (@webapp['secure']) -%>
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
+<% end -%>
+    Header always unset X-Powered-By
+    Header always unset X-Runtime
+  </IfModule>
+
+<% if (defined? @services) and (@services.include? 'webapp') -%>
+  DocumentRoot /srv/leap/webapp/public
+
+  RewriteEngine On
+  # Check for maintenance file and redirect all requests
+  RewriteCond %{DOCUMENT_ROOT}/system/maintenance.html -f
+  RewriteCond %{SCRIPT_FILENAME} !maintenance.html
+  RewriteCond %{REQUEST_URI} !/images/maintenance.jpg
+  RewriteRule ^.*$ %{DOCUMENT_ROOT}/system/maintenance.html [L]
+
+  # http://www.modrails.com/documentation/Users%20guide%20Apache.html#_passengerallowencodedslashes_lt_on_off_gt
+  AllowEncodedSlashes on
+  PassengerAllowEncodedSlashes on
+  PassengerFriendlyErrorPages off
+  SetEnv TMPDIR /var/tmp
+
+  # Allow rails assets to be cached for a very long time (since the URLs change whenever the content changes)
+  <Location /assets/>
+    Header unset ETag
+    FileETag None
+    ExpiresActive On
+    ExpiresDefault "access plus 1 year"
+  </Location>
+<% end -%>
+
+
+<% if (defined? @services) and (@services.include? 'monitor') -%>
+ <DirectoryMatch (/usr/share/nagios3/htdocs|/usr/lib/cgi-bin/nagios3|/etc/nagios3/stylesheets)>
+ <% if (defined? @services) and (@services.include? 'webapp') -%>
+    PassengerEnabled off
+ <% end -%>
+    AllowOverride all
+    # Nagios won't work with setting this option to "DENY",
+    # as set in conf.d/security (#4169). Therefor we allow
+    # it here, only for nagios.
+    Header set X-Frame-Options: "ALLOW"
+  </DirectoryMatch>
+<% end -%>
+</VirtualHost>
+
diff --git a/puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb
deleted file mode 100644
index a001552a..00000000
--- a/puppet/modules/site_apache/templates/vhosts.d/leap_webapp.conf.erb
+++ /dev/null
@@ -1,67 +0,0 @@
-<VirtualHost *:80>
-  ServerName <%= domain %>
-  ServerAlias www.<%= domain %>
-  RewriteEngine On
-  RewriteRule ^.*$ https://<%= domain -%>%{REQUEST_URI} [R=permanent,L]
-</VirtualHost>
-
-<VirtualHost *:443>
-  ServerName <%= domain_name %>
-  ServerAlias <%= domain %>
-  ServerAlias www.<%= domain %>
-
-  SSLEngine on
-  SSLProtocol -all +SSLv3 +TLSv1
-  SSLCipherSuite HIGH:MEDIUM:!aNULL:!SSLv2:!MD5:@STRENGTH
-  SSLHonorCipherOrder on
-
-  SSLCACertificatePath /etc/ssl/certs
-  SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::commercial_ca_name') %>.crt
-  SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::commercial_cert_name') %>.key
-  SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::commercial_cert_name') %>.crt
-
-  RequestHeader set X_FORWARDED_PROTO 'https'
-
-  <IfModule mod_headers.c>
-<% if @webapp['secure'] -%>
-    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
-<% end -%>
-    Header always unset X-Powered-By
-    Header always unset X-Runtime
-  </IfModule>
-
-  DocumentRoot /srv/leap/webapp/public
-
-  RewriteEngine On
-  # Check for maintenance file and redirect all requests
-  RewriteCond %{DOCUMENT_ROOT}/system/maintenance.html -f
-  RewriteCond %{SCRIPT_FILENAME} !maintenance.html
-  RewriteCond %{REQUEST_URI} !/images/maintenance.jpg
-  RewriteRule ^.*$ %{DOCUMENT_ROOT}/system/maintenance.html [L]
-
-  # http://www.modrails.com/documentation/Users%20guide%20Apache.html#_passengerallowencodedslashes_lt_on_off_gt
-  AllowEncodedSlashes on
-  PassengerAllowEncodedSlashes on
-  PassengerFriendlyErrorPages off
-  SetEnv TMPDIR /var/tmp
-
-  # Allow rails assets to be cached for a very long time (since the URLs change whenever the content changes)
-  <Location /assets/>
-    Header unset ETag
-    FileETag None
-    ExpiresActive On
-    ExpiresDefault "access plus 1 year"
-  </Location>
-
- <% if (defined? @services) and (@services.include? 'monitor') -%>
- <DirectoryMatch (/usr/share/nagios3/htdocs|/usr/lib/cgi-bin/nagios3|/etc/nagios3/stylesheets)>
-    PassengerEnabled off
-    AllowOverride all
-    # Nagios won't work with setting this option to "DENY",
-    # as set in conf.d/security (#4169). Therefor we allow
-    # it here, only for nagios.
-    Header set X-Frame-Options: "ALLOW"
-  </DirectoryMatch>
- <% end -%>
-</VirtualHost>
-
diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index 3e1ef7e7..9f66c8ea 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -11,18 +11,32 @@ class site_nagios::server inherits nagios::base {
 
   include nagios::defaults
   include nagios::base
-  #Class ['nagios'] -> Class ['nagios::defaults']
-  class {'nagios::apache':
+  class {'nagios':
+    # don't manage apache class from nagios, cause we already include
+    # it in site_apache::common
+    httpd              => 'absent',
     allow_external_cmd => true,
     stored_config      => false,
-    #before             => Class ['nagios::defaults']
   }
 
+  # - [monitor2] err: /Stage[main]/Site_nagios::Server/Apache::Config::Global[nagios3.conf]/Apache::Config::File[nagios3.conf]/File[apache_nagios3.conf]/ensure: change from absent to link failed: Cannot create a symlink without a target at /srv/leap/puppet/modules/apache/manifests/config/file.pp:32
+  #apache::config::global { 'nagios3.conf':
+  #  ensure  => link,
+  #  target  => '/usr/share/doc/nagios3-common/examples/apache2.conf',
+  #}
+
+  file { '/etc/apache2/conf.d/nagios3.conf':
+    ensure => link,
+    target => '/usr/share/doc/nagios3-common/examples/apache2.conf',
+    notify => Service['apache']
+  }
+
+  include site_apache::common
   include site_apache::module::headers
 
   File ['nagios_htpasswd'] {
     source  => undef,
-    content => "nagiosadmin:$nagiosadmin_pw",
+    content => "nagiosadmin:${nagiosadmin_pw}",
     mode    => '0640',
   }
 
diff --git a/puppet/modules/site_webapp/manifests/apache.pp b/puppet/modules/site_webapp/manifests/apache.pp
index d327877a..21243d34 100644
--- a/puppet/modules/site_webapp/manifests/apache.pp
+++ b/puppet/modules/site_webapp/manifests/apache.pp
@@ -7,30 +7,14 @@ class site_webapp::apache {
   $web_domain       = hiera('domain')
   $domain_name      = $web_domain['name']
 
-  include x509::variables
-  include site_config::x509::commercial::cert
-  include site_config::x509::commercial::key
-  include site_config::x509::commercial::ca
-
-  Class['Site_config::X509::Commercial::Key'] ~> Service[apache]
-  Class['Site_config::X509::Commercial::Cert'] ~> Service[apache]
-  Class['Site_config::X509::Commercial::Ca'] ~> Service[apache]
-
-  class { '::apache': no_default_site => true, ssl => true }
-
+  include site_apache::common
   include site_apache::module::headers
-  include site_apache::module::rewrite
   include site_apache::module::alias
   include site_apache::module::expires
   include site_apache::module::removeip
 
   class { 'passenger': use_munin => false }
 
-  apache::vhost::file {
-    'leap_webapp':
-      content => template('site_apache/vhosts.d/leap_webapp.conf.erb')
-  }
-
   apache::vhost::file {
     'api':
       content => template('site_apache/vhosts.d/api.conf.erb')
-- 
cgit v1.2.3


From f2580e5f504aaa2b763e838fc50705355990e98e Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 6 Feb 2014 18:58:35 +0100
Subject: updated submodule check_mk

---
 puppet/modules/check_mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/check_mk b/puppet/modules/check_mk
index cd99b5b9..382cb6d2 160000
--- a/puppet/modules/check_mk
+++ b/puppet/modules/check_mk
@@ -1 +1 @@
-Subproject commit cd99b5b90f8096e0c444aa923692342881346998
+Subproject commit 382cb6d2ab5fe05b9db7e4178cd16b71685bef59
-- 
cgit v1.2.3


From 102a22ff35c8cf844a3eabeb213a508e658e47c2 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 6 Feb 2014 23:46:04 +0100
Subject: add a comment why we use a custom way to populate authorized_keys

---
 puppet/modules/site_sshd/manifests/authorized_keys.pp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/puppet/modules/site_sshd/manifests/authorized_keys.pp b/puppet/modules/site_sshd/manifests/authorized_keys.pp
index c18f691c..f36fe20f 100644
--- a/puppet/modules/site_sshd/manifests/authorized_keys.pp
+++ b/puppet/modules/site_sshd/manifests/authorized_keys.pp
@@ -1,4 +1,7 @@
 define site_sshd::authorized_keys ($keys, $ensure = 'present', $home = '') {
+  # We use a custom define here to deploy the authorized_keys file
+  # cause puppet doesn't allow purgin before populating this file
+  # (see https://tickets.puppetlabs.com/browse/PUP-1174)
   # This line allows default homedir based on $title variable.
   # If $home is empty, the default is used.
   $homedir = $home ? {'' => "/home/${title}", default => $home}
-- 
cgit v1.2.3


From 0ca517eabf4b4e2c0dd81c9941e5e503fb2469e1 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 7 Feb 2014 14:40:37 +0100
Subject: platform version -> 0.5rc2

---
 platform.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/platform.rb b/platform.rb
index 60b0d9a5..7d84c3fb 100644
--- a/platform.rb
+++ b/platform.rb
@@ -3,8 +3,8 @@
 #
 
 Leap::Platform.define do
-  self.version = "0.2.4"
-  self.compatible_cli = "1.2.4".."1.99"
+  self.version = "0.5rc2"
+  self.compatible_cli = "1.3.1".."1.99"
 
   #
   # the facter facts that should be gathered
-- 
cgit v1.2.3


From f544b5d5fa6d7ad941332bbc787fc97e78a658b6 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 7 Feb 2014 15:41:09 +0100
Subject: added custom $datasource_programs check_mk variable to call the agent
 via ssh

---
 puppet/modules/site_check_mk/files/use_ssh.mk | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 puppet/modules/site_check_mk/files/use_ssh.mk

diff --git a/puppet/modules/site_check_mk/files/use_ssh.mk b/puppet/modules/site_check_mk/files/use_ssh.mk
new file mode 100644
index 00000000..dbdcd4b5
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/use_ssh.mk
@@ -0,0 +1,5 @@
+# http://mathias-kettner.de/checkmk_datasource_programs.html
+datasource_programs = [
+ ( "ssh -l root -i /etc/check_mk/.ssh/id_rsa <IP> check_mk_agent", ALL_HOSTS ),
+]
+
-- 
cgit v1.2.3


From d400d271e616f669cc6383a5893dd992a0efada2 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 7 Feb 2014 15:42:12 +0100
Subject: deploy check_mk pubkey on clients

---
 puppet/modules/site_nagios/manifests/client.pp | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/puppet/modules/site_nagios/manifests/client.pp b/puppet/modules/site_nagios/manifests/client.pp
index 82063dc3..cb72db54 100644
--- a/puppet/modules/site_nagios/manifests/client.pp
+++ b/puppet/modules/site_nagios/manifests/client.pp
@@ -1,4 +1,9 @@
 class site_nagios::client {
+
+  $ssh_hash = hiera('ssh')
+  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
+  $type     = $ssh_hash['authorized_keys']['monitor']['type']
+
   class { 'check_mk::agent':
     agent_package_name          => 'check-mk-agent',
     agent_logwatch_package_name => 'check-mk-agent-logwatch',
@@ -6,4 +11,12 @@ class site_nagios::client {
     homedir                     => '/etc/nagios/check_mk',
     register_agent              => false
   }
+
+  file { '/root/.ssh/authorized_keys2':
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0600',
+    content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding ${type} ${pubkey} monitor"
+  }
+
 }
-- 
cgit v1.2.3


From 65281c7d46a0ebbb7c70eddaef9802ddb1885c65 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 7 Feb 2014 15:42:46 +0100
Subject: deploy check_mk on monitoring server

---
 puppet/modules/site_nagios/manifests/server.pp     |  3 +-
 .../site_nagios/manifests/server/check_mk.pp       | 48 +++++++++++++++-------
 2 files changed, 35 insertions(+), 16 deletions(-)

diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index 6ade7d06..59a3bbb0 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -51,6 +51,7 @@ class site_nagios::server inherits nagios::base {
 
   create_resources ( site_nagios::add_host, $hosts )
 
-  include site_nagios::apache
+  include site_nagios::server::apache
+  include site_nagios::server::check_mk
   include site_shorewall::monitor
 }
diff --git a/puppet/modules/site_nagios/manifests/server/check_mk.pp b/puppet/modules/site_nagios/manifests/server/check_mk.pp
index c6676d76..75bd4538 100644
--- a/puppet/modules/site_nagios/manifests/server/check_mk.pp
+++ b/puppet/modules/site_nagios/manifests/server/check_mk.pp
@@ -1,24 +1,42 @@
 class site_nagios::server::check_mk {
 
+  $ssh_hash = hiera('ssh')
+  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
+  $type     = $ssh_hash['authorized_keys']['monitor']['type']
+  $seckey   = $ssh_hash['monitor']['private_key']
+  $all_hosts = '"localhost", "plain1"'
+
+  package { 'check-mk-server':
+    ensure => installed,
+  }
+
   # override paths to use the system check_mk rather than OMD
   class { 'check_mk::config':
-    site        => '',
-    etc_dir     => '/etc',
-    bin_dir     => '/usr/bin',
-    host_groups => undef
+    site          => '',
+    etc_dir       => '/etc',
+    nagios_subdir => 'nagios3',
+    bin_dir       => '/usr/bin',
+    host_groups   => undef,
+    require       => Package['check-mk-server']
   }
 
   file {
-    '/etc/nagios/check_mk':
-      ensure => directory,
-      owner  => root,
-      group  => root,
-      mode   => '0755';
-
-    '/etc/nagios/check_mk/.ssh':
-      ensure => directory,
-      owner  => root,
-      group  => root,
-      mode   => '0755';
+    '/etc/check_mk/conf.d/use_ssh.mk':
+      source => 'puppet:///modules/site_check_mk/use_ssh.mk',
+      notify => Exec['check_mk-refresh'];
+    '/etc/check_mk/all_hosts_static':
+      content => $all_hosts,
+      notify  => Exec['check_mk-refresh'];
+    '/etc/check_mk/.ssh':
+      ensure => directory;
+    '/etc/check_mk/.ssh/id_rsa':
+      content => $seckey,
+      owner   => 'nagios',
+      mode    => '0600';
+    '/etc/check_mk/.ssh/id_rsa.pub':
+      content => "${type} ${pubkey} monitor",
+      owner   => 'nagios',
+      mode    => '0644';
   }
+
 }
-- 
cgit v1.2.3


From b733f9b49b48f700673d4a4a98832a6c00a39dbf Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 7 Feb 2014 21:29:46 +0100
Subject: updated LEAP archive signing key 0x1E34A1828E207901

---
 puppet/modules/site_apt/files/keys/leap_key.asc | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/puppet/modules/site_apt/files/keys/leap_key.asc b/puppet/modules/site_apt/files/keys/leap_key.asc
index b69251f0..b6b5077b 100644
--- a/puppet/modules/site_apt/files/keys/leap_key.asc
+++ b/puppet/modules/site_apt/files/keys/leap_key.asc
@@ -1,5 +1,5 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.11 (GNU/Linux)
+Version: GnuPG v1.4.14 (GNU/Linux)
 
 mQINBFESwt0BEAC2CR+XgW04DVwT427v2T4+qz+O/xGOwQcalVaSOUuguYgf29en
 Apb6mUqROOTuJWN1nw1lvXiA6iFxg6DjDUhsp6j54X7GAAAjZ9QuavPgcsractsJ
@@ -36,7 +36,19 @@ y9k8peFB7wwf0sW3Eg78XFsfy4gyV619VnBR+PbfOpKqFFXAodF1mFiIrPeefaVp
 F9fiQ5Owt0sJjDaJnYT83ksAO2Aj+VsY3UjnDrGFaiV8Neit9y/8W8DqmZ3EZEF/
 M3iS0yDjqqt9ACFD+jkGlKYsyHv7gbpTq0yi6u/kRXHUTIvVwFL9M6Z6AUcG8gzo
 qbKhXGfWKEq0lN5HAjJ//V9ro3DekFd0A+NQOlFV6XtspZwphVdtW1WS078HmVlw
-F5dbD8pcfT/RjbkCDQRREsLdARAA3Frw+j6H9McEIi/gjiGwvxnIdGc8McWchnFp
+F5dbD8pcfT/RjYkCPQQTAQoAJwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUC
+UvT9ZgUJA8NuBQAKCRAeNKGCjiB5AXB+D/9k/BzZdAczQ3/v7hKrN9y3/D8kOEYK
+rF8HdcBOH522sN6mqvm7wGkf3RmNSi731m6vzlbBSonrAT5KDMpj+THOmUcY29V5
+a1YOgFCCkToOfl+LmlLiuqfrGCJyE28MKMrsi2zMBKhsSxhvcI0EhJkQpPBu8gUs
+XW1GSHuh5CYzwf/i8eNDpVrhHjRF0AVCOWIq52LTR62QchR+6ci/wVDHWd9Ase5X
+8rxNnt2/pCbgATklQbmRcQS6efTVk3oXk1DZ8M46vayJ1g2BFuIi7pohiekLAAAt
+MCwRKHTHvtPkGAUAEXExPGS78qHxLHIau2VCtSBxm+bQX+ZyCMANDpI+ZTFp1APJ
+9SpbtGozuQOpWFjWY1rERunrbyWHIb2DuVVNKGiHlkMJB76zzysvbIPYWx1RqD6s
+KFJBkjrM0xn8H+D6qzwzGfmX1Yaw12oYA6pcai4aK5sO7KHt+THAxYAcVF7qxGU7
+lnDifM56hrH/DbE5InlDC8OUqDysj0cHacRee+ZYtj7TiEykWfP5RrZCLQ7L6Jd/
+HtgQti/9TVUaFkIlQCfvF+l4BYZQYvnhx3MVK7ChKLmy6AVQLWnDrBrDvl07HLvW
+6pslRzVHfWyIYng0pZ0HvK+MpQztCoUcDK470mjlpAtjNHuyKh6r6TtaiVK8MgbR
+Sx/NMHb1/PXQJrkCDQRREsLdARAA3Frw+j6H9McEIi/gjiGwvxnIdGc8McWchnFp
 OWvdhTW9056v+y22DoKbULjT8k+8GzuRQ0xp4VwCC1rX3UExwceczzGs+tSKuIGm
 g1ELygsaOZHdQBNLGPvn+TZNGlaYXPlQo7m8YhXGHwgQrdKyjcFD5xnOHxe981LT
 q+IQ6jVYhho7/Qik9rVE1XHxoOfYvnNZJD0cFdf9OcX47YoqmM4sZYPMoOmKoVQT
@@ -59,5 +71,5 @@ Dxix2FBXQU/4pVpGHjXTQP6RqeTrAedXvpgCHWP1UIlswIQecGmQcJ/hRZjd+0vl
 cjfCYhZHr7N96Da6Cy8v2fZiZHaSAt7T2oIZ9X3gEh/kOlLDcuIdvMHUfojn0MrP
 Ce1AqOHyQQqhkVylvZpS0PdE0VW3PmJ98uKfX2FVAOTUD4Rw3n9Ew7bfM249HuP4
 JOXi/Skp4sBB/xgrtV1u+E+BW0SS/BOiwfrI4xUy+MrWuw==
-=4STg
+=Om8x
 -----END PGP PUBLIC KEY BLOCK-----
-- 
cgit v1.2.3


From cac0061fe20ab42c9efee4dd80ec6a940c03c54e Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 7 Feb 2014 21:32:19 +0100
Subject: added local check_mk dir /etc/nagios3/local to nagios.cfg

---
 puppet/modules/site_nagios/files/configs/Debian/nagios.cfg | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/puppet/modules/site_nagios/files/configs/Debian/nagios.cfg b/puppet/modules/site_nagios/files/configs/Debian/nagios.cfg
index 753d1610..61d9f2da 100644
--- a/puppet/modules/site_nagios/files/configs/Debian/nagios.cfg
+++ b/puppet/modules/site_nagios/files/configs/Debian/nagios.cfg
@@ -25,6 +25,9 @@ log_file=/var/log/nagios3/nagios.log
 # Puppet-managed configuration files
 cfg_dir=/etc/nagios3/conf.d
 
+# check-mk managed configuration files
+cfg_dir=/etc/nagios3/local
+
 # Debian also defaults to using the check commands defined by the debian
 # nagios-plugins package
 cfg_dir=/etc/nagios-plugins/config
-- 
cgit v1.2.3


From 313b91b77cf4496d7cc31c46ef1e8e69ed53610c Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sat, 8 Feb 2014 00:04:23 +0100
Subject: restricted check_mk ssh login a bit more

---
 puppet/modules/site_nagios/manifests/client.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_nagios/manifests/client.pp b/puppet/modules/site_nagios/manifests/client.pp
index cb72db54..ff569142 100644
--- a/puppet/modules/site_nagios/manifests/client.pp
+++ b/puppet/modules/site_nagios/manifests/client.pp
@@ -16,7 +16,7 @@ class site_nagios::client {
     owner   => 'root',
     group   => 'root',
     mode    => '0600',
-    content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding ${type} ${pubkey} monitor"
+    content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty,no-user-rc, ${type} ${pubkey} monitor"
   }
 
 }
-- 
cgit v1.2.3


From f2f019d402345d6133cdfb6274d4b78d44e08ec9 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sat, 8 Feb 2014 13:59:37 +0100
Subject: reload nagios after check_mk

---
 puppet/modules/site_nagios/manifests/server/check_mk.pp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/puppet/modules/site_nagios/manifests/server/check_mk.pp b/puppet/modules/site_nagios/manifests/server/check_mk.pp
index 75bd4538..02cb8407 100644
--- a/puppet/modules/site_nagios/manifests/server/check_mk.pp
+++ b/puppet/modules/site_nagios/manifests/server/check_mk.pp
@@ -20,6 +20,8 @@ class site_nagios::server::check_mk {
     require       => Package['check-mk-server']
   }
 
+  Exec['check_mk-reload'] -> Service['nagios']
+
   file {
     '/etc/check_mk/conf.d/use_ssh.mk':
       source => 'puppet:///modules/site_check_mk/use_ssh.mk',
-- 
cgit v1.2.3


From 6720bdba0c67893de713eee7f753fb582d06aa61 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sat, 8 Feb 2014 14:00:10 +0100
Subject: disable purging of /etc/nagios3 and /etc/nagios3/conf.d

---
 puppet/modules/site_nagios/manifests/server/purge.pp | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/puppet/modules/site_nagios/manifests/server/purge.pp b/puppet/modules/site_nagios/manifests/server/purge.pp
index 39735cd3..18993586 100644
--- a/puppet/modules/site_nagios/manifests/server/purge.pp
+++ b/puppet/modules/site_nagios/manifests/server/purge.pp
@@ -1,7 +1,17 @@
-class site_nagios::server::purge {
-  exec {'purge_conf.d':
-    command => '/bin/rm -rf /etc/nagios3/conf.d/*',
-    onlyif  => 'test -e /etc/nagios3/conf.d'
+class site_nagios::server::purge inherits nagios::base {
+  # we don't want to get /etc/nagios3 and /etc/nagios3/conf.d
+  # purged, cause the check-mk-config-nagios3 package
+  # places its templates in /etc/nagios3/conf.d/check_mk,
+  # and check_mk -O updated it's nagios config in /etc/nagios3/conf.d/check_mk
+  File['nagios_cfgdir'] {
+    purge => false
+  }
+  File['nagios_confd'] {
+    purge => false
   }
 
+  exec {'purge_conf.d':
+    command => '/bin/rm -f /etc/nagios3/conf.d/nagios_*',
+    onlyif  => 'find /etc/nagios3/conf.d/ | grep -q "/etc/nagios3/conf.d/nagios_"'
+  }
 }
-- 
cgit v1.2.3


From 8054778e83fbc1f5a34dcaee4b364b8ded44dbab Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 10 Feb 2014 14:44:01 +0100
Subject: use default value for hiera lookup (#5118)

---
 puppet/modules/site_sshd/manifests/init.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp
index d2b13822..d2de41c8 100644
--- a/puppet/modules/site_sshd/manifests/init.pp
+++ b/puppet/modules/site_sshd/manifests/init.pp
@@ -1,6 +1,6 @@
 class site_sshd {
   $ssh = hiera_hash('ssh')
-  $hosts = hiera_hash('hosts')
+  $hosts = hiera('hosts', '')
 
   ##
   ## SETUP AUTHORIZED KEYS
-- 
cgit v1.2.3


From df342b1d4a12ea14aaaede6d876cca16028ba9a2 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 10 Feb 2014 18:33:05 +0100
Subject: add all nodes to check_mk main.mk config

---
 puppet/modules/site_nagios/manifests/server/check_mk.pp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/puppet/modules/site_nagios/manifests/server/check_mk.pp b/puppet/modules/site_nagios/manifests/server/check_mk.pp
index 02cb8407..5e0795c1 100644
--- a/puppet/modules/site_nagios/manifests/server/check_mk.pp
+++ b/puppet/modules/site_nagios/manifests/server/check_mk.pp
@@ -4,7 +4,10 @@ class site_nagios::server::check_mk {
   $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
   $type     = $ssh_hash['authorized_keys']['monitor']['type']
   $seckey   = $ssh_hash['monitor']['private_key']
-  $all_hosts = '"localhost", "plain1"'
+
+  $nagios_hiera   = hiera_hash('nagios')
+  $hosts          = $nagios_hiera['hosts']
+  $all_hosts = inline_template("<% @hosts.keys.sort.each do |key| -%>\"<%= key %>\", <% end -%>")
 
   package { 'check-mk-server':
     ensure => installed,
-- 
cgit v1.2.3


From 27cd293b4ed3f3632044e914375a45a5345e8cee Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 11 Feb 2014 14:00:45 +0100
Subject: use <HOST> instead of <IP>, because we cannot use public ips in DC

---
 puppet/modules/site_check_mk/files/use_ssh.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_check_mk/files/use_ssh.mk b/puppet/modules/site_check_mk/files/use_ssh.mk
index dbdcd4b5..a10e67a3 100644
--- a/puppet/modules/site_check_mk/files/use_ssh.mk
+++ b/puppet/modules/site_check_mk/files/use_ssh.mk
@@ -1,5 +1,5 @@
 # http://mathias-kettner.de/checkmk_datasource_programs.html
 datasource_programs = [
- ( "ssh -l root -i /etc/check_mk/.ssh/id_rsa <IP> check_mk_agent", ALL_HOSTS ),
+ ( "ssh -l root -i /etc/check_mk/.ssh/id_rsa <HOST> check_mk_agent", ALL_HOSTS ),
 ]
 
-- 
cgit v1.2.3


From 9a13819dbe7c8e8a51f802356e6fbebe32a7a11f Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 11 Feb 2014 17:39:12 +0100
Subject: use use_ssh.mk as template, include ssh port

---
 puppet/modules/site_check_mk/files/use_ssh.mk           | 5 -----
 puppet/modules/site_check_mk/templates/use_ssh.mk       | 5 +++++
 puppet/modules/site_nagios/manifests/server/check_mk.pp | 5 +++--
 3 files changed, 8 insertions(+), 7 deletions(-)
 delete mode 100644 puppet/modules/site_check_mk/files/use_ssh.mk
 create mode 100644 puppet/modules/site_check_mk/templates/use_ssh.mk

diff --git a/puppet/modules/site_check_mk/files/use_ssh.mk b/puppet/modules/site_check_mk/files/use_ssh.mk
deleted file mode 100644
index a10e67a3..00000000
--- a/puppet/modules/site_check_mk/files/use_ssh.mk
+++ /dev/null
@@ -1,5 +0,0 @@
-# http://mathias-kettner.de/checkmk_datasource_programs.html
-datasource_programs = [
- ( "ssh -l root -i /etc/check_mk/.ssh/id_rsa <HOST> check_mk_agent", ALL_HOSTS ),
-]
-
diff --git a/puppet/modules/site_check_mk/templates/use_ssh.mk b/puppet/modules/site_check_mk/templates/use_ssh.mk
new file mode 100644
index 00000000..4c5523db
--- /dev/null
+++ b/puppet/modules/site_check_mk/templates/use_ssh.mk
@@ -0,0 +1,5 @@
+# http://mathias-kettner.de/checkmk_datasource_programs.html
+datasource_programs = [
+ ( "ssh -l root -i /etc/check_mk/.ssh/id_rsa -p <%= @ssh_port %> <HOST> check_mk_agent", ALL_HOSTS ),
+]
+
diff --git a/puppet/modules/site_nagios/manifests/server/check_mk.pp b/puppet/modules/site_nagios/manifests/server/check_mk.pp
index 5e0795c1..f0fd3a76 100644
--- a/puppet/modules/site_nagios/manifests/server/check_mk.pp
+++ b/puppet/modules/site_nagios/manifests/server/check_mk.pp
@@ -4,6 +4,7 @@ class site_nagios::server::check_mk {
   $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
   $type     = $ssh_hash['authorized_keys']['monitor']['type']
   $seckey   = $ssh_hash['monitor']['private_key']
+  $ssh_port = $ssh_hash['port']
 
   $nagios_hiera   = hiera_hash('nagios')
   $hosts          = $nagios_hiera['hosts']
@@ -27,8 +28,8 @@ class site_nagios::server::check_mk {
 
   file {
     '/etc/check_mk/conf.d/use_ssh.mk':
-      source => 'puppet:///modules/site_check_mk/use_ssh.mk',
-      notify => Exec['check_mk-refresh'];
+      content => template('site_check_mk/use_ssh.mk'),
+      notify  => Exec['check_mk-refresh'];
     '/etc/check_mk/all_hosts_static':
       content => $all_hosts,
       notify  => Exec['check_mk-refresh'];
-- 
cgit v1.2.3


From 142eee6d9162c762c35fb79312ec572ce274b6d0 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 11 Feb 2014 17:39:37 +0100
Subject: properly purge nagios3/conf.d dir

---
 puppet/modules/site_nagios/manifests/server/purge.pp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/puppet/modules/site_nagios/manifests/server/purge.pp b/puppet/modules/site_nagios/manifests/server/purge.pp
index 18993586..1c12cfb0 100644
--- a/puppet/modules/site_nagios/manifests/server/purge.pp
+++ b/puppet/modules/site_nagios/manifests/server/purge.pp
@@ -10,8 +10,9 @@ class site_nagios::server::purge inherits nagios::base {
     purge => false
   }
 
+  # only purge find in the /etc/nagios3/conf.d/ dir, not in any subdir
   exec {'purge_conf.d':
-    command => '/bin/rm -f /etc/nagios3/conf.d/nagios_*',
-    onlyif  => 'find /etc/nagios3/conf.d/ | grep -q "/etc/nagios3/conf.d/nagios_"'
+    command => '/usr/bin/find /etc/nagios3/conf.d/ -maxdepth 1 -type f -exec rm {} \;',
+    onlyif  => '/usr/bin/find /etc/nagios3/conf.d/ -maxdepth 1 -type f | grep -q "/etc/nagios3/conf.d"'
   }
 }
-- 
cgit v1.2.3


From 3516ef17f41b80409a50cffe5b81a7777e6742cb Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 11 Feb 2014 18:17:36 +0100
Subject: changed submodule url for check_mk module to
 https://leap.se/git/puppet_check_mk

---
 .gitmodules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitmodules b/.gitmodules
index 13b43e88..7005b770 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -90,4 +90,4 @@
 	url = https://leap.se/git/puppet_sysctl
 [submodule "puppet/modules/check_mk"]
 	path = puppet/modules/check_mk
-	url = https://git.codecoop.org/varacanero/puppet_check_mk.git
+	url = https://leap.se/git/puppet_check_mk
-- 
cgit v1.2.3


From efc3e3eaa0788271cf61155d7e9be4d46e6e9d47 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Feb 2014 16:26:59 +0100
Subject: moved check_mk server and client class to site_check_mk module

---
 puppet/modules/site_check_mk/manifests/client.pp   | 24 +++++++++++
 puppet/modules/site_check_mk/manifests/server.pp   | 48 ++++++++++++++++++++++
 puppet/modules/site_config/manifests/default.pp    |  2 +-
 puppet/modules/site_nagios/manifests/client.pp     | 22 ----------
 puppet/modules/site_nagios/manifests/init.pp       |  2 +-
 puppet/modules/site_nagios/manifests/server.pp     |  2 +-
 .../site_nagios/manifests/server/check_mk.pp       | 48 ----------------------
 7 files changed, 75 insertions(+), 73 deletions(-)
 create mode 100644 puppet/modules/site_check_mk/manifests/client.pp
 create mode 100644 puppet/modules/site_check_mk/manifests/server.pp
 delete mode 100644 puppet/modules/site_nagios/manifests/client.pp
 delete mode 100644 puppet/modules/site_nagios/manifests/server/check_mk.pp

diff --git a/puppet/modules/site_check_mk/manifests/client.pp b/puppet/modules/site_check_mk/manifests/client.pp
new file mode 100644
index 00000000..ae269168
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/client.pp
@@ -0,0 +1,24 @@
+class site_check_mk::client {
+
+  $ssh_hash = hiera('ssh')
+  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
+  $type     = $ssh_hash['authorized_keys']['monitor']['type']
+
+  include site_apt::preferences::check_mk
+
+  class { 'check_mk::agent':
+    agent_package_name          => 'check-mk-agent',
+    agent_logwatch_package_name => 'check-mk-agent-logwatch',
+    method                      => 'ssh',
+    homedir                     => '/etc/nagios/check_mk',
+    register_agent              => false
+  }
+
+  file { '/root/.ssh/authorized_keys2':
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0600',
+    content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty,no-user-rc, ${type} ${pubkey} monitor"
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/server.pp b/puppet/modules/site_check_mk/manifests/server.pp
new file mode 100644
index 00000000..625fc688
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/server.pp
@@ -0,0 +1,48 @@
+class site_check_mk::server {
+
+  $ssh_hash = hiera('ssh')
+  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
+  $type     = $ssh_hash['authorized_keys']['monitor']['type']
+  $seckey   = $ssh_hash['monitor']['private_key']
+  $ssh_port = $ssh_hash['port']
+
+  $nagios_hiera   = hiera_hash('nagios')
+  $hosts          = $nagios_hiera['hosts']
+  $all_hosts = inline_template("<% @hosts.keys.sort.each do |key| -%>\"<%= key %>\", <% end -%>")
+
+  package { 'check-mk-server':
+    ensure => installed,
+  }
+
+  # override paths to use the system check_mk rather than OMD
+  class { 'check_mk::config':
+    site          => '',
+    etc_dir       => '/etc',
+    nagios_subdir => 'nagios3',
+    bin_dir       => '/usr/bin',
+    host_groups   => undef,
+    require       => Package['check-mk-server']
+  }
+
+  Exec['check_mk-reload'] -> Service['nagios']
+
+  file {
+    '/etc/check_mk/conf.d/use_ssh.mk':
+      content => template('site_check_mk/use_ssh.mk'),
+      notify  => Exec['check_mk-refresh'];
+    '/etc/check_mk/all_hosts_static':
+      content => $all_hosts,
+      notify  => Exec['check_mk-refresh'];
+    '/etc/check_mk/.ssh':
+      ensure => directory;
+    '/etc/check_mk/.ssh/id_rsa':
+      content => $seckey,
+      owner   => 'nagios',
+      mode    => '0600';
+    '/etc/check_mk/.ssh/id_rsa.pub':
+      content => "${type} ${pubkey} monitor",
+      owner   => 'nagios',
+      mode    => '0644';
+  }
+  include check_mk::agent::local_checks
+}
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index a09a30d2..25f9b3f8 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -87,5 +87,5 @@ class site_config::default {
     include ::site_custom
   }
 
-  include site_nagios::client
+  include site_check_mk::client
 }
diff --git a/puppet/modules/site_nagios/manifests/client.pp b/puppet/modules/site_nagios/manifests/client.pp
deleted file mode 100644
index ff569142..00000000
--- a/puppet/modules/site_nagios/manifests/client.pp
+++ /dev/null
@@ -1,22 +0,0 @@
-class site_nagios::client {
-
-  $ssh_hash = hiera('ssh')
-  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
-  $type     = $ssh_hash['authorized_keys']['monitor']['type']
-
-  class { 'check_mk::agent':
-    agent_package_name          => 'check-mk-agent',
-    agent_logwatch_package_name => 'check-mk-agent-logwatch',
-    method                      => 'ssh',
-    homedir                     => '/etc/nagios/check_mk',
-    register_agent              => false
-  }
-
-  file { '/root/.ssh/authorized_keys2':
-    owner   => 'root',
-    group   => 'root',
-    mode    => '0600',
-    content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty,no-user-rc, ${type} ${pubkey} monitor"
-  }
-
-}
diff --git a/puppet/modules/site_nagios/manifests/init.pp b/puppet/modules/site_nagios/manifests/init.pp
index c3cfa02e..eb08cdcb 100644
--- a/puppet/modules/site_nagios/manifests/init.pp
+++ b/puppet/modules/site_nagios/manifests/init.pp
@@ -1,6 +1,6 @@
 class site_nagios  {
   tag 'leap_service'
   Class['site_config::default'] -> Class['site_nagios']
-  
+
   include site_nagios::server
 }
diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index d740d8b7..b1795826 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -46,6 +46,6 @@ class site_nagios::server inherits nagios::base {
   create_resources ( site_nagios::add_host, $hosts )
 
   include site_nagios::server::apache
-  include site_nagios::server::check_mk
+  include site_check_mk::server
   include site_shorewall::monitor
 }
diff --git a/puppet/modules/site_nagios/manifests/server/check_mk.pp b/puppet/modules/site_nagios/manifests/server/check_mk.pp
deleted file mode 100644
index f0fd3a76..00000000
--- a/puppet/modules/site_nagios/manifests/server/check_mk.pp
+++ /dev/null
@@ -1,48 +0,0 @@
-class site_nagios::server::check_mk {
-
-  $ssh_hash = hiera('ssh')
-  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
-  $type     = $ssh_hash['authorized_keys']['monitor']['type']
-  $seckey   = $ssh_hash['monitor']['private_key']
-  $ssh_port = $ssh_hash['port']
-
-  $nagios_hiera   = hiera_hash('nagios')
-  $hosts          = $nagios_hiera['hosts']
-  $all_hosts = inline_template("<% @hosts.keys.sort.each do |key| -%>\"<%= key %>\", <% end -%>")
-
-  package { 'check-mk-server':
-    ensure => installed,
-  }
-
-  # override paths to use the system check_mk rather than OMD
-  class { 'check_mk::config':
-    site          => '',
-    etc_dir       => '/etc',
-    nagios_subdir => 'nagios3',
-    bin_dir       => '/usr/bin',
-    host_groups   => undef,
-    require       => Package['check-mk-server']
-  }
-
-  Exec['check_mk-reload'] -> Service['nagios']
-
-  file {
-    '/etc/check_mk/conf.d/use_ssh.mk':
-      content => template('site_check_mk/use_ssh.mk'),
-      notify  => Exec['check_mk-refresh'];
-    '/etc/check_mk/all_hosts_static':
-      content => $all_hosts,
-      notify  => Exec['check_mk-refresh'];
-    '/etc/check_mk/.ssh':
-      ensure => directory;
-    '/etc/check_mk/.ssh/id_rsa':
-      content => $seckey,
-      owner   => 'nagios',
-      mode    => '0600';
-    '/etc/check_mk/.ssh/id_rsa.pub':
-      content => "${type} ${pubkey} monitor",
-      owner   => 'nagios',
-      mode    => '0644';
-  }
-
-}
-- 
cgit v1.2.3


From cafa3fc37229ad9fa8e78c1a06ef6e5444ba3ebb Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Feb 2014 16:36:57 +0100
Subject: updated submodule check_mk

---
 puppet/modules/check_mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/check_mk b/puppet/modules/check_mk
index 382cb6d2..f9e49426 160000
--- a/puppet/modules/check_mk
+++ b/puppet/modules/check_mk
@@ -1 +1 @@
-Subproject commit 382cb6d2ab5fe05b9db7e4178cd16b71685bef59
+Subproject commit f9e494265f6c7b83ab9ef418e40cc7aac5589563
-- 
cgit v1.2.3


From 6d1a379f59612b79ddfbc10cac79cb5dfdafae58 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Feb 2014 16:51:46 +0100
Subject: added apt::preferences file for check-mk-\* to install from backports

---
 puppet/modules/site_apt/manifests/preferences/check_mk.pp | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 puppet/modules/site_apt/manifests/preferences/check_mk.pp

diff --git a/puppet/modules/site_apt/manifests/preferences/check_mk.pp b/puppet/modules/site_apt/manifests/preferences/check_mk.pp
new file mode 100644
index 00000000..580e0d3f
--- /dev/null
+++ b/puppet/modules/site_apt/manifests/preferences/check_mk.pp
@@ -0,0 +1,9 @@
+class site_apt::preferences::check_mk {
+
+  apt::preferences_snippet { 'check-mk':
+    package  => 'check-mk-*',
+    release  => "${::lsbdistcodename}-backports",
+    priority => 999;
+  }
+
+}
-- 
cgit v1.2.3


From 7bfc884008d26cc7dca3b10e0aeef9073f55e5d3 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Feb 2014 17:01:00 +0100
Subject: include monitor node into hosts hash so check-mk-agent can run on
 monitor host itself via ssh to localhost (requires latest leap_cli)

---
 provider_base/services/monitor.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provider_base/services/monitor.json b/provider_base/services/monitor.json
index 5656fe80..7ad0d637 100644
--- a/provider_base/services/monitor.json
+++ b/provider_base/services/monitor.json
@@ -3,7 +3,7 @@
     "nagiosadmin_pw": "= secret :nagios_admin_password",
     "hosts": "= nodes_like_me[:services => '!monitor'].pick_fields('domain.internal', 'ip_address', 'services', 'openvpn.gateway_address')"
   },
-  "hosts": "= hosts_file(nodes_like_me[:services => '!monitor'])",
+  "hosts": "= hosts_file(nodes_like_me)",
   "ssh": {
     "monitor": {
       "username": "= Leap::Platform.monitor_username",
-- 
cgit v1.2.3


From 060124b047ac44f9f54573a389fea6c5b6ab18ea Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Feb 2014 18:14:19 +0100
Subject: renamed site_check_mk::client to site_check_mk::agent

---
 puppet/modules/site_check_mk/manifests/agent.pp  | 24 ++++++++++++++++++++++++
 puppet/modules/site_check_mk/manifests/client.pp | 24 ------------------------
 puppet/modules/site_config/manifests/default.pp  |  2 +-
 3 files changed, 25 insertions(+), 25 deletions(-)
 create mode 100644 puppet/modules/site_check_mk/manifests/agent.pp
 delete mode 100644 puppet/modules/site_check_mk/manifests/client.pp

diff --git a/puppet/modules/site_check_mk/manifests/agent.pp b/puppet/modules/site_check_mk/manifests/agent.pp
new file mode 100644
index 00000000..bb0cb167
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent.pp
@@ -0,0 +1,24 @@
+class site_check_mk::agent {
+
+  $ssh_hash = hiera('ssh')
+  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
+  $type     = $ssh_hash['authorized_keys']['monitor']['type']
+
+  include site_apt::preferences::check_mk
+
+  class { 'check_mk::agent':
+    agent_package_name          => 'check-mk-agent',
+    agent_logwatch_package_name => 'check-mk-agent-logwatch',
+    method                      => 'ssh',
+    homedir                     => '/etc/nagios/check_mk',
+    register_agent              => false
+  }
+
+  file { '/root/.ssh/authorized_keys2':
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0600',
+    content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty,no-user-rc, ${type} ${pubkey} monitor"
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/client.pp b/puppet/modules/site_check_mk/manifests/client.pp
deleted file mode 100644
index ae269168..00000000
--- a/puppet/modules/site_check_mk/manifests/client.pp
+++ /dev/null
@@ -1,24 +0,0 @@
-class site_check_mk::client {
-
-  $ssh_hash = hiera('ssh')
-  $pubkey   = $ssh_hash['authorized_keys']['monitor']['key']
-  $type     = $ssh_hash['authorized_keys']['monitor']['type']
-
-  include site_apt::preferences::check_mk
-
-  class { 'check_mk::agent':
-    agent_package_name          => 'check-mk-agent',
-    agent_logwatch_package_name => 'check-mk-agent-logwatch',
-    method                      => 'ssh',
-    homedir                     => '/etc/nagios/check_mk',
-    register_agent              => false
-  }
-
-  file { '/root/.ssh/authorized_keys2':
-    owner   => 'root',
-    group   => 'root',
-    mode    => '0600',
-    content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty,no-user-rc, ${type} ${pubkey} monitor"
-  }
-
-}
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index 25f9b3f8..53cc60f6 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -87,5 +87,5 @@ class site_config::default {
     include ::site_custom
   }
 
-  include site_check_mk::client
+  include site_check_mk::agent
 }
-- 
cgit v1.2.3


From 9431d1c9da024f98f5c6eb7cf2eff68b2e3a1926 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Feb 2014 18:43:47 +0100
Subject: include monitor node also into nagios hash so check-mk-agent can run
 on monitor host itself via ssh to localhost (requires latest leap_cli)

---
 provider_base/services/monitor.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provider_base/services/monitor.json b/provider_base/services/monitor.json
index 7ad0d637..82c18745 100644
--- a/provider_base/services/monitor.json
+++ b/provider_base/services/monitor.json
@@ -1,7 +1,7 @@
 {
   "nagios": {
     "nagiosadmin_pw": "= secret :nagios_admin_password",
-    "hosts": "= nodes_like_me[:services => '!monitor'].pick_fields('domain.internal', 'ip_address', 'services', 'openvpn.gateway_address')"
+    "hosts": "= nodes_like_me.pick_fields('domain.internal', 'ip_address', 'services', 'openvpn.gateway_address')"
   },
   "hosts": "= hosts_file(nodes_like_me)",
   "ssh": {
-- 
cgit v1.2.3


From 1c8c4f6f3b68ba1da13e6b6374c6c55fe8214789 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Feb 2014 18:45:17 +0100
Subject: execute nagios plugins locally with mrpe

---
 puppet/modules/site_check_mk/manifests/agent.pp      |  1 +
 puppet/modules/site_check_mk/manifests/agent/mrpe.pp | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 puppet/modules/site_check_mk/manifests/agent/mrpe.pp

diff --git a/puppet/modules/site_check_mk/manifests/agent.pp b/puppet/modules/site_check_mk/manifests/agent.pp
index bb0cb167..ac5a7ebd 100644
--- a/puppet/modules/site_check_mk/manifests/agent.pp
+++ b/puppet/modules/site_check_mk/manifests/agent.pp
@@ -21,4 +21,5 @@ class site_check_mk::agent {
     content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty,no-user-rc, ${type} ${pubkey} monitor"
   }
 
+  include site_check_mk::agent::mrpe
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/mrpe.pp b/puppet/modules/site_check_mk/manifests/agent/mrpe.pp
new file mode 100644
index 00000000..37df7f74
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/mrpe.pp
@@ -0,0 +1,17 @@
+class site_check_mk::agent::mrpe {
+  # check_mk can use standard nagios plugins using
+  # a wrapper called mrpe
+  # see http://mathias-kettner.de/checkmk_mrpe.html
+
+  package { 'nagios-plugins-basic':
+    ensure => latest,
+  }
+
+  file { '/etc/check_mk/mrpe.cfg':
+    ensure => present
+  } ->
+  file_line { 'Apt':
+    line => 'APT    /usr/lib/nagios/plugins/check_apt',
+    path => '/etc/check_mk/mrpe.cfg',
+  }
+}
-- 
cgit v1.2.3


From 12cea40d5dffe5aa6e269c05773ed49d9f00a9ea Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 13 Feb 2014 00:10:09 +0100
Subject: added site_check_mk::agent::couchdb and site_check_mk::agent::soledad
 for local checks

---
 puppet/modules/site_check_mk/manifests/agent/couchdb.pp | 17 +++++++++++++++++
 puppet/modules/site_check_mk/manifests/agent/soledad.pp | 10 ++++++++++
 puppet/modules/site_couchdb/manifests/init.pp           |  2 ++
 puppet/modules/soledad/manifests/init.pp                |  2 ++
 4 files changed, 31 insertions(+)
 create mode 100644 puppet/modules/site_check_mk/manifests/agent/couchdb.pp
 create mode 100644 puppet/modules/site_check_mk/manifests/agent/soledad.pp

diff --git a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
new file mode 100644
index 00000000..5b50e5a9
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
@@ -0,0 +1,17 @@
+class site_check_mk::agent::couchdb {
+
+  # local custom checks
+  file { '/usr/lib/check_mk_agent/local/check_bigcouch_errors.sh':
+    ensure  => link,
+    target  => '/srv/leap/couchdb/scripts/tests/check_bigcouch_errors.sh',
+    require => Vcsrepo['/srv/leap/couchdb/scripts']
+  }
+
+  # local nagios plugin checks via mrpe
+  file_line {
+    'Tapicero_Procs':
+      line => 'Tapicero_Procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a tapicero',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/soledad.pp b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
new file mode 100644
index 00000000..d75ae732
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
@@ -0,0 +1,10 @@
+class site_check_mk::agent::soledad {
+
+  # local nagios plugin checks via mrpe
+  file_line {
+    'Soledad_Procs':
+      line => 'Soledad_Procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a soledad',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+
+}
diff --git a/puppet/modules/site_couchdb/manifests/init.pp b/puppet/modules/site_couchdb/manifests/init.pp
index 137b661f..a9512577 100644
--- a/puppet/modules/site_couchdb/manifests/init.pp
+++ b/puppet/modules/site_couchdb/manifests/init.pp
@@ -107,4 +107,6 @@ class site_couchdb {
   }
 
   if $couchdb_backup { include site_couchdb::backup }
+
+  include site_check_mk::agent::couchdb
 }
diff --git a/puppet/modules/soledad/manifests/init.pp b/puppet/modules/soledad/manifests/init.pp
index 7d44c8b4..35adc28e 100644
--- a/puppet/modules/soledad/manifests/init.pp
+++ b/puppet/modules/soledad/manifests/init.pp
@@ -27,4 +27,6 @@ class soledad {
       require => User['soledad'];
   }
 
+  include site_check_mk::agent::soledad
+
 }
-- 
cgit v1.2.3


From d0eea33d88a6ffcbe01544678372d80e8c8de51f Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 14 Feb 2014 17:38:02 +0100
Subject: Include check_mk monitor pubkey in /root/.ssh/authorized_keys

instead of creating a /root/.ssh/authorized_keys2

see https://review.leap.se/r/148/#comment153
---
 puppet/modules/site_check_mk/manifests/agent.pp        | 7 -------
 puppet/modules/site_sshd/templates/authorized_keys.erb | 4 ++++
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/puppet/modules/site_check_mk/manifests/agent.pp b/puppet/modules/site_check_mk/manifests/agent.pp
index ac5a7ebd..75188c7b 100644
--- a/puppet/modules/site_check_mk/manifests/agent.pp
+++ b/puppet/modules/site_check_mk/manifests/agent.pp
@@ -14,12 +14,5 @@ class site_check_mk::agent {
     register_agent              => false
   }
 
-  file { '/root/.ssh/authorized_keys2':
-    owner   => 'root',
-    group   => 'root',
-    mode    => '0600',
-    content => "command=\"/usr/bin/check_mk_agent\",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty,no-user-rc, ${type} ${pubkey} monitor"
-  }
-
   include site_check_mk::agent::mrpe
 }
diff --git a/puppet/modules/site_sshd/templates/authorized_keys.erb b/puppet/modules/site_sshd/templates/authorized_keys.erb
index 3c65e8ab..69f4d8e6 100644
--- a/puppet/modules/site_sshd/templates/authorized_keys.erb
+++ b/puppet/modules/site_sshd/templates/authorized_keys.erb
@@ -2,5 +2,9 @@
 # all manually added keys will be overridden
 
 <% keys.sort.each do |user, hash| -%>
+<% if user == 'monitor' -%>
+command="/usr/bin/check_mk_agent",no-port-forwarding,no-x11-forwarding,no-agent-forwarding,no-pty,no-user-rc, <%=hash['type']-%> <%=hash['key']%> <%=user%> 
+<% else -%>
 <%=hash['type']-%> <%=hash['key']%> <%=user%> 
+<% end -%>
 <% end -%> 
-- 
cgit v1.2.3