| ... |
... |
@@ -1,0 +1,319 @@ |
|
1 |
+#!/bin/bash |
|
2 |
+ |
|
3 |
+# This generates and signs your required certificates. Please do not |
|
4 |
+# forget to install the Icinga 2 package and your desired monitoring |
|
5 |
+# plugins first. |
|
6 |
+ |
|
7 |
+# Config from Director |
|
8 |
+ICINGA2_NODENAME='private-cloud-taunusstein-master' |
|
9 |
+ICINGA2_CA_TICKET='c892a4ef8afe567e67db5beaf363f8c9b498a7ad' |
|
10 |
+ICINGA2_PARENT_ZONE='monitoring-sat-fsn02.xima-services.de' |
|
11 |
+ICINGA2_PARENT_ENDPOINTS=('monitoring-sat-fsn02.xima-services.de,monitoring-sat-fsn02.xima-services.de') |
|
12 |
+ICINGA2_CA_NODE='monitoring.xima-services.de' |
|
13 |
+ICINGA2_GLOBAL_ZONES=('director-global') |
|
14 |
+ |
|
15 |
+# Internal defaults |
|
16 |
+: "${ICINGA2_OSFAMILY:=}" |
|
17 |
+: "${ICINGA2_HOSTNAME:="$(hostname -f)"}" |
|
18 |
+: "${ICINGA2_NODENAME:="${ICINGA2_HOSTNAME}"}" |
|
19 |
+: "${ICINGA2_CA_NODE:=}" |
|
20 |
+: "${ICINGA2_CA_PORT:=5665}" |
|
21 |
+: "${ICINGA2_CA_TICKET:=}" |
|
22 |
+: "${ICINGA2_PARENT_ZONE:=master}" |
|
23 |
+: "${ICINGA2_PARENT_ENDPOINTS:=()}" |
|
24 |
+: "${ICINGA2_GLOBAL_ZONES:=director-global}" |
|
25 |
+: "${ICINGA2_DRYRUN:=}" |
|
26 |
+: "${ICINGA2_UPDATE_CONFIG:=}" |
|
27 |
+ |
|
28 |
+# Helper functions |
|
29 |
+fail() { |
|
30 |
+ echo "ERROR: $1" >&2 |
|
31 |
+ exit 1 |
|
32 |
+} |
|
33 |
+ |
|
34 |
+warn() { |
|
35 |
+ echo "WARNING: $1" >&2 |
|
36 |
+} |
|
37 |
+ |
|
38 |
+info() { |
|
39 |
+ echo "INFO: $1" >&2 |
|
40 |
+} |
|
41 |
+ |
|
42 |
+check_command() { |
|
43 |
+ command -v "$@" &>/dev/null |
|
44 |
+} |
|
45 |
+ |
|
46 |
+install_config() { |
|
47 |
+ if [ -e "$1" ] && [ ! -e "${1}.orig" ]; then |
|
48 |
+ info "Creating a backup at ${1}.orig" |
|
49 |
+ cp "$1" "${1}.orig" |
|
50 |
+ fi |
|
51 |
+ echo "Writing config to ${1}" |
|
52 |
+ echo "$2" > "${1}" |
|
53 |
+} |
|
54 |
+ |
|
55 |
+[ "$BASH_VERSION" ] || fail "This is a Bash script" |
|
56 |
+ |
|
57 |
+errors= |
|
58 |
+for key in NODENAME CA_NODE CA_PORT CA_TICKET PARENT_ZONE PARENT_ENDPOINTS; do |
|
59 |
+ var="ICINGA2_${key}" |
|
60 |
+ if [ -z "${!var}" ]; then |
|
61 |
+ warn "The variable $var needs to be configured!" |
|
62 |
+ errors+=1 |
|
63 |
+ fi |
|
64 |
+done |
|
65 |
+[ -z "$errors" ] || exit 1 |
|
66 |
+ |
|
67 |
+# Detect osfamily |
|
68 |
+if [ -n "$ICINGA2_OSFAMILY" ]; then |
|
69 |
+ info "Assuming supplied osfamily $ICINGA2_OSFAMILY" |
|
70 |
+elif check_command rpm && ! check_command dpkg; then |
|
71 |
+ info "This should be a RedHat system" |
|
72 |
+ if [ -e /etc/sysconfig/icinga2 ]; then |
|
73 |
+ # shellcheck disable=SC1091 |
|
74 |
+ . /etc/sysconfig/icinga2 |
|
75 |
+ fi |
|
76 |
+ ICINGA2_OSFAMILY=redhat |
|
77 |
+elif check_command dpkg; then |
|
78 |
+ info "This should be a Debian system" |
|
79 |
+ if [ -e /etc/default/icinga2 ]; then |
|
80 |
+ # shellcheck disable=SC1091 |
|
81 |
+ . /etc/default/icinga2 |
|
82 |
+ fi |
|
83 |
+ ICINGA2_OSFAMILY=debian |
|
84 |
+elif check_command apk; then |
|
85 |
+ info "This should be a Alpine system" |
|
86 |
+ if [ -e /etc/icinga2/icinga2.sysconfig ]; then |
|
87 |
+ # shellcheck disable=SC1091 |
|
88 |
+ . /etc/icinga2/icinga2.sysconfig |
|
89 |
+ fi |
|
90 |
+ ICINGA2_OSFAMILY=alpine |
|
91 |
+else |
|
92 |
+ fail "Could not determine your os type!" |
|
93 |
+fi |
|
94 |
+ |
|
95 |
+# internal defaults |
|
96 |
+: "${ICINGA2_CONFIG_FILE:=/etc/icinga2/icinga2.conf}" |
|
97 |
+: "${ICINGA2_CONFIGDIR:="$(dirname "$ICINGA2_CONFIG_FILE")"}" |
|
98 |
+: "${ICINGA2_DATADIR:=/var/lib/icinga2}" |
|
99 |
+: "${ICINGA2_SSLDIR_OLD:="${ICINGA2_CONFIGDIR}"/pki}" |
|
100 |
+: "${ICINGA2_SSLDIR_NEW:="${ICINGA2_DATADIR}"/certs}" |
|
101 |
+: "${ICINGA2_SSLDIR:=}" |
|
102 |
+: "${ICINGA2_BIN:=icinga2}" |
|
103 |
+ |
|
104 |
+case "$ICINGA2_OSFAMILY" in |
|
105 |
+debian) |
|
106 |
+ : "${ICINGA2_USER:=nagios}" |
|
107 |
+ : "${ICINGA2_GROUP:=nagios}" |
|
108 |
+ ;; |
|
109 |
+redhat) |
|
110 |
+ : "${ICINGA2_USER:=icinga}" |
|
111 |
+ : "${ICINGA2_GROUP:=icinga}" |
|
112 |
+ ;; |
|
113 |
+alpine) |
|
114 |
+ : "${ICINGA2_USER:=icinga}" |
|
115 |
+ : "${ICINGA2_GROUP:=icinga}" |
|
116 |
+ ;; |
|
117 |
+*) |
|
118 |
+ fail "Unknown osfamily '$ICINGA2_OSFAMILY'!" |
|
119 |
+ ;; |
|
120 |
+esac |
|
121 |
+ |
|
122 |
+icinga_version() { |
|
123 |
+ "$ICINGA2_BIN" --version 2>/dev/null | grep -oPi '\(version: [rv]?\K\d+\.\d+\.\d+[^\)]*' |
|
124 |
+} |
|
125 |
+ |
|
126 |
+version() { |
|
127 |
+ echo "$@" | awk -F. '{ printf("%03d%03d%03d\n", $1,$2,$3); }' |
|
128 |
+} |
|
129 |
+ |
|
130 |
+# Make sure icinga2 is installed and running |
|
131 |
+echo -n "check: icinga2 installed - " |
|
132 |
+if version=$(icinga_version); then |
|
133 |
+ echo "OK: $version" |
|
134 |
+else |
|
135 |
+ fail "You need to install icinga2!" |
|
136 |
+fi |
|
137 |
+ |
|
138 |
+if [ -z "${ICINGA2_SSLDIR}" ]; then |
|
139 |
+ if [ -f "${ICINGA2_SSLDIR_OLD}/${ICINGA2_NODENAME}.crt" ]; then |
|
140 |
+ info "Using old SSL directory: ${ICINGA2_SSLDIR_OLD}" |
|
141 |
+ info "Because you already have a certificate in ${ICINGA2_SSLDIR_OLD}/${ICINGA2_NODENAME}.crt" |
|
142 |
+ ICINGA2_SSLDIR="${ICINGA2_SSLDIR_OLD}" |
|
143 |
+ elif [ $(version $version) -gt $(version 2.8) ]; then |
|
144 |
+ info "Using new SSL directory: ${ICINGA2_SSLDIR_NEW}" |
|
145 |
+ ICINGA2_SSLDIR="${ICINGA2_SSLDIR_NEW}" |
|
146 |
+ else |
|
147 |
+ info "Using old SSL directory: ${ICINGA2_SSLDIR_OLD}" |
|
148 |
+ ICINGA2_SSLDIR="${ICINGA2_SSLDIR_OLD}" |
|
149 |
+ fi |
|
150 |
+fi |
|
151 |
+ |
|
152 |
+if [ ! -d "$ICINGA2_SSLDIR" ]; then |
|
153 |
+ mkdir "$ICINGA2_SSLDIR" |
|
154 |
+ chown "$ICINGA2_USER.$ICINGA2_GROUP" "$ICINGA2_SSLDIR" |
|
155 |
+fi |
|
156 |
+ |
|
157 |
+if [ -f "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" ]; then |
|
158 |
+ warn "ERROR: a certificate for '${ICINGA2_NODENAME}' already exists" |
|
159 |
+ warn "Please remove ${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.??? in case you want a" |
|
160 |
+ warn "new certificate to be generated and signed by ${ICINGA2_CA_NODE}" |
|
161 |
+ |
|
162 |
+ if [ -z "${ICINGA2_UPDATE_CONFIG}" ] && [ -z "${ICINGA2_DRYRUN}" ]; then |
|
163 |
+ warn "Aborting here, you can can call the script like this to just update config:" |
|
164 |
+ info " ICINGA2_UPDATE_CONFIG=1 $0" |
|
165 |
+ exit 1 |
|
166 |
+ fi |
|
167 |
+elif [ -z "${ICINGA2_DRYRUN}" ]; then |
|
168 |
+ if ! "$ICINGA2_BIN" pki new-cert --cn "${ICINGA2_NODENAME}" \ |
|
169 |
+ --cert "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" \ |
|
170 |
+ --csr "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.csr" \ |
|
171 |
+ --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key" |
|
172 |
+ then fail "Could not create self signed certificate!" |
|
173 |
+ fi |
|
174 |
+ |
|
175 |
+ if ! "$ICINGA2_BIN" pki save-cert \ |
|
176 |
+ --host "${ICINGA2_CA_NODE}" \ |
|
177 |
+ --port "${ICINGA2_CA_PORT}" \ |
|
178 |
+ --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key" \ |
|
179 |
+ --trustedcert "${ICINGA2_SSLDIR}/trusted-master.crt" |
|
180 |
+ then fail "Could not retrieve trusted certificate from host ${ICINGA2_CA_NODE}" |
|
181 |
+ fi |
|
182 |
+ |
|
183 |
+ if ! "$ICINGA2_BIN" pki request \ |
|
184 |
+ --host "${ICINGA2_CA_NODE}" \ |
|
185 |
+ --port "${ICINGA2_CA_PORT}" \ |
|
186 |
+ --ticket "${ICINGA2_CA_TICKET}" \ |
|
187 |
+ --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key" \ |
|
188 |
+ --cert "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" \ |
|
189 |
+ --trustedcert "${ICINGA2_SSLDIR}/trusted-master.crt" \ |
|
190 |
+ --ca "${ICINGA2_SSLDIR}/ca.crt" |
|
191 |
+ then fail "Could not retrieve final certificate from host ${ICINGA2_CA_NODE}" |
|
192 |
+ fi |
|
193 |
+else |
|
194 |
+ info "Would create certificates under ${ICINGA2_SSLDIR}, but in dry-run!" |
|
195 |
+fi |
|
196 |
+ |
|
197 |
+# Prepare Config Files |
|
198 |
+content_config=$(cat << EOF |
|
199 |
+/** Icinga 2 Config - proposed by Icinga Director */ |
|
200 |
+ |
|
201 |
+include "constants.conf" |
|
202 |
+ |
|
203 |
+$([ "${ICINGA2_HOSTNAME}" != "${ICINGA2_NODENAME}" ] || echo '// ')const NodeName = "${ICINGA2_NODENAME}" |
|
204 |
+ |
|
205 |
+include "zones.conf" |
|
206 |
+include "features-enabled/*.conf" |
|
207 |
+ |
|
208 |
+include <itl> |
|
209 |
+include <plugins> |
|
210 |
+include <plugins-contrib> |
|
211 |
+include <manubulon> |
|
212 |
+include <windows-plugins> |
|
213 |
+include <nscp> |
|
214 |
+EOF |
|
215 |
+) |
|
216 |
+ |
|
217 |
+endpoint_list='' |
|
218 |
+for item in "${ICINGA2_PARENT_ENDPOINTS[@]}"; do |
|
219 |
+ endpoint=$(echo "$item" | cut -d, -f1) |
|
220 |
+ endpoint_list+="\"${endpoint}\", " |
|
221 |
+done |
|
222 |
+ |
|
223 |
+content_zones=$(cat << EOF |
|
224 |
+/** Icinga 2 Config - proposed by Icinga Director */ |
|
225 |
+ |
|
226 |
+object Endpoint "${ICINGA2_NODENAME}" {} |
|
227 |
+ |
|
228 |
+object Zone "${ICINGA2_NODENAME}" { |
|
229 |
+ parent = "${ICINGA2_PARENT_ZONE}" |
|
230 |
+ endpoints = [ "${ICINGA2_NODENAME}" ] |
|
231 |
+} |
|
232 |
+ |
|
233 |
+object Zone "${ICINGA2_PARENT_ZONE}" { |
|
234 |
+ endpoints = [ ${endpoint_list%, } ] |
|
235 |
+} |
|
236 |
+EOF |
|
237 |
+) |
|
238 |
+ |
|
239 |
+for item in "${ICINGA2_PARENT_ENDPOINTS[@]}"; do |
|
240 |
+ endpoint=$(echo "$item" | cut -d, -f1) |
|
241 |
+ host=$(echo "$item" | cut -s -d, -f2) |
|
242 |
+ |
|
243 |
+ content_zones+=$(cat << EOF |
|
244 |
+ |
|
245 |
+object Endpoint "${endpoint}" { |
|
246 |
+$([ -n "$host" ] && echo " host = \"${host}\"" || echo " //host = \"${endpoint}\"") |
|
247 |
+} |
|
248 |
+EOF |
|
249 |
+) |
|
250 |
+done |
|
251 |
+ |
|
252 |
+for zone in "${ICINGA2_GLOBAL_ZONES[@]}"; do |
|
253 |
+ content_zones+=$(cat << EOF |
|
254 |
+ |
|
255 |
+object Zone "${zone}" { |
|
256 |
+ global = true |
|
257 |
+} |
|
258 |
+EOF |
|
259 |
+) |
|
260 |
+done |
|
261 |
+ |
|
262 |
+content_api="/** Icinga 2 Config - proposed by Icinga Director */ |
|
263 |
+ |
|
264 |
+object ApiListener \"api\" {" |
|
265 |
+ |
|
266 |
+if [ "${ICINGA2_SSLDIR}" = "${ICINGA2_SSLDIR_OLD}" ]; then |
|
267 |
+content_api+=" |
|
268 |
+ cert_path = SysconfDir + \"/icinga2/pki/${ICINGA2_NODENAME}.crt\" |
|
269 |
+ key_path = SysconfDir + \"/icinga2/pki/${ICINGA2_NODENAME}.key\" |
|
270 |
+ ca_path = SysconfDir + \"/icinga2/pki/ca.crt\" |
|
271 |
+" |
|
272 |
+fi |
|
273 |
+content_api+=" |
|
274 |
+ accept_commands = true |
|
275 |
+ accept_config = true |
|
276 |
+} |
|
277 |
+" |
|
278 |
+ |
|
279 |
+if [ -z "${ICINGA2_DRYRUN}" ]; then |
|
280 |
+ install_config "$ICINGA2_CONFIGDIR"/icinga2.conf "$content_config" |
|
281 |
+ install_config "$ICINGA2_CONFIGDIR"/zones.conf "$content_zones" |
|
282 |
+ install_config "$ICINGA2_CONFIGDIR"/features-available/api.conf "$content_api" |
|
283 |
+ |
|
284 |
+ "$ICINGA2_BIN" feature enable api |
|
285 |
+ |
|
286 |
+ "$ICINGA2_BIN" daemon -C |
|
287 |
+ |
|
288 |
+ echo "Please restart icinga2:" |
|
289 |
+ case "$ICINGA2_OSFAMILY" in |
|
290 |
+ debian) |
|
291 |
+ echo " systemctl restart icinga2" |
|
292 |
+ ;; |
|
293 |
+ redhat) |
|
294 |
+ echo " systemctl restart icinga2" |
|
295 |
+ ;; |
|
296 |
+ alpine) |
|
297 |
+ echo " rc-service icinga2 restart" |
|
298 |
+ ;; |
|
299 |
+ *) |
|
300 |
+ fail "Unknown osfamily '$ICINGA2_OSFAMILY'!" |
|
301 |
+ ;; |
|
302 |
+ esac |
|
303 |
+else |
|
304 |
+ output_code() { |
|
305 |
+ sed 's/^/ /m' <<<"$1" |
|
306 |
+ } |
|
307 |
+ echo "### $ICINGA2_CONFIGDIR"/icinga2.conf |
|
308 |
+ echo |
|
309 |
+ output_code "$content_config" |
|
310 |
+ echo |
|
311 |
+ echo "### $ICINGA2_CONFIGDIR"/zones.conf |
|
312 |
+ echo |
|
313 |
+ output_code "$content_zones" |
|
314 |
+ echo |
|
315 |
+ echo "### $ICINGA2_CONFIGDIR"/features-available/api.conf |
|
316 |
+ echo |
|
317 |
+ output_code "$content_api" |
|
318 |
+fi |
|
319 |
+ |
