| ... |
... |
@@ -1,319 +1,0 @@ |
| 1 |
|
-#!/bin/bash |
| 2 |
|
- |
| 3 |
|
-# This generates and signs your required certificates. Please do not |
| 4 |
|
-# forget to install the Icinga 2 package and your desired monitoring |
| 5 |
|
-# plugins first. |
| 6 |
|
- |
| 7 |
|
-# Config from Director |
| 8 |
|
-ICINGA2_NODENAME='private-cloud-taunusstein-master' |
| 9 |
|
-ICINGA2_CA_TICKET='c892a4ef8afe567e67db5beaf363f8c9b498a7ad' |
| 10 |
|
-ICINGA2_PARENT_ZONE='monitoring-sat-fsn02.xima-services.de' |
| 11 |
|
-ICINGA2_PARENT_ENDPOINTS=('monitoring-sat-fsn02.xima-services.de,monitoring-sat-fsn02.xima-services.de') |
| 12 |
|
-ICINGA2_CA_NODE='monitoring.xima-services.de' |
| 13 |
|
-ICINGA2_GLOBAL_ZONES=('director-global') |
| 14 |
|
- |
| 15 |
|
-# Internal defaults |
| 16 |
|
-: "${ICINGA2_OSFAMILY:=}" |
| 17 |
|
-: "${ICINGA2_HOSTNAME:="$(hostname -f)"}" |
| 18 |
|
-: "${ICINGA2_NODENAME:="${ICINGA2_HOSTNAME}"}" |
| 19 |
|
-: "${ICINGA2_CA_NODE:=}" |
| 20 |
|
-: "${ICINGA2_CA_PORT:=5665}" |
| 21 |
|
-: "${ICINGA2_CA_TICKET:=}" |
| 22 |
|
-: "${ICINGA2_PARENT_ZONE:=master}" |
| 23 |
|
-: "${ICINGA2_PARENT_ENDPOINTS:=()}" |
| 24 |
|
-: "${ICINGA2_GLOBAL_ZONES:=director-global}" |
| 25 |
|
-: "${ICINGA2_DRYRUN:=}" |
| 26 |
|
-: "${ICINGA2_UPDATE_CONFIG:=}" |
| 27 |
|
- |
| 28 |
|
-# Helper functions |
| 29 |
|
-fail() { |
| 30 |
|
- echo "ERROR: $1" >&2 |
| 31 |
|
- exit 1 |
| 32 |
|
-} |
| 33 |
|
- |
| 34 |
|
-warn() { |
| 35 |
|
- echo "WARNING: $1" >&2 |
| 36 |
|
-} |
| 37 |
|
- |
| 38 |
|
-info() { |
| 39 |
|
- echo "INFO: $1" >&2 |
| 40 |
|
-} |
| 41 |
|
- |
| 42 |
|
-check_command() { |
| 43 |
|
- command -v "$@" &>/dev/null |
| 44 |
|
-} |
| 45 |
|
- |
| 46 |
|
-install_config() { |
| 47 |
|
- if [ -e "$1" ] && [ ! -e "${1}.orig" ]; then |
| 48 |
|
- info "Creating a backup at ${1}.orig" |
| 49 |
|
- cp "$1" "${1}.orig" |
| 50 |
|
- fi |
| 51 |
|
- echo "Writing config to ${1}" |
| 52 |
|
- echo "$2" > "${1}" |
| 53 |
|
-} |
| 54 |
|
- |
| 55 |
|
-[ "$BASH_VERSION" ] || fail "This is a Bash script" |
| 56 |
|
- |
| 57 |
|
-errors= |
| 58 |
|
-for key in NODENAME CA_NODE CA_PORT CA_TICKET PARENT_ZONE PARENT_ENDPOINTS; do |
| 59 |
|
- var="ICINGA2_${key}" |
| 60 |
|
- if [ -z "${!var}" ]; then |
| 61 |
|
- warn "The variable $var needs to be configured!" |
| 62 |
|
- errors+=1 |
| 63 |
|
- fi |
| 64 |
|
-done |
| 65 |
|
-[ -z "$errors" ] || exit 1 |
| 66 |
|
- |
| 67 |
|
-# Detect osfamily |
| 68 |
|
-if [ -n "$ICINGA2_OSFAMILY" ]; then |
| 69 |
|
- info "Assuming supplied osfamily $ICINGA2_OSFAMILY" |
| 70 |
|
-elif check_command rpm && ! check_command dpkg; then |
| 71 |
|
- info "This should be a RedHat system" |
| 72 |
|
- if [ -e /etc/sysconfig/icinga2 ]; then |
| 73 |
|
- # shellcheck disable=SC1091 |
| 74 |
|
- . /etc/sysconfig/icinga2 |
| 75 |
|
- fi |
| 76 |
|
- ICINGA2_OSFAMILY=redhat |
| 77 |
|
-elif check_command dpkg; then |
| 78 |
|
- info "This should be a Debian system" |
| 79 |
|
- if [ -e /etc/default/icinga2 ]; then |
| 80 |
|
- # shellcheck disable=SC1091 |
| 81 |
|
- . /etc/default/icinga2 |
| 82 |
|
- fi |
| 83 |
|
- ICINGA2_OSFAMILY=debian |
| 84 |
|
-elif check_command apk; then |
| 85 |
|
- info "This should be a Alpine system" |
| 86 |
|
- if [ -e /etc/icinga2/icinga2.sysconfig ]; then |
| 87 |
|
- # shellcheck disable=SC1091 |
| 88 |
|
- . /etc/icinga2/icinga2.sysconfig |
| 89 |
|
- fi |
| 90 |
|
- ICINGA2_OSFAMILY=alpine |
| 91 |
|
-else |
| 92 |
|
- fail "Could not determine your os type!" |
| 93 |
|
-fi |
| 94 |
|
- |
| 95 |
|
-# internal defaults |
| 96 |
|
-: "${ICINGA2_CONFIG_FILE:=/etc/icinga2/icinga2.conf}" |
| 97 |
|
-: "${ICINGA2_CONFIGDIR:="$(dirname "$ICINGA2_CONFIG_FILE")"}" |
| 98 |
|
-: "${ICINGA2_DATADIR:=/var/lib/icinga2}" |
| 99 |
|
-: "${ICINGA2_SSLDIR_OLD:="${ICINGA2_CONFIGDIR}"/pki}" |
| 100 |
|
-: "${ICINGA2_SSLDIR_NEW:="${ICINGA2_DATADIR}"/certs}" |
| 101 |
|
-: "${ICINGA2_SSLDIR:=}" |
| 102 |
|
-: "${ICINGA2_BIN:=icinga2}" |
| 103 |
|
- |
| 104 |
|
-case "$ICINGA2_OSFAMILY" in |
| 105 |
|
-debian) |
| 106 |
|
- : "${ICINGA2_USER:=nagios}" |
| 107 |
|
- : "${ICINGA2_GROUP:=nagios}" |
| 108 |
|
- ;; |
| 109 |
|
-redhat) |
| 110 |
|
- : "${ICINGA2_USER:=icinga}" |
| 111 |
|
- : "${ICINGA2_GROUP:=icinga}" |
| 112 |
|
- ;; |
| 113 |
|
-alpine) |
| 114 |
|
- : "${ICINGA2_USER:=icinga}" |
| 115 |
|
- : "${ICINGA2_GROUP:=icinga}" |
| 116 |
|
- ;; |
| 117 |
|
-*) |
| 118 |
|
- fail "Unknown osfamily '$ICINGA2_OSFAMILY'!" |
| 119 |
|
- ;; |
| 120 |
|
-esac |
| 121 |
|
- |
| 122 |
|
-icinga_version() { |
| 123 |
|
- "$ICINGA2_BIN" --version 2>/dev/null | grep -oPi '\(version: [rv]?\K\d+\.\d+\.\d+[^\)]*' |
| 124 |
|
-} |
| 125 |
|
- |
| 126 |
|
-version() { |
| 127 |
|
- echo "$@" | awk -F. '{ printf("%03d%03d%03d\n", $1,$2,$3); }' |
| 128 |
|
-} |
| 129 |
|
- |
| 130 |
|
-# Make sure icinga2 is installed and running |
| 131 |
|
-echo -n "check: icinga2 installed - " |
| 132 |
|
-if version=$(icinga_version); then |
| 133 |
|
- echo "OK: $version" |
| 134 |
|
-else |
| 135 |
|
- fail "You need to install icinga2!" |
| 136 |
|
-fi |
| 137 |
|
- |
| 138 |
|
-if [ -z "${ICINGA2_SSLDIR}" ]; then |
| 139 |
|
- if [ -f "${ICINGA2_SSLDIR_OLD}/${ICINGA2_NODENAME}.crt" ]; then |
| 140 |
|
- info "Using old SSL directory: ${ICINGA2_SSLDIR_OLD}" |
| 141 |
|
- info "Because you already have a certificate in ${ICINGA2_SSLDIR_OLD}/${ICINGA2_NODENAME}.crt" |
| 142 |
|
- ICINGA2_SSLDIR="${ICINGA2_SSLDIR_OLD}" |
| 143 |
|
- elif [ $(version $version) -gt $(version 2.8) ]; then |
| 144 |
|
- info "Using new SSL directory: ${ICINGA2_SSLDIR_NEW}" |
| 145 |
|
- ICINGA2_SSLDIR="${ICINGA2_SSLDIR_NEW}" |
| 146 |
|
- else |
| 147 |
|
- info "Using old SSL directory: ${ICINGA2_SSLDIR_OLD}" |
| 148 |
|
- ICINGA2_SSLDIR="${ICINGA2_SSLDIR_OLD}" |
| 149 |
|
- fi |
| 150 |
|
-fi |
| 151 |
|
- |
| 152 |
|
-if [ ! -d "$ICINGA2_SSLDIR" ]; then |
| 153 |
|
- mkdir "$ICINGA2_SSLDIR" |
| 154 |
|
- chown "$ICINGA2_USER.$ICINGA2_GROUP" "$ICINGA2_SSLDIR" |
| 155 |
|
-fi |
| 156 |
|
- |
| 157 |
|
-if [ -f "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" ]; then |
| 158 |
|
- warn "ERROR: a certificate for '${ICINGA2_NODENAME}' already exists" |
| 159 |
|
- warn "Please remove ${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.??? in case you want a" |
| 160 |
|
- warn "new certificate to be generated and signed by ${ICINGA2_CA_NODE}" |
| 161 |
|
- |
| 162 |
|
- if [ -z "${ICINGA2_UPDATE_CONFIG}" ] && [ -z "${ICINGA2_DRYRUN}" ]; then |
| 163 |
|
- warn "Aborting here, you can can call the script like this to just update config:" |
| 164 |
|
- info " ICINGA2_UPDATE_CONFIG=1 $0" |
| 165 |
|
- exit 1 |
| 166 |
|
- fi |
| 167 |
|
-elif [ -z "${ICINGA2_DRYRUN}" ]; then |
| 168 |
|
- if ! "$ICINGA2_BIN" pki new-cert --cn "${ICINGA2_NODENAME}" \ |
| 169 |
|
- --cert "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" \ |
| 170 |
|
- --csr "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.csr" \ |
| 171 |
|
- --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key" |
| 172 |
|
- then fail "Could not create self signed certificate!" |
| 173 |
|
- fi |
| 174 |
|
- |
| 175 |
|
- if ! "$ICINGA2_BIN" pki save-cert \ |
| 176 |
|
- --host "${ICINGA2_CA_NODE}" \ |
| 177 |
|
- --port "${ICINGA2_CA_PORT}" \ |
| 178 |
|
- --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key" \ |
| 179 |
|
- --trustedcert "${ICINGA2_SSLDIR}/trusted-master.crt" |
| 180 |
|
- then fail "Could not retrieve trusted certificate from host ${ICINGA2_CA_NODE}" |
| 181 |
|
- fi |
| 182 |
|
- |
| 183 |
|
- if ! "$ICINGA2_BIN" pki request \ |
| 184 |
|
- --host "${ICINGA2_CA_NODE}" \ |
| 185 |
|
- --port "${ICINGA2_CA_PORT}" \ |
| 186 |
|
- --ticket "${ICINGA2_CA_TICKET}" \ |
| 187 |
|
- --key "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.key" \ |
| 188 |
|
- --cert "${ICINGA2_SSLDIR}/${ICINGA2_NODENAME}.crt" \ |
| 189 |
|
- --trustedcert "${ICINGA2_SSLDIR}/trusted-master.crt" \ |
| 190 |
|
- --ca "${ICINGA2_SSLDIR}/ca.crt" |
| 191 |
|
- then fail "Could not retrieve final certificate from host ${ICINGA2_CA_NODE}" |
| 192 |
|
- fi |
| 193 |
|
-else |
| 194 |
|
- info "Would create certificates under ${ICINGA2_SSLDIR}, but in dry-run!" |
| 195 |
|
-fi |
| 196 |
|
- |
| 197 |
|
-# Prepare Config Files |
| 198 |
|
-content_config=$(cat << EOF |
| 199 |
|
-/** Icinga 2 Config - proposed by Icinga Director */ |
| 200 |
|
- |
| 201 |
|
-include "constants.conf" |
| 202 |
|
- |
| 203 |
|
-$([ "${ICINGA2_HOSTNAME}" != "${ICINGA2_NODENAME}" ] || echo '// ')const NodeName = "${ICINGA2_NODENAME}" |
| 204 |
|
- |
| 205 |
|
-include "zones.conf" |
| 206 |
|
-include "features-enabled/*.conf" |
| 207 |
|
- |
| 208 |
|
-include <itl> |
| 209 |
|
-include <plugins> |
| 210 |
|
-include <plugins-contrib> |
| 211 |
|
-include <manubulon> |
| 212 |
|
-include <windows-plugins> |
| 213 |
|
-include <nscp> |
| 214 |
|
-EOF |
| 215 |
|
-) |
| 216 |
|
- |
| 217 |
|
-endpoint_list='' |
| 218 |
|
-for item in "${ICINGA2_PARENT_ENDPOINTS[@]}"; do |
| 219 |
|
- endpoint=$(echo "$item" | cut -d, -f1) |
| 220 |
|
- endpoint_list+="\"${endpoint}\", " |
| 221 |
|
-done |
| 222 |
|
- |
| 223 |
|
-content_zones=$(cat << EOF |
| 224 |
|
-/** Icinga 2 Config - proposed by Icinga Director */ |
| 225 |
|
- |
| 226 |
|
-object Endpoint "${ICINGA2_NODENAME}" {} |
| 227 |
|
- |
| 228 |
|
-object Zone "${ICINGA2_NODENAME}" { |
| 229 |
|
- parent = "${ICINGA2_PARENT_ZONE}" |
| 230 |
|
- endpoints = [ "${ICINGA2_NODENAME}" ] |
| 231 |
|
-} |
| 232 |
|
- |
| 233 |
|
-object Zone "${ICINGA2_PARENT_ZONE}" { |
| 234 |
|
- endpoints = [ ${endpoint_list%, } ] |
| 235 |
|
-} |
| 236 |
|
-EOF |
| 237 |
|
-) |
| 238 |
|
- |
| 239 |
|
-for item in "${ICINGA2_PARENT_ENDPOINTS[@]}"; do |
| 240 |
|
- endpoint=$(echo "$item" | cut -d, -f1) |
| 241 |
|
- host=$(echo "$item" | cut -s -d, -f2) |
| 242 |
|
- |
| 243 |
|
- content_zones+=$(cat << EOF |
| 244 |
|
- |
| 245 |
|
-object Endpoint "${endpoint}" { |
| 246 |
|
-$([ -n "$host" ] && echo " host = \"${host}\"" || echo " //host = \"${endpoint}\"") |
| 247 |
|
-} |
| 248 |
|
-EOF |
| 249 |
|
-) |
| 250 |
|
-done |
| 251 |
|
- |
| 252 |
|
-for zone in "${ICINGA2_GLOBAL_ZONES[@]}"; do |
| 253 |
|
- content_zones+=$(cat << EOF |
| 254 |
|
- |
| 255 |
|
-object Zone "${zone}" { |
| 256 |
|
- global = true |
| 257 |
|
-} |
| 258 |
|
-EOF |
| 259 |
|
-) |
| 260 |
|
-done |
| 261 |
|
- |
| 262 |
|
-content_api="/** Icinga 2 Config - proposed by Icinga Director */ |
| 263 |
|
- |
| 264 |
|
-object ApiListener \"api\" {" |
| 265 |
|
- |
| 266 |
|
-if [ "${ICINGA2_SSLDIR}" = "${ICINGA2_SSLDIR_OLD}" ]; then |
| 267 |
|
-content_api+=" |
| 268 |
|
- cert_path = SysconfDir + \"/icinga2/pki/${ICINGA2_NODENAME}.crt\" |
| 269 |
|
- key_path = SysconfDir + \"/icinga2/pki/${ICINGA2_NODENAME}.key\" |
| 270 |
|
- ca_path = SysconfDir + \"/icinga2/pki/ca.crt\" |
| 271 |
|
-" |
| 272 |
|
-fi |
| 273 |
|
-content_api+=" |
| 274 |
|
- accept_commands = true |
| 275 |
|
- accept_config = true |
| 276 |
|
-} |
| 277 |
|
-" |
| 278 |
|
- |
| 279 |
|
-if [ -z "${ICINGA2_DRYRUN}" ]; then |
| 280 |
|
- install_config "$ICINGA2_CONFIGDIR"/icinga2.conf "$content_config" |
| 281 |
|
- install_config "$ICINGA2_CONFIGDIR"/zones.conf "$content_zones" |
| 282 |
|
- install_config "$ICINGA2_CONFIGDIR"/features-available/api.conf "$content_api" |
| 283 |
|
- |
| 284 |
|
- "$ICINGA2_BIN" feature enable api |
| 285 |
|
- |
| 286 |
|
- "$ICINGA2_BIN" daemon -C |
| 287 |
|
- |
| 288 |
|
- echo "Please restart icinga2:" |
| 289 |
|
- case "$ICINGA2_OSFAMILY" in |
| 290 |
|
- debian) |
| 291 |
|
- echo " systemctl restart icinga2" |
| 292 |
|
- ;; |
| 293 |
|
- redhat) |
| 294 |
|
- echo " systemctl restart icinga2" |
| 295 |
|
- ;; |
| 296 |
|
- alpine) |
| 297 |
|
- echo " rc-service icinga2 restart" |
| 298 |
|
- ;; |
| 299 |
|
- *) |
| 300 |
|
- fail "Unknown osfamily '$ICINGA2_OSFAMILY'!" |
| 301 |
|
- ;; |
| 302 |
|
- esac |
| 303 |
|
-else |
| 304 |
|
- output_code() { |
| 305 |
|
- sed 's/^/ /m' <<<"$1" |
| 306 |
|
- } |
| 307 |
|
- echo "### $ICINGA2_CONFIGDIR"/icinga2.conf |
| 308 |
|
- echo |
| 309 |
|
- output_code "$content_config" |
| 310 |
|
- echo |
| 311 |
|
- echo "### $ICINGA2_CONFIGDIR"/zones.conf |
| 312 |
|
- echo |
| 313 |
|
- output_code "$content_zones" |
| 314 |
|
- echo |
| 315 |
|
- echo "### $ICINGA2_CONFIGDIR"/features-available/api.conf |
| 316 |
|
- echo |
| 317 |
|
- output_code "$content_api" |
| 318 |
|
-fi |
| 319 |
|
- |