From 20bdad85962cd73c79db8015ce60101b1eb1e80f Mon Sep 17 00:00:00 2001 From: Thorsten Spille Date: Thu, 24 Jul 2025 22:59:37 +0200 Subject: [PATCH] fix --- src/icinga2/constants-service.conf | 69 ++--- src/icinga2/install-service.sh | 470 +++++++++++------------------ 2 files changed, 193 insertions(+), 346 deletions(-) diff --git a/src/icinga2/constants-service.conf b/src/icinga2/constants-service.conf index 9b581fa..0da0c0f 100644 --- a/src/icinga2/constants-service.conf +++ b/src/icinga2/constants-service.conf @@ -1,62 +1,35 @@ #!/bin/bash -# -# Zamba LXC Toolbox - Service Constants -# Service: icinga-stack -# -# Description: Enthält alle anwendungsspezifischen Konstanten und -# Variablen, die für OS-Upgrades relevant sind. -# -# --- Service Metadata --- -ZAMBA_SERVICE_NAME="Icinga2 Stack mit IcingaDB" -ZAMBA_SERVICE_DESC="Installiert Icinga2, IcingaDB, Icingaweb2, Director, Nginx, MariaDB, Redis, InfluxDB2 und Grafana." -# Tags zur besseren Filterung und Verwaltung des Containers -SERVICE_TAGS="monitoring,icinga,icingadb,grafana,influxdb,nginx,mariadb,redis" +# Authors: +# (C) 2021 Idea an concept by Christian Zengel +# (C) 2021 Script design and prototype by Markus Helmke +# (C) 2021 Script rework and documentation by Thorsten Spille +# This file contains the project constants on service level -# --- LXC Container Configuration --- -# Diese Parameter steuern die Erstellung des LXC Containers durch das Zamba Framework. - -# Debian Version, die als Basis für den Container dient +# Debian Version, which will be installed LXC_TEMPLATE_VERSION="debian-12-standard" -# Erstellt einen unprivilegierten Container für erhöhte Sicherheit -LXC_UNPRIVILEGED="1" - -# Erlaubt das Ausführen von z.B. Docker innerhalb dieses Containers -LXC_NESTING="1" - -# Wird für bestimmte Sicherheits-Features benötigt, hier nicht erforderlich -LXC_KEYCTL="0" - -# Erstellt einen Mountpoint (mp0) für geteilte Dateisysteme -LXC_MP=1 -# Name des ZFS-Dateisystems, das als Mountpoint dient +# Create sharefs mountpoint +LXC_MP=0 +# Defines the mountpoint of the filesystem shared by Zamba inside your LXC container (default: tank) LXC_SHAREFS_MOUNTPOINT="tank" -# Optimierte Recordsize für Datenbanken und kleine Dateien +# Defines the recordsize of mp0 LXC_MP_RECORDSIZE="16K" -# Minimal benötigter Arbeitsspeicher in MB. -# 2048 MB wird für den Betrieb des gesamten Stacks (Icinga, DBs, Grafana) empfohlen. -LXC_MEM_MIN=2048 +# Create unprivileged container +LXC_UNPRIVILEGED="1" +# enable nesting feature +LXC_NESTING="1" -# --- Service-spezifische Konfiguration --- +# enable keyctl feature +LXC_KEYCTL="0" -# Pfad zur Speicherung der generierten Zugangsdaten -CRED_FILE="/root/.zamba_credentials/icinga_stack.txt" +# Sets the minimum amount of RAM the service needs for operation +LXC_MEM_MIN=1024 +# service dependent meta tags +SERVICE_TAGS="php-fpm,nginx,mariadb" -# --- OS-Versions-spezifische Variablen --- -# Diese Variablen müssen bei einem Upgrade des Basis-Betriebssystems -# (z.B. von Debian 12 auf 13) angepasst werden. - -# Der Codename des Betriebssystems (wird für die Repository-Pfade benötigt) -# Dieser Wert wird normalerweise vom Framework (z.B. aus /etc/os-release) bereitgestellt. -# Falls nicht, wird hier ein Fallback gesetzt. -OS_CODENAME="${OS_CODENAME:-bookworm}" - -# Die Standard-PHP-Version für die jeweilige Debian-Version. -# Debian 12 (Bookworm) -> "8.2" -# Debian 13 (Trixie) -> voraussichtlich "8.3" -PHP_VERSION="8.2" +CRED_FILE="/root/.zamba_credentials/icinga_stack.txt" \ No newline at end of file diff --git a/src/icinga2/install-service.sh b/src/icinga2/install-service.sh index c85fc04..8f0ee86 100644 --- a/src/icinga2/install-service.sh +++ b/src/icinga2/install-service.sh @@ -1,10 +1,8 @@ -#!/bin/bash -# -# Zamba LXC Toolbox - Service Installer -# Service: icinga-stack -# -# Description: Führt die Installation und Konfiguration des Icinga2 Stacks mit IcingaDB durch. -# + +source /root/functions.sh +source /root/zamba.conf +source /root/constants-service.conf +source /etc/os-release # --- Internal Helper Functions --- _generate_local_password() { @@ -12,148 +10,80 @@ _generate_local_password() { } -# --- Service Functions (_install, _configure, _setup, _info) --- +curl -fsSL https://packages.icinga.com/icinga.key | gpg --dearmor -o /usr/share/keyrings/icinga-archive-keyring.gpg +echo "deb [signed-by=/usr/share/keyrings/icinga-archive-keyring.gpg] https://packages.icinga.com/debian icinga-$(lsb_release -cs) main" > /etc/apt/sources.list.d/icinga.list -_install() { - echo "" - echo "=================================================" - echo " Phase 1: Installation der Pakete (IcingaDB Edition)" - echo "=================================================" - echo "" - - echo "[INFO] System wird aktualisiert und Basispakete werden installiert." - export DEBIAN_FRONTEND=noninteractive - apt-get update - apt-get install -y wget gpg apt-transport-https curl sudo lsb-release +curl -fsSL https://packages.netways.de/icinga/netways.key | gpg --dearmor -o /usr/share/keyrings/netways-archive-keyring.gpg +echo "deb [signed-by=/usr/share/keyrings/netways-archive-keyring.gpg] https://packages.netways.de/icinga/debian/ icinga-$(lsb_release -cs) main" > /etc/apt/sources.list.d/netways.list - echo "[INFO] Repositories für Icinga, Netways, InfluxDB und Grafana werden hinzugefügt." - # Icinga Repo - if [ ! -f /etc/apt/sources.list.d/icinga.list ]; then - curl -fsSL https://packages.icinga.com/icinga.key | gpg --dearmor -o /usr/share/keyrings/icinga-archive-keyring.gpg - echo "deb [signed-by=/usr/share/keyrings/icinga-archive-keyring.gpg] https://packages.icinga.com/debian icinga-${OS_CODENAME} main" > /etc/apt/sources.list.d/icinga.list - fi +curl -fsSL https://repos.influxdata.com/influxdata-archive_compat.key | gpg --dearmor -o /usr/share/keyrings/influxdata-archive_compat-keyring.gpg +echo "deb [signed-by=/usr/share/keyrings/influxdata-archive_compat-keyring.gpg] https://repos.influxdata.com/debian $(lsb_release -cs) stable" > /etc/apt/sources.list.d/influxdata.list - # Netways Repo for additional modules - if [ ! -f /etc/apt/sources.list.d/netways.list ]; then - curl -fsSL https://packages.netways.de/icinga/netways.key | gpg --dearmor -o /usr/share/keyrings/netways-archive-keyring.gpg - echo "deb [signed-by=/usr/share/keyrings/netways-archive-keyring.gpg] https://packages.netways.de/icinga/debian/ icinga-${OS_CODENAME} main" > /etc/apt/sources.list.d/netways.list - fi +wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor -o /usr/share/keyrings/grafana-archive-keyring.gpg +echo "deb [signed-by=/usr/share/keyrings/grafana-archive-keyring.gpg] https://apt.grafana.com stable main" > /etc/apt/sources.list.d/grafana.list - # InfluxDB Repo - if [ ! -f /etc/apt/sources.list.d/influxdata.list ]; then - curl -fsSL https://repos.influxdata.com/influxdata-archive_compat.key | gpg --dearmor -o /usr/share/keyrings/influxdata-archive_compat-keyring.gpg - echo "deb [signed-by=/usr/share/keyrings/influxdata-archive_compat-keyring.gpg] https://repos.influxdata.com/debian ${OS_CODENAME} stable" > /etc/apt/sources.list.d/influxdata.list - fi +apt update - # Grafana Repo - if [ ! -f /etc/apt/sources.list.d/grafana.list ]; then - wget -q -O - https://apt.grafana.com/gpg.key | gpg --dearmor -o /usr/share/keyrings/grafana-archive-keyring.gpg - echo "deb [signed-by=/usr/share/keyrings/grafana-archive-keyring.gpg] https://apt.grafana.com stable main" > /etc/apt/sources.list.d/grafana.list - fi - - echo "[INFO] Paketlisten werden erneut aktualisiert." - apt-get update +apt-get install -y icinga2 nginx php${PHP_VERSION}-fpm php${PHP_VERSION}-mysql php${PHP_VERSION}-intl php${PHP_VERSION}-xml php${PHP_VERSION}-gd php${PHP_VERSION}-ldap php${PHP_VERSION}-imagick \ + mariadb-server mariadb-client influxdb2 grafana imagemagick icingaweb2 icingacli icinga-php-library icingaweb2-module-reactbundle \ + icinga-director icingadb icingadb-redis icingadb-web icingaweb2-module-perfdatagraphs icingaweb2-module-perfdatagraphs-influxdbv2 - echo "[INFO] Hauptkomponenten werden installiert (PHP Version: ${PHP_VERSION})." - apt-get install -y \ - icinga2 \ - nginx php${PHP_VERSION}-fpm php${PHP_VERSION}-mysql php${PHP_VERSION}-intl php${PHP_VERSION}-xml php${PHP_VERSION}-gd php${PHP_VERSION}-ldap php${PHP_VERSION}-imagick \ - mariadb-server mariadb-client \ - redis-server redis-tools \ - influxdb2 \ - grafana \ - imagemagick \ - icingaweb2 icingacli \ - icinga-php-library \ - icingaweb2-module-reactbundle \ - icinga-director \ - icingadb \ - icingadb-redis \ - icingadb-web \ - icingaweb2-module-perfdatagraphs \ - icingaweb2-module-perfdatagraphs-influxdbv2 -} -_configure() { - echo "" - echo "=================================================" - echo " Phase 2: Konfiguration der Komponenten (IcingaDB Edition)" - echo "=================================================" - echo "" +ICINGAWEB_DB_PASS=$(_generate_local_password 24) +DIRECTOR_DB_PASS=$(_generate_local_password 24) +ICINGA_IDO_DB_PASS=$(_generate_local_password 24) +ICINGA_API_USER_PASS=$(_generate_local_password 24) +ICINGAWEB_ADMIN_PASS=$(_generate_local_password 16) +GRAFANA_ADMIN_PASS=$(_generate_local_password 16) +INFLUX_ADMIN_TOKEN=$(_generate_local_password 40) - # 1. Passwörter generieren - echo "[INFO] Passwörter und API-Keys werden generiert." - ICINGAWEB_DB_PASS=$(_generate_local_password 24) - DIRECTOR_DB_PASS=$(_generate_local_password 24) - ICINGADB_PASS=$(_generate_local_password 24) - ICINGA_API_USER_PASS=$(_generate_local_password 24) - ICINGAWEB_ADMIN_PASS=$(_generate_local_password 16) - GRAFANA_ADMIN_PASS=$(_generate_local_password 16) - INFLUX_ADMIN_TOKEN=$(_generate_local_password 40) - - # 2. MariaDB konfigurieren - echo "[INFO] MariaDB wird konfiguriert." - # Ensure MariaDB is running for configuration - systemctl start mariadb - while ! mysqladmin ping -h localhost --silent; do sleep 1; done - - mysql -e "CREATE DATABASE IF NOT EXISTS icingaweb2 CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" - mysql -e "CREATE DATABASE IF NOT EXISTS director CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" - mysql -e "CREATE DATABASE IF NOT EXISTS icingadb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" - - mysql -e "CREATE USER IF NOT EXISTS 'icingaweb2'@'localhost' IDENTIFIED BY '${ICINGAWEB_DB_PASS}';" - mysql -e "CREATE USER IF NOT EXISTS 'director'@'localhost' IDENTIFIED BY '${DIRECTOR_DB_PASS}';" - mysql -e "CREATE USER IF NOT EXISTS 'icingadb'@'localhost' IDENTIFIED BY '${ICINGADB_PASS}';" +systemctl start mariadb +while ! mysqladmin ping -h localhost --silent; do sleep 1; done - mysql -e "GRANT ALL PRIVILEGES ON icingaweb2.* TO 'icingaweb2'@'localhost';" - mysql -e "GRANT ALL PRIVILEGES ON director.* TO 'director'@'localhost';" - mysql -e "GRANT ALL PRIVILEGES ON icingadb.* TO 'icingadb'@'localhost';" - mysql -e "FLUSH PRIVILEGES;" +mysql -e "CREATE DATABASE IF NOT EXISTS icingaweb2 CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" +mysql -e "CREATE DATABASE IF NOT EXISTS director CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" +mysql -e "CREATE DATABASE IF NOT EXISTS icinga_ido CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" - # 3. Redis konfigurieren - echo "[INFO] Erstelle systemd-Override für Redis-Server." - mkdir -p /etc/systemd/system/redis-server.service.d - bash -c "cat > /etc/systemd/system/redis-server.service.d/override.conf" <&2; exit 1; fi +mysql -e "CREATE USER IF NOT EXISTS 'icingaweb2'@'localhost' IDENTIFIED BY '${ICINGAWEB_DB_PASS}';" +mysql -e "CREATE USER IF NOT EXISTS 'director'@'localhost' IDENTIFIED BY '${DIRECTOR_DB_PASS}';" +mysql -e "CREATE USER IF NOT EXISTS 'icinga_ido'@'localhost' IDENTIFIED BY '${ICINGA_IDO_DB_PASS}';" - # 5. Credentials-Datei schreiben - echo "[INFO] Zugangsdaten werden in ${CRED_FILE} gespeichert." - mkdir -p "$(dirname "$CRED_FILE")" && chmod 700 "$(dirname "$CRED_FILE")" - { - echo "# --- Icinga Monitoring Stack Credentials ---" - echo "URL: https://${ZAMBA_HOSTNAME:-$(hostname -f)}/icingaweb2; Benutzer: icingaadmin; Passwort: ${ICINGAWEB_ADMIN_PASS}" - echo "URL: https://${ZAMBA_HOSTNAME:-$(hostname -f)}/grafana; Benutzer: admin; Passwort: ${GRAFANA_ADMIN_PASS}" - echo "InfluxDB Admin Token: ${INFLUX_ADMIN_TOKEN}" - echo "Icinga Director API: Benutzer: director; Passwort: ${ICINGA_API_USER_PASS}" - } > "$CRED_FILE" && chmod 600 "$CRED_FILE" +mysql -e "GRANT ALL PRIVILEGES ON icingaweb2.* TO 'icingaweb2'@'localhost';" +mysql -e "GRANT ALL PRIVILEGES ON director.* TO 'director'@'localhost';" +mysql -e "GRANT ALL PRIVILEGES ON icinga_ido.* TO 'icinga_ido'@'localhost';" +mysql -e "FLUSH PRIVILEGES;" - # 6. Icinga2 Konfigurationsdateien schreiben - echo "[INFO] Icinga2 Konfigurationsdateien werden geschrieben." - bash -c "cat > /etc/icinga2/features-available/icingadb.conf" <&2; exit 1; fi + + +mkdir -p "$(dirname "$CRED_FILE")" && chmod 700 "$(dirname "$CRED_FILE")" +{ + echo "# --- Icinga Monitoring Stack Credentials ---" + echo "URL: https://${ZAMBA_HOSTNAME:-$(hostname -f)}/icingaweb2; Benutzer: icingaadmin; Passwort: ${ICINGAWEB_ADMIN_PASS}" + echo "URL: https://${ZAMBA_HOSTNAME:-$(hostname -f)}/grafana; Benutzer: admin; Passwort: ${GRAFANA_ADMIN_PASS}" + echo "InfluxDB Admin Token: ${INFLUX_ADMIN_TOKEN}" + echo "Icinga Director API: Benutzer: director; Passwort: ${ICINGA_API_USER_PASS}" +} > "$CRED_FILE" && chmod 600 "$CRED_FILE" + +systemctl enable --now icingadb-redis +bash -c "cat > /etc/icinga2/features-available/icingadb.conf" < /etc/icinga2/conf.d/api-users.conf" < /etc/icinga2/conf.d/api-users.conf" < /etc/icinga2/features-available/influxdb2-writer.conf" < /etc/icinga2/features-available/influxdb2-writer.conf" < /etc/icinga2/zones.conf" < /etc/icingadb/config.yml" < /etc/icingadb/config.yml" < /etc/icingaweb2/resources.ini" < /etc/grafana/provisioning/datasources/influxdb.yaml" < /etc/grafana/provisioning/datasources/influxdb.yaml" < /etc/nginx/sites-available/icinga-stack" < /etc/nginx/sites-available/icinga-stack" <&2; exit 1; fi +if [ ! -f "$DIRECTOR_SCHEMA" ]; then echo "[ERROR] Director-Schema nicht gefunden: $DIRECTOR_SCHEMA" >&2; exit 1; fi +if [ ! -f "$ICINGADB_SCHEMA" ]; then echo "[ERROR] IcingaDB-Schema nicht gefunden: $ICINGADB_SCHEMA" >&2; exit 1; fi - if [ ! -f "$IWEB_SCHEMA" ]; then echo "[ERROR] IcingaWeb-Schema nicht gefunden: $IWEB_SCHEMA" >&2; exit 1; fi - if [ ! -f "$DIRECTOR_SCHEMA" ]; then echo "[ERROR] Director-Schema nicht gefunden: $DIRECTOR_SCHEMA" >&2; exit 1; fi - if [ ! -f "$ICINGADB_SCHEMA" ]; then echo "[ERROR] IcingaDB-Schema nicht gefunden: $ICINGADB_SCHEMA" >&2; exit 1; fi - if ! mysql -e "use icingaweb2; show tables;" | grep -q "icingaweb_user"; then - echo "[INFO] Importiere IcingaWeb2-Schema..." - mysql icingaweb2 < "$IWEB_SCHEMA" - fi - - if ! mysql -e "use director; show tables;" | grep -q "director_datafield"; then - echo "[INFO] Importiere Icinga Director-Schema..." - mysql director < "$DIRECTOR_SCHEMA" - fi - - if ! mysql -e "use icingadb; show tables;" | grep -q "icingadb_schema_migration"; then - echo "[INFO] Importiere IcingaDB-Schema..." - mysql icingadb < "$ICINGADB_SCHEMA" - fi - - echo "[INFO] Icinga2 Features werden aktiviert." - icinga2 feature enable icingadb api influxdb2-writer >/dev/null +if ! mysql -e "use icingaweb2; show tables;" | grep -q "icingaweb_user"; then + echo "[INFO] Importiere IcingaWeb2-Schema..." + mysql icingaweb2 < "$IWEB_SCHEMA" +fi - echo "[INFO] Erstelle Icinga Web 2 Kernkonfiguration." - bash -c "cat > /etc/icingaweb2/config.ini" < /etc/icingaweb2/config.ini" < /etc/icingaweb2/authentication.ini" < /etc/icingaweb2/authentication.ini" < /etc/icingaweb2/roles.ini" < /etc/icingaweb2/roles.ini" < /etc/icingaweb2/modules/monitoring/backends.ini" < /etc/icingaweb2/modules/monitoring/backends.ini" < /etc/icingaweb2/modules/director/config.ini" < /etc/icingaweb2/modules/director/config.ini" < /etc/icingaweb2/modules/perfdatagraphs/config.ini" < /etc/icingaweb2/modules/perfdatagraphs/config.ini" </dev/null 2>&1; do - counter=$((counter + 1)) - if [ "$counter" -gt 15 ]; then - echo "[ERROR] Icinga Director wurde nach 30 Sekunden nicht bereit." >&2 - exit 1 - fi - echo "[INFO] Director ist noch nicht bereit, warte 2 Sekunden... (Versuch ${counter}/15)" - sleep 2 - done - echo "[INFO] Icinga Director ist bereit." +echo "[INFO] Füge Icinga Web 2 Admin-Benutzer direkt in die Datenbank ein." +PASSWORD_HASH=$(php -r "echo password_hash('${ICINGAWEB_ADMIN_PASS}', PASSWORD_BCRYPT);") +mysql icingaweb2 -e "INSERT INTO icingaweb_user (name, active, password_hash) VALUES ('icingaadmin', 1, '${PASSWORD_HASH}') ON DUPLICATE KEY UPDATE password_hash='${PASSWORD_HASH}';" - echo "[INFO] Icinga Director Setup wird ausgeführt." - bash -c "cat > /etc/icingaweb2/modules/director/kickstart.ini" </dev/null 2>&1; do + counter=$((counter + 1)) + if [ "$counter" -gt 15 ]; then + echo "[ERROR] Icinga Director wurde nach 30 Sekunden nicht bereit." >&2 + exit 1 + fi + echo "[INFO] Director ist noch nicht bereit, warte 2 Sekunden... (Versuch ${counter}/15)" + sleep 2 +done +echo "[INFO] Icinga Director ist bereit." + +echo "[INFO] Icinga Director Setup wird ausgeführt." +bash -c "cat > /etc/icingaweb2/modules/director/kickstart.ini" <