]>
Commit | Line | Data |
---|---|---|
e820134d | 1 | { config, pkgs, lib, name, nodes, ... }: |
3bc32d9e | 2 | let |
e820134d | 3 | cfg = config.myServices.monitoring; |
71a2425e IB |
4 | send_mails = pkgs.runCommand "send_mails" { |
5 | buildInputs = [ pkgs.makeWrapper ]; | |
6 | } '' | |
7 | mkdir -p $out/bin | |
8 | cp ${./send_mails} $out/bin/send_mails | |
9 | patchShebangs $out | |
10 | wrapProgram $out/bin/send_mails --prefix PATH : ${lib.makeBinPath [ | |
11 | pkgs.mailutils | |
12 | ]} | |
13 | ''; | |
3bc32d9e IB |
14 | myplugins = pkgs.runCommand "buildplugins" { |
15 | buildInputs = [ pkgs.makeWrapper pkgs.perl ]; | |
16 | } '' | |
17 | mkdir $out | |
18 | cp ${./plugins}/* $out/ | |
19 | patchShebangs $out | |
20 | wrapProgram $out/check_command --prefix PATH : ${config.security.wrapperDir} | |
21 | wrapProgram $out/send_nrdp.sh --prefix PATH : ${lib.makeBinPath [ | |
b11f0e17 | 22 | pkgs.curl pkgs.jq |
3bc32d9e | 23 | ]} |
e820134d IB |
24 | wrapProgram $out/check_maison_bbc --prefix PATH : ${lib.makeBinPath [ |
25 | pkgs.curl pkgs.jq | |
26 | ]} | |
3bc32d9e IB |
27 | wrapProgram $out/check_mem.sh --prefix PATH : ${lib.makeBinPath [ |
28 | pkgs.gnugrep pkgs.gawk pkgs.procps-ng | |
29 | ]} | |
9f202523 IB |
30 | wrapProgram $out/check_postgres_replication --prefix PATH : ${lib.makeBinPath [ |
31 | pkgs.postgresql | |
32 | ]} | |
6015a3b5 IB |
33 | wrapProgram $out/check_redis_replication --prefix PATH : ${lib.makeBinPath [ |
34 | pkgs.gnugrep pkgs.coreutils pkgs.redis | |
35 | ]} | |
36 | wrapProgram $out/check_mysql_replication --prefix PATH : ${lib.makeBinPath [ | |
37 | pkgs.gnugrep pkgs.gnused pkgs.coreutils pkgs.mariadb | |
38 | ]} | |
16b80abd IB |
39 | wrapProgram $out/check_openldap_replication --prefix PATH : ${lib.makeBinPath [ |
40 | pkgs.gnugrep pkgs.gnused pkgs.coreutils pkgs.openldap | |
41 | ]} | |
71a2425e IB |
42 | wrapProgram $out/check_emails --prefix PATH : ${lib.makeBinPath [ |
43 | pkgs.openssh send_mails | |
44 | ]} --prefix PERL5LIB : ${pkgs.perlPackages.makePerlPath [ | |
45 | pkgs.perlPackages.TimeDate | |
46 | ]} | |
e820134d IB |
47 | wrapProgram $out/check_ftp_database --prefix PATH : ${lib.makeBinPath [ |
48 | pkgs.lftp | |
49 | ]} | |
50 | wrapProgram $out/check_git --prefix PATH : ${lib.makeBinPath [ | |
51 | pkgs.git pkgs.openssh | |
52 | ]} | |
53 | wrapProgram $out/check_imap_connection --prefix PATH : ${lib.makeBinPath [ | |
54 | pkgs.openssl | |
55 | ]} | |
25844101 IB |
56 | wrapProgram $out/check_eriomem --prefix PATH : ${lib.makeBinPath [ |
57 | pkgs.s3cmd pkgs.python3 | |
58 | ]} | |
e820134d IB |
59 | wrapProgram $out/notify_maison_bbc_by_email --prefix PATH : ${lib.makeBinPath [ |
60 | pkgs.mailutils pkgs.gawk | |
61 | ]} | |
62 | wrapProgram $out/notify_by_email --prefix PATH : ${lib.makeBinPath [ | |
63 | pkgs.mailutils | |
64 | ]} | |
65 | wrapProgram $out/notify_by_slack --prefix PATH : ${lib.makeBinPath [ | |
66 | pkgs.curl pkgs.jq | |
67 | ]} | |
6191bdeb IB |
68 | wrapProgram $out/check_ovh_sms --prefix PATH : ${lib.makeBinPath [ |
69 | (pkgs.python3.withPackages (ps: [ps.ovh])) | |
70 | ]} | |
3bc32d9e | 71 | ''; |
eb071dd4 IB |
72 | toObjects = pkgs.callPackage ./to_objects.nix {}; |
73 | commonConfig = { | |
74 | eldiron = { | |
75 | processWarn = "250"; processAlert = "400"; | |
76 | loadWarn = "8.0"; loadAlert = "10.0"; | |
77 | }; | |
78 | backup-2 = { | |
25844101 | 79 | processWarn = "60"; processAlert = "70"; |
eb071dd4 IB |
80 | loadWarn = "1.0"; loadAlert = "2.0"; |
81 | }; | |
e820134d IB |
82 | monitoring-1 = { |
83 | processWarn = "50"; processAlert = "60"; | |
84 | loadWarn = "1.0"; loadAlert = "2.0"; | |
85 | }; | |
eb071dd4 | 86 | }; |
e820134d | 87 | masterPassiveObjects = let |
e820134d IB |
88 | passiveNodes = lib.attrsets.filterAttrs (n: _: builtins.elem n ["backup-2" "eldiron"]) nodes; |
89 | toPassiveServices = map (s: s.passiveInfo.filter s // s.passiveInfo); | |
90 | passiveServices = lib.flatten (lib.attrsets.mapAttrsToList | |
91 | (_: n: toPassiveServices n.config.myServices.monitoring.services) | |
92 | passiveNodes | |
93 | ); | |
94 | in { | |
71a2425e | 95 | service = passiveServices; |
e820134d IB |
96 | host = lib.lists.foldr |
97 | (a: b: a//b) | |
98 | {} | |
71a2425e | 99 | (lib.attrsets.mapAttrsToList (_: h: h.config.myServices.monitoring.hosts) passiveNodes); |
e820134d | 100 | }; |
71a2425e IB |
101 | emailCheck = host: hostFQDN: let |
102 | allCfg = config.myEnv.monitoring.email_check; | |
103 | cfg = allCfg."${host}"; | |
104 | reverseTargets = builtins.attrNames (lib.attrsets.filterAttrs (k: v: builtins.elem host v.targets) allCfg); | |
105 | to_email = cfg': host': | |
106 | let sep = if lib.strings.hasInfix "+" cfg'.mail_address then "_" else "+"; | |
107 | in "${cfg'.mail_address}${sep}${host'}@${cfg'.mail_domain}"; | |
108 | mails_to_send = builtins.concatStringsSep "," (map (n: to_email allCfg."${n}" host) cfg.targets); | |
109 | mails_to_receive = builtins.concatStringsSep "," (map (n: "${to_email cfg n}:${n}") reverseTargets); | |
110 | command = if cfg.local | |
111 | then | |
112 | [ "check_emails_local" "/var/lib/naemon/checks/email" mails_to_send mails_to_receive ] | |
113 | else | |
114 | [ "check_emails" cfg.login cfg.port mails_to_send mails_to_receive ]; | |
115 | in | |
116 | { | |
117 | service_description = "${hostFQDN} email service is active"; | |
118 | use = "mail-service"; | |
119 | host_name = hostFQDN; | |
120 | servicegroups = "webstatus-email"; | |
121 | check_command = command; | |
122 | }; | |
123 | otherObjects = map | |
124 | (n: (pkgs.callPackage (./. + "/objects_" + n + ".nix") { inherit emailCheck; })) | |
a1a4a72e | 125 | [ "caldance-1" "ulminfo-fr" "phare" "tiboqorl-fr" ]; |
e820134d | 126 | masterObjects = pkgs.callPackage ./objects_master.nix { inherit config; }; |
eb071dd4 | 127 | commonObjects = pkgs.callPackage ./objects_common.nix ({ |
e820134d | 128 | master = cfg.master; |
619e4f46 | 129 | hostFQDN = config.hostEnv.fqdn; |
e820134d | 130 | hostName = name; |
eb071dd4 IB |
131 | sudo = "/run/wrappers/bin/sudo"; |
132 | } // builtins.getAttr name commonConfig); | |
133 | hostObjects = | |
134 | let | |
135 | specific_file = ./. + "/objects_" + name + ".nix"; | |
9f202523 | 136 | in |
e820134d IB |
137 | lib.attrsets.optionalAttrs |
138 | (builtins.pathExists specific_file) | |
139 | (pkgs.callPackage specific_file { | |
71a2425e | 140 | inherit config emailCheck; |
619e4f46 | 141 | hostFQDN = config.hostEnv.fqdn; |
e820134d IB |
142 | hostName = name; |
143 | }); | |
3bc32d9e IB |
144 | in |
145 | { | |
146 | options = { | |
9f202523 IB |
147 | myServices.monitoring = { |
148 | enable = lib.mkOption { | |
149 | type = lib.types.bool; | |
150 | default = false; | |
151 | description = '' | |
152 | Whether to enable monitoring. | |
153 | ''; | |
154 | }; | |
e820134d IB |
155 | master = lib.mkOption { |
156 | type = lib.types.bool; | |
157 | default = false; | |
158 | description = '' | |
159 | This instance is the master instance | |
160 | ''; | |
161 | }; | |
162 | hosts = lib.mkOption { | |
163 | readOnly = true; | |
164 | description = "Hosts list for this host"; | |
165 | default = (commonObjects.host or {}) // (hostObjects.host or {}); | |
166 | }; | |
167 | services = lib.mkOption { | |
168 | readOnly = true; | |
169 | description = "Services list for this host"; | |
170 | default = commonObjects.service ++ hostObjects.service; | |
171 | }; | |
3bc32d9e IB |
172 | }; |
173 | }; | |
174 | ||
e820134d | 175 | config = lib.mkIf cfg.enable { |
d2e703c5 | 176 | services.duplyBackup.profiles.monitoring = { |
6a8252b1 IB |
177 | rootDir = config.services.naemon.varDir; |
178 | }; | |
3bc32d9e IB |
179 | security.sudo.extraRules = [ |
180 | { | |
181 | commands = [ | |
182 | { command = "${pkgs.mdadm}/bin/mdadm --monitor --scan -1"; options = [ "NOPASSWD" ]; } | |
183 | { command = "${pkgs.postfix}/bin/mailq"; options = [ "NOPASSWD" ]; } | |
184 | ]; | |
185 | users = [ "naemon" ]; | |
186 | runAs = "root"; | |
187 | } | |
9f202523 IB |
188 | { |
189 | commands = [ | |
9f202523 IB |
190 | { command = "${myplugins}/check_last_file_date /backup2/*"; options = [ "NOPASSWD" ]; } |
191 | ]; | |
192 | users = [ "naemon" ]; | |
16b80abd IB |
193 | runAs = "ALL"; |
194 | } | |
195 | { | |
196 | commands = [ | |
197 | { command = "${myplugins}/check_postgres_replication *"; options = [ "NOPASSWD" ]; } | |
198 | ]; | |
199 | users = [ "naemon" ]; | |
9f202523 IB |
200 | runAs = "postgres"; |
201 | } | |
202 | { | |
203 | commands = [ | |
6015a3b5 | 204 | { command = "${myplugins}/check_mysql_replication *"; options = [ "NOPASSWD" ]; } |
9f6a7862 IB |
205 | ]; |
206 | users = [ "naemon" ]; | |
207 | runAs = "mysql"; | |
208 | } | |
6015a3b5 IB |
209 | { |
210 | commands = [ | |
16b80abd | 211 | { command = "${myplugins}/check_openldap_replication *"; options = [ "NOPASSWD" ]; } |
6015a3b5 IB |
212 | ]; |
213 | users = [ "naemon" ]; | |
16b80abd | 214 | runAs = "openldap"; |
6015a3b5 | 215 | } |
9f6a7862 IB |
216 | { |
217 | commands = [ | |
16b80abd | 218 | { command = "${myplugins}/check_redis_replication *"; options = [ "NOPASSWD" ]; } |
9f202523 IB |
219 | ]; |
220 | users = [ "naemon" ]; | |
16b80abd | 221 | runAs = "redis"; |
9f202523 | 222 | } |
3bc32d9e IB |
223 | ]; |
224 | environment.etc."mdadm.conf" = { | |
225 | enable = true; | |
226 | mode = "0644"; | |
227 | user = "root"; | |
ab8f306d | 228 | text = "MAILADDR ${config.myEnv.monitoring.email}"; |
3bc32d9e IB |
229 | }; |
230 | ||
e820134d IB |
231 | secrets.keys = [ |
232 | { | |
233 | dest = "naemon/id_rsa"; | |
234 | user = "naemon"; | |
235 | group = "naemon"; | |
236 | premissions = "0400"; | |
237 | text = config.myEnv.monitoring.ssh_secret_key; | |
238 | } | |
239 | ]; | |
3bc32d9e IB |
240 | # needed since extraResource is not in the closure |
241 | systemd.services.naemon.path = [ myplugins ]; | |
242 | services.naemon = { | |
243 | enable = true; | |
244 | extraConfig = '' | |
245 | broker_module=${pkgs.naemon-livestatus}/lib/naemon-livestatus/livestatus.so ${config.services.naemon.runDir}/live | |
246 | use_syslog=1 | |
247 | log_initial_states=1 | |
248 | date_format=iso8601 | |
ab8f306d | 249 | admin_email=${config.myEnv.monitoring.email} |
e820134d | 250 | '' + lib.optionalString (!cfg.master) '' |
3bc32d9e IB |
251 | obsess_over_services=1 |
252 | ocsp_command=notify-master | |
253 | ''; | |
254 | extraResource = '' | |
255 | $USER2$=${myplugins} | |
ab8f306d IB |
256 | $USER200$=${config.myEnv.monitoring.status_url} |
257 | $USER201$=${config.myEnv.monitoring.status_token} | |
e820134d IB |
258 | $USER202$=${config.myEnv.monitoring.http_user_password} |
259 | $USER203$=${config.secrets.fullPaths."naemon/id_rsa"} | |
260 | $USER204$=${config.myEnv.monitoring.imap_login} | |
261 | $USER205$=${config.myEnv.monitoring.imap_password} | |
262 | $USER206$=${config.myEnv.monitoring.slack_channel} | |
263 | $USER207$=${config.myEnv.monitoring.slack_url} | |
25844101 | 264 | $USER208$=${builtins.concatStringsSep "," (map (builtins.concatStringsSep ":") config.myEnv.monitoring.eriomem_keys)} |
6191bdeb IB |
265 | $USER209$=${builtins.concatStringsSep "," [ |
266 | config.myEnv.monitoring.ovh_sms.endpoint | |
267 | config.myEnv.monitoring.ovh_sms.application_key | |
268 | config.myEnv.monitoring.ovh_sms.application_secret | |
269 | config.myEnv.monitoring.ovh_sms.consumer_key | |
270 | config.myEnv.monitoring.ovh_sms.account | |
271 | ]} | |
3bc32d9e | 272 | ''; |
e820134d IB |
273 | objectDefs = toObjects commonObjects |
274 | + toObjects hostObjects | |
275 | + lib.optionalString cfg.master (toObjects masterObjects) | |
71a2425e IB |
276 | + lib.optionalString cfg.master (toObjects masterPassiveObjects) |
277 | + lib.optionalString cfg.master (builtins.concatStringsSep "\n" (map toObjects otherObjects)); | |
3bc32d9e IB |
278 | }; |
279 | }; | |
280 | } |