X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fmonitoring%2Fdefault.nix;h=a1f4b3f0c99a14ac32c14e6316a853c84b2af99b;hb=e820134d38c3b7470ea5112f40a6dc967f039878;hp=11861ad17ef769ab25873fe9df42219d8299e46b;hpb=3bc32d9ebd9b0900eeef756122ad28f8857f8bfe;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/modules/private/monitoring/default.nix b/modules/private/monitoring/default.nix index 11861ad..a1f4b3f 100644 --- a/modules/private/monitoring/default.nix +++ b/modules/private/monitoring/default.nix @@ -1,5 +1,6 @@ -{ config, myconfig, pkgs, lib, ... }: +{ config, pkgs, lib, name, nodes, ... }: let + cfg = config.myServices.monitoring; myplugins = pkgs.runCommand "buildplugins" { buildInputs = [ pkgs.makeWrapper pkgs.perl ]; } '' @@ -8,25 +9,132 @@ let patchShebangs $out wrapProgram $out/check_command --prefix PATH : ${config.security.wrapperDir} wrapProgram $out/send_nrdp.sh --prefix PATH : ${lib.makeBinPath [ - pkgs.curl pkgs.which pkgs.coreutils + pkgs.curl pkgs.jq + ]} + wrapProgram $out/check_maison_bbc --prefix PATH : ${lib.makeBinPath [ + pkgs.curl pkgs.jq ]} wrapProgram $out/check_mem.sh --prefix PATH : ${lib.makeBinPath [ pkgs.gnugrep pkgs.gawk pkgs.procps-ng ]} + wrapProgram $out/check_postgres_replication --prefix PATH : ${lib.makeBinPath [ + pkgs.postgresql + ]} + wrapProgram $out/check_redis_replication --prefix PATH : ${lib.makeBinPath [ + pkgs.gnugrep pkgs.coreutils pkgs.redis + ]} + wrapProgram $out/check_mysql_replication --prefix PATH : ${lib.makeBinPath [ + pkgs.gnugrep pkgs.gnused pkgs.coreutils pkgs.mariadb + ]} + wrapProgram $out/check_openldap_replication --prefix PATH : ${lib.makeBinPath [ + pkgs.gnugrep pkgs.gnused pkgs.coreutils pkgs.openldap + ]} + wrapProgram $out/check_ftp_database --prefix PATH : ${lib.makeBinPath [ + pkgs.lftp + ]} + wrapProgram $out/check_git --prefix PATH : ${lib.makeBinPath [ + pkgs.git pkgs.openssh + ]} + wrapProgram $out/check_imap_connection --prefix PATH : ${lib.makeBinPath [ + pkgs.openssl + ]} + wrapProgram $out/notify_maison_bbc_by_email --prefix PATH : ${lib.makeBinPath [ + pkgs.mailutils pkgs.gawk + ]} + wrapProgram $out/notify_by_email --prefix PATH : ${lib.makeBinPath [ + pkgs.mailutils + ]} + wrapProgram $out/notify_by_slack --prefix PATH : ${lib.makeBinPath [ + pkgs.curl pkgs.jq + ]} ''; + toObjects = pkgs.callPackage ./to_objects.nix {}; + commonConfig = { + eldiron = { + processWarn = "250"; processAlert = "400"; + loadWarn = "8.0"; loadAlert = "10.0"; + }; + backup-2 = { + processWarn = "50"; processAlert = "60"; + loadWarn = "1.0"; loadAlert = "2.0"; + }; + monitoring-1 = { + processWarn = "50"; processAlert = "60"; + loadWarn = "1.0"; loadAlert = "2.0"; + }; + }; + masterPassiveObjects = let + otherPassiveObjects = map + (n: (pkgs.callPackage (./. + "/objects_" + n + ".nix") {})) + [ "caldance-1" "ulminfo-fr" "immae-eu" "phare" "tiboqorl-fr" ]; + otherPassiveServices = lib.flatten (map (h: h.service or []) otherPassiveObjects); + otherPassiveHosts = (map (h: h.host)) otherPassiveObjects; + passiveNodes = lib.attrsets.filterAttrs (n: _: builtins.elem n ["backup-2" "eldiron"]) nodes; + toPassiveServices = map (s: s.passiveInfo.filter s // s.passiveInfo); + passiveServices = lib.flatten (lib.attrsets.mapAttrsToList + (_: n: toPassiveServices n.config.myServices.monitoring.services) + passiveNodes + ); + in { + service = passiveServices ++ otherPassiveServices; + host = lib.lists.foldr + (a: b: a//b) + {} + (otherPassiveHosts ++ lib.attrsets.mapAttrsToList (_: h: h.config.myServices.monitoring.hosts) passiveNodes); + }; + masterObjects = pkgs.callPackage ./objects_master.nix { inherit config; }; + commonObjects = pkgs.callPackage ./objects_common.nix ({ + master = cfg.master; + hostFQDN = config.hostEnv.FQDN; + hostName = name; + sudo = "/run/wrappers/bin/sudo"; + } // builtins.getAttr name commonConfig); + hostObjects = + let + specific_file = ./. + "/objects_" + name + ".nix"; + in + lib.attrsets.optionalAttrs + (builtins.pathExists specific_file) + (pkgs.callPackage specific_file { + inherit config; + hostFQDN = config.hostEnv.FQDN; + hostName = name; + }); in { options = { - myServices.monitoring.enable = lib.mkOption { - type = lib.types.bool; - default = false; - description = '' - Whether to enable monitoring. - ''; + myServices.monitoring = { + enable = lib.mkOption { + type = lib.types.bool; + default = false; + description = '' + Whether to enable monitoring. + ''; + }; + master = lib.mkOption { + type = lib.types.bool; + default = false; + description = '' + This instance is the master instance + ''; + }; + hosts = lib.mkOption { + readOnly = true; + description = "Hosts list for this host"; + default = (commonObjects.host or {}) // (hostObjects.host or {}); + }; + services = lib.mkOption { + readOnly = true; + description = "Services list for this host"; + default = commonObjects.service ++ hostObjects.service; + }; }; }; - config = lib.mkIf config.myServices.monitoring.enable { + config = lib.mkIf cfg.enable { + services.duplyBackup.profiles.monitoring = { + rootDir = config.services.naemon.varDir; + }; security.sudo.extraRules = [ { commands = [ @@ -36,14 +144,58 @@ in users = [ "naemon" ]; runAs = "root"; } + { + commands = [ + { command = "${myplugins}/check_last_file_date /backup2/*"; options = [ "NOPASSWD" ]; } + ]; + users = [ "naemon" ]; + runAs = "ALL"; + } + { + commands = [ + { command = "${myplugins}/check_postgres_replication *"; options = [ "NOPASSWD" ]; } + ]; + users = [ "naemon" ]; + runAs = "postgres"; + } + { + commands = [ + { command = "${myplugins}/check_mysql_replication *"; options = [ "NOPASSWD" ]; } + ]; + users = [ "naemon" ]; + runAs = "mysql"; + } + { + commands = [ + { command = "${myplugins}/check_openldap_replication *"; options = [ "NOPASSWD" ]; } + ]; + users = [ "naemon" ]; + runAs = "openldap"; + } + { + commands = [ + { command = "${myplugins}/check_redis_replication *"; options = [ "NOPASSWD" ]; } + ]; + users = [ "naemon" ]; + runAs = "redis"; + } ]; environment.etc."mdadm.conf" = { enable = true; mode = "0644"; user = "root"; - text = "MAILADDR naemon@immae.eu"; + text = "MAILADDR ${config.myEnv.monitoring.email}"; }; + secrets.keys = [ + { + dest = "naemon/id_rsa"; + user = "naemon"; + group = "naemon"; + premissions = "0400"; + text = config.myEnv.monitoring.ssh_secret_key; + } + ]; # needed since extraResource is not in the closure systemd.services.naemon.path = [ myplugins ]; services.naemon = { @@ -53,59 +205,26 @@ in use_syslog=1 log_initial_states=1 date_format=iso8601 - admin_email=naemon@immae.eu - + admin_email=${config.myEnv.monitoring.email} + '' + lib.optionalString (!cfg.master) '' obsess_over_services=1 ocsp_command=notify-master ''; extraResource = '' $USER2$=${myplugins} - $USER200$=${myconfig.env.monitoring.status_url} - $USER201$=${myconfig.env.monitoring.status_token} + $USER200$=${config.myEnv.monitoring.status_url} + $USER201$=${config.myEnv.monitoring.status_token} + $USER202$=${config.myEnv.monitoring.http_user_password} + $USER203$=${config.secrets.fullPaths."naemon/id_rsa"} + $USER204$=${config.myEnv.monitoring.imap_login} + $USER205$=${config.myEnv.monitoring.imap_password} + $USER206$=${config.myEnv.monitoring.slack_channel} + $USER207$=${config.myEnv.monitoring.slack_url} ''; - objectDefs = builtins.readFile ./conf/local_services.cfg - + builtins.readFile ./conf/timeperiods.cfg - + builtins.readFile ./conf/services.cfg - + builtins.readFile ./conf/contacts.cfg - + builtins.readFile ./conf/hosts.cfg - + '' - define command { - command_line ${myplugins}/send_nrdp.sh -u "$USER200$" -t "$USER201$" -H "$HOSTADDRESS$" -s "$SERVICEDESC$" -S "$SERVICESTATEID$" -o "$SERVICEOUTPUT$" - command_name notify-master - } - define service { - service_description No mdadm array is degraded - use local-service - check_command check_command_output!${pkgs.mdadm}/bin/mdadm --monitor --scan -1!^$!-s 0 -r root - } - - define service { - service_description mailq is empty - use local-service - check_command check_mailq - } - - define command { - command_name check_mailq - command_line $USER1$/check_mailq -s -w 1 -c 2 - } - - define service { - name local-service - use generic-service - host_name eldiron.immae.eu - check_interval 5 - max_check_attempts 4 - register 0 - retry_interval 1 - } - define host { - host_name eldiron.immae.eu - alias eldiron.immae.eu - address eldiron.immae.eu - use linux-server - } - ''; + objectDefs = toObjects commonObjects + + toObjects hostObjects + + lib.optionalString cfg.master (toObjects masterObjects) + + lib.optionalString cfg.master (toObjects masterPassiveObjects); }; }; }