blob: baeebc9e5231583945300a7a9ccfbd73d8131ae8 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
{ config, myconfig, pkgs, lib, name, hostFQDN, ... }:
let
myplugins = pkgs.runCommand "buildplugins" {
buildInputs = [ pkgs.makeWrapper pkgs.perl ];
} ''
mkdir $out
cp ${./plugins}/* $out/
patchShebangs $out
wrapProgram $out/check_command --prefix PATH : ${config.security.wrapperDir}
wrapProgram $out/send_nrdp.sh --prefix PATH : ${lib.makeBinPath [
pkgs.curl pkgs.jq
]}
wrapProgram $out/check_mem.sh --prefix PATH : ${lib.makeBinPath [
pkgs.gnugrep pkgs.gawk pkgs.procps-ng
]}
wrapProgram $out/check_postgres_replication --prefix PATH : ${lib.makeBinPath [
pkgs.postgresql
]}
'';
toObjects = pkgs.callPackage ./to_objects.nix {};
commonConfig = {
eldiron = {
processWarn = "250"; processAlert = "400";
loadWarn = "8.0"; loadAlert = "10.0";
};
backup-2 = {
processWarn = "50"; processAlert = "60";
loadWarn = "1.0"; loadAlert = "2.0";
};
};
commonObjects = pkgs.callPackage ./objects_common.nix ({
inherit hostFQDN;
sudo = "/run/wrappers/bin/sudo";
} // builtins.getAttr name commonConfig);
hostObjects =
let
specific_file = ./. + "/objects_" + name + ".nix";
in
lib.attrsets.optionalAttrs (builtins.pathExists specific_file) (pkgs.callPackage specific_file {});
in
{
options = {
myServices.monitoring = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to enable monitoring.
'';
};
};
};
config = lib.mkIf config.myServices.monitoring.enable {
services.duplyBackup.profiles.monitoring = {
rootDir = config.services.naemon.varDir;
};
security.sudo.extraRules = [
{
commands = [
{ command = "${pkgs.mdadm}/bin/mdadm --monitor --scan -1"; options = [ "NOPASSWD" ]; }
{ command = "${pkgs.postfix}/bin/mailq"; options = [ "NOPASSWD" ]; }
];
users = [ "naemon" ];
runAs = "root";
}
{
commands = [
{ command = "${myplugins}/check_postgres_replication *"; options = [ "NOPASSWD" ]; }
{ command = "${myplugins}/check_last_file_date /backup2/*"; options = [ "NOPASSWD" ]; }
];
users = [ "naemon" ];
runAs = "postgres";
}
{
commands = [
{ command = "${myplugins}/check_last_file_date /backup2/*"; options = [ "NOPASSWD" ]; }
];
users = [ "naemon" ];
runAs = "mysql";
}
{
commands = [
{ command = "${myplugins}/check_last_file_date /backup2/*"; options = [ "NOPASSWD" ]; }
];
users = [ "naemon" ];
runAs = "backup";
}
];
environment.etc."mdadm.conf" = {
enable = true;
mode = "0644";
user = "root";
text = "MAILADDR ${myconfig.env.monitoring.email}";
};
# needed since extraResource is not in the closure
systemd.services.naemon.path = [ myplugins ];
services.naemon = {
enable = true;
extraConfig = ''
broker_module=${pkgs.naemon-livestatus}/lib/naemon-livestatus/livestatus.so ${config.services.naemon.runDir}/live
use_syslog=1
log_initial_states=1
date_format=iso8601
admin_email=${myconfig.env.monitoring.email}
obsess_over_services=1
ocsp_command=notify-master
'';
extraResource = ''
$USER2$=${myplugins}
$USER200$=${myconfig.env.monitoring.status_url}
$USER201$=${myconfig.env.monitoring.status_token}
'';
objectDefs = toObjects commonObjects + toObjects hostObjects;
};
};
}
|
