Skip to content

Icinga2

Jump to navigationJump to search

Exemplary setup of an Icinga2 installation with

  • two masters icingasiteA and icingasiteB
  • a central PostgreSQL server
  • a dedicated web server (nginx) that takes on the role of icingaweb2

This example is not ideal insofar as the database naturally represents a single point of failure. You should use a redundant database with a service IP, for example. Consult the documentation regarding this. In my scenario, a simple database suffices.

Installing icinga2

Master Node Icinga2

On mastersiteA and mastersiteB:

pkg install -y icinga2
sysrc icinga2_enable="yes"
service icinga2 start

The Nagios plugins are installed automatically as a dependency. On the database host:

  • Create database: icinga
  • Create role: icinga
  • Configure pg_hba so that access from hosts mastersiteA and mastersiteB is possible

On only one of the two masters; import schema:

psql -U icinga -W -h your_postgresql_host.domain.net icinga < /usr/local/share/icinga2-ido-pgsql/schema/pgsql.sql

Now on both masters again; enable the Icinga2 IDO pgsql module, create configuration and restart Icinga2.

icinga2 feature enable ido-pgsql
vim /usr/local/etc/icinga2/features-enabled/ido-pgsql.conf

object object IdoPgsqlConnection "ido-pgsql" {
user = 'icinga'
password = 'yoursecurepassword'
host = 'your_postgresql_host.domain.net'
database = 'icinga' }

service icinga2 restart

Set up the API

icinga2 api setup

Create an API user for icingaweb2 with minimal privileges:

vim /usr/local/etc/icinga2/conf.d/api-users.conf

object ApiUser "icingaweb2" {
password = "Wijsa8ZdfeRs5E35d"
permissions = [ "status/query", "actions/*", "objects/modify/*", "objects/query/*" ] }

service icinga2 restart

Webservice Icingaweb2

  • Ensure there is a dedicated user for icingaweb2, here icingaweb2
  • Ensure there is a group icingaweb2 that has the member icingaweb2
  • Ensure the web server host also has access to the IDO database (pg_hba.conf and the role)
  • Ensure the web server host has firewall access to the API on both icinga2 masters
  • Ensure the API is activated on the masters, listening on "::", and an API user has been created for icingaweb2 (see below for the user)
  • Add icingaweb2 to the nginx group
  • Set up the PostgreSQL database on the central psql host:
    • Database name: icingaweb2
    • Password: A secure password of your choice
  • Configure pg_hba on the central DB host so that the server running icingaweb2 has access (host / md5)

Configure the web server for running icingaweb2, here is an example nginx configuration on an Alpine host with icingaweb installed via apk in /usr/share/webapps/icingaweb2.

server {
# icingaweb2
listen [::]:80;
server_name icinga.mydomain.net;
autoindex off;
access_log /var/log/nginx/icinga.mydomain.net-access.log;
error_log /var/log/nginx/icinga.mydomain.net-error.log;
root /var/www/vhosts/icinga.mydomain.net;
location / {
index index.html index.htm index.php;
}
location ~ ^/icingaweb2/index\.php(.*)$ {
fastcgi_pass unix:/run/nginx/www.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME /usr/share/webapps/icingaweb2/public/index.php;
fastcgi_param ICINGAWEB_CONFIGDIR /etc/icingaweb2;
fastcgi_param REMOTE_USER $remote_user;
}
location ~ ^/icingaweb2(.+)? {
alias /usr/share/webapps/icingaweb2/public;
index index.php;
try_files $1 $uri $uri/ /icingaweb2/index.php$is_args$args;
}
}

Note: The web interface should of course be accessed via HTTPS. In my case I solve this by placing a reverse proxy in between that handles SSL offloading.

Install the icingaweb2 package along with various plugins

apk add icingaweb2 icingaweb2-bash-completion icingaweb2-doc icingaweb2-module-director icingaweb2-module-incubator icingaweb2-module-incubator-doc icingaweb2-module-ipl icingaweb2-module-reactbundle
chgrp -R icingacweb2 /etc/icingaweb2
chmod -R g+rws /etc/icingaweb2

Generate setup token:

icingacli setup token create

  • Copy the token to your clipboard and open the setup URL http://myicingaweb2.domain.net/
  • Paste the token and click continue
  • Activate desired plugins and continue
  • The installation status is checked. Resolve any deficiencies and continue
  • Authentication method: Database and continue
    • Resource name: icingaweb_db
    • Database type: PostgreSQL
    • Host: yourpostgres.server.lan
    • Port: 5432
    • Database name: icingaweb2
    • Username: icingaweb2
    • Password: yoursecurepassword
    • Character set:
    • SSL: Depending on how your PostgreSQL is configured, disable if in doubt
  • Backend name: icingaweb2
  • Create users according to your preferences
  • continue, continue, continue
  • Monitoring backend:
    • Backend name: icinga2
    • Backend type: IDO
  • Monitoring IDO resource:
    • Resource name: icinga_ido
    • Database type: PostgreSQL
    • Host: yourpostgres.server.lan
    • Port: 5432
    • Database name: icinga
    • Username: icingaweb2ido
    • Password: another secure password
    • Character set:
    • SSL: Depending on how your PostgreSQL is configured, disable if in doubt
  • Command transport:
    • Transport name: icinga2
    • Transport type: Icinga 2 API
    • Host: any of your master servers
    • Port: 5665
    • API username: your API username
    • API password: your API password

Reconfigure Icingaweb

  • On the host where icingaweb2 runs:

icingacli module enable setup

Open the website, e.g.:

https://icinga.mysstem.net/icingaweb2/setup