Configure munin nodes & master.

Interhost communications are protected by stunnel4.  The graphs are only
visible on the master itself, and content is generated by Fast CGI.

9 files changed, 418 insertions, 0 deletions

diff --git a/roles/munin-master/files/etc/nginx/sites-available/munin b/roles/munin-master/files/etc/nginx/sites-available/munin
new file mode 100644
index 0000000..ade1888
--- /dev/null
+++ b/roles/munin-master/files/etc/nginx/sites-available/munin
@@ -0,0 +1,31 @@
+server {
+    listen 127.0.0.1:80;
+    listen [::1]:80;
+
+    server_name munin.fripost.org;
+
+    access_log /var/log/nginx/munin.access.log;
+    error_log  /var/log/nginx/munin.error.log info;
+
+    location = / {
+        return 302 /munin$args;
+    }
+
+    location /munin/static/ {
+        alias /etc/munin/static/;
+    }
+
+    location /munin-cgi/munin-cgi-graph/ {
+        fastcgi_split_path_info ^(/munin-cgi/munin-cgi-graph)(.*);
+        include fastcgi/params;
+        fastcgi_pass unix:/run/munin/cgi-graph.socket;
+        gzip off;
+    }
+
+    location /munin/ {
+        fastcgi_split_path_info ^(/munin)(.*);
+        include fastcgi/params;
+        fastcgi_pass unix:/run/munin/cgi-html.socket;
+        gzip off;
+    }
+}
diff --git a/roles/munin-master/files/lib/systemd/system/munin-cgi-graph.service b/roles/munin-master/files/lib/systemd/system/munin-cgi-graph.service
new file mode 100644
index 0000000..9e4d820
--- /dev/null
+++ b/roles/munin-master/files/lib/systemd/system/munin-cgi-graph.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Munin CGI Graph Service
+After=network.target
+PartOf=munin.service
+Requires=munin-cgi-graph.socket
+
+[Service]
+StandardInput=socket
+User=www-data
+Group=munin
+ExecStart=/usr/lib/munin/cgi/munin-cgi-graph
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/munin-master/files/lib/systemd/system/munin-cgi-graph.socket b/roles/munin-master/files/lib/systemd/system/munin-cgi-graph.socket
new file mode 100644
index 0000000..d4d2e27
--- /dev/null
+++ b/roles/munin-master/files/lib/systemd/system/munin-cgi-graph.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Munin CGI Graph Listen Socket
+
+[Socket]
+SocketUser=www-data
+SocketGroup=www-data
+SocketMode=0600
+ListenStream=/run/munin/cgi-graph.socket
+
+[Install]
+WantedBy=sockets.target
diff --git a/roles/munin-master/files/lib/systemd/system/munin-cgi-html.service b/roles/munin-master/files/lib/systemd/system/munin-cgi-html.service
new file mode 100644
index 0000000..11a7470
--- /dev/null
+++ b/roles/munin-master/files/lib/systemd/system/munin-cgi-html.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Munin CGI HTML Service
+After=network.target
+PartOf=munin.service
+Requires=munin-cgi-html.socket
+
+[Service]
+StandardInput=socket
+User=www-data
+Group=munin
+ExecStart=/usr/lib/munin/cgi/munin-cgi-html
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/munin-master/files/lib/systemd/system/munin-cgi-html.socket b/roles/munin-master/files/lib/systemd/system/munin-cgi-html.socket
new file mode 100644
index 0000000..77be2cf
--- /dev/null
+++ b/roles/munin-master/files/lib/systemd/system/munin-cgi-html.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Munin CGI HTML Listen Socket
+
+[Socket]
+SocketUser=www-data
+SocketGroup=www-data
+SocketMode=0600
+ListenStream=/run/munin/cgi-html.socket
+
+[Install]
+WantedBy=sockets.target
diff --git a/roles/munin-master/handlers/main.yml b/roles/munin-master/handlers/main.yml
new file mode 100644
index 0000000..4c41033
--- /dev/null
+++ b/roles/munin-master/handlers/main.yml
@@ -0,0 +1,24 @@
+---
+- name: systemctl daemon-reload
+  command: /bin/systemctl daemon-reload
+
+- name: Restart rrdcached
+  service: name=rrdcached state=restarted
+
+- name: Restart munin
+  service: name=munin state=restarted
+
+- name: Restart munin-node
+  service: name=munin-node state=restarted
+
+- name: Restart munin-cgi-graph
+  service: name=munin-cgi-graph state=restarted
+
+- name: Restart munin-cgi-html
+  service: name=munin-cgi-html state=restarted
+
+- name: Restart Nginx
+  service: name=nginx state=restarted
+
+- name: Restart stunnel
+  service: name=stunnel4 pattern=/usr/bin/stunnel4 state=restarted
diff --git a/roles/munin-master/tasks/main.yml b/roles/munin-master/tasks/main.yml
new file mode 100644
index 0000000..5dd1151
--- /dev/null
+++ b/roles/munin-master/tasks/main.yml
@@ -0,0 +1,136 @@
+- name: Install munin
+  apt: pkg={{ item }}
+  with_items:
+    - munin
+    - rrdcached
+    - libcgi-fast-perl
+
+- name: Configure rrdcached
+  lineinfile: "dest=/etc/default/rrdcached
+               regexp='^#?OPTS='
+               line='OPTS=\"-s munin -m 660 -l unix:/var/run/rrdcached.sock -w 1800 -z 1800 -f 3600 -j /var/lib/rrdcached/journal -F -b /var/lib/munin -B\"'"
+  register: r
+  notify:
+    - Restart rrdcached
+
+- name: Start rrdcached
+  service: name=rrdcached state=started
+  when: not r.changed
+
+- meta: flush_handlers
+
+
+- name: Configure munin
+  template: src=etc/munin/munin.conf.j2
+            dest=/etc/munin/munin.conf
+            owner=root group=root
+            mode=0644
+  notify:
+    - Restart munin-cgi-graph
+    - Restart munin-cgi-html
+
+- name: chown www-data:adm /var/log/munin/munin-cgi-{graph,html}.log
+  file: path=/var/log/munin/{{ item }}
+        owner=www-data group=adm
+        mode=0640
+  with_items:
+    - munin-cgi-graph.log
+    - munin-cgi-html.log
+
+- name: Copy munin-cgi-graph.{service,socket}
+  copy: src=lib/systemd/system/{{ item }}
+        dest=/lib/systemd/system/{{ item }}
+        owner=root group=root
+        mode=0644
+  notify:
+    - systemctl daemon-reload
+    - Restart munin-cgi-graph
+  with_items:
+    - munin-cgi-graph.service
+    - munin-cgi-graph.socket
+
+- name: Copy munin-cgi-html.{service,socket}
+  copy: src=lib/systemd/system/{{ item }}
+        dest=/lib/systemd/system/{{ item }}
+        owner=root group=root
+        mode=0644
+  notify:
+    - systemctl daemon-reload
+    - Restart munin-cgi-html
+  with_items:
+    - munin-cgi-html.service
+    - munin-cgi-html.socket
+
+- meta: flush_handlers
+
+- name: Start munin-cgi-{graph,html}
+  service: name={{ item }} state=started enabled=yes
+  with_items:
+    - munin-cgi-graph
+    - munin-cgi-html
+
+
+- name: Copy /etc/nginx/sites-available/munin
+  copy: src=etc/nginx/sites-available/munin
+        dest=/etc/nginx/sites-available/munin
+        owner=root group=root
+        mode=0644
+  register: r1
+  notify:
+    - Restart Nginx
+
+- name: Create /etc/nginx/sites-enabled/munin
+  file: src=../sites-available/munin
+        dest=/etc/nginx/sites-enabled/munin
+        owner=root group=root
+        state=link force=yes
+  register: r2
+  notify:
+    - Restart Nginx
+
+- name: Start Nginx
+  service: name=nginx state=started
+  when: not (r1.changed or r2.changed)
+
+- meta: flush_handlers
+
+
+- name: Copy munin-node X.509 certificates
+  copy: src=certs/munin/{{ item }}.pem
+        dest=/etc/stunnel/certs/munin-{{ hostvars[item].inventory_hostname_short }}.pem
+        owner=root group=root
+        mode=0644
+  with_items: groups.all | difference([inventory_hostname])
+  register: r1
+  notify:
+    - Restart stunnel
+
+- name: Configure stunnel
+  template: src=etc/stunnel/munin-master.conf.j2
+            dest=/etc/stunnel/munin-master.conf
+            owner=root group=root
+            mode=0644
+  register: r2
+  notify:
+    - Restart stunnel
+
+- name: Start stunnel
+  service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started
+  when: not (r1.changed or r2.changed)
+
+- meta: flush_handlers
+
+
+- name: Install 'munin_stats' and 'munin_update' plugins
+  file: src=/usr/share/munin/plugins/{{ item }}
+        dest=/etc/munin/plugins/{{ item }}
+        owner=root group=root
+        state=link force=yes
+  with_items:
+    - munin_stats
+    - munin_update
+  tags:
+    - munin-node
+    - munin
+  notify:
+    - Restart munin-node
diff --git a/roles/munin-master/templates/etc/munin/munin.conf.j2 b/roles/munin-master/templates/etc/munin/munin.conf.j2
new file mode 100644
index 0000000..8273a83
--- /dev/null
+++ b/roles/munin-master/templates/etc/munin/munin.conf.j2
@@ -0,0 +1,115 @@
+# Example configuration file for Munin, generated by 'make build'
+
+# The next three variables specifies where the location of the RRD
+# databases, the HTML output, logs and the lock/pid files.  They all
+# must be writable by the user running munin-cron.  They are all
+# defaulted to the values you see here.
+#
+#dbdir	/var/lib/munin
+#htmldir /var/cache/munin/www
+#logdir /var/log/munin
+#rundir  /var/run/munin
+
+# Where to look for the HTML templates
+#
+#tmpldir	/etc/munin/templates
+
+# Where to look for the static www files
+#
+#staticdir /etc/munin/static
+
+# temporary cgi files are here. note that it has to be writable by 
+# the cgi user (usually nobody or httpd).
+#
+# cgitmpdir /var/lib/munin/cgi-tmp
+
+# (Exactly one) directory to include all files from.
+includedir /etc/munin/munin-conf.d
+
+# You can choose the time reference for "DERIVE" like graphs, and show
+# "per minute", "per hour" values instead of the default "per second"
+#
+#graph_period second
+
+# Graphics files are generated either via cron or by a CGI process.
+# See http://munin-monitoring.org/wiki/CgiHowto2 for more
+# documentation.
+# Since 2.0, munin-graph has been rewritten to use the cgi code. 
+# It is single threaded *by design* now.
+#
+graph_strategy cgi
+
+# munin-cgi-graph is invoked by the web server up to very many times at the
+# same time.  This is not optimal since it results in high CPU and memory
+# consumption to the degree that the system can thrash.  Again the default is
+# 6.  Most likely the optimal number for max_cgi_graph_jobs is the same as
+# max_graph_jobs.
+#
+#munin_cgi_graph_jobs 6
+
+# If the automatic CGI url is wrong for your system override it here:
+#
+#cgiurl_graph /munin-cgi/munin-cgi-graph
+
+# max_size_x and max_size_y are the max size of images in pixel.
+# Default is 4000. Do not make it too large otherwise RRD might use all
+# RAM to generate the images.
+# 
+#max_size_x 4000
+#max_size_y 4000
+
+# HTML files are normally generated by munin-html, no matter if the
+# files are used or not. You can change this to on-demand generation
+# by following the instructions in http://munin-monitoring.org/wiki/CgiHowto2
+# 
+# Notes: 
+# - moving to CGI for HTML means you cannot have graph generated by cron.
+# - cgi html has some bugs, mostly you still have to launch munin-html by hand
+# 
+html_strategy cgi
+
+# munin-update runs in parallel.
+#
+# The default max number of processes is 16, and is probably ok for you.
+#
+# If set too high, it might hit some process/ram/filedesc limits.
+# If set too low, munin-update might take more than 5 min.
+#
+# If you want munin-update to not be parallel set it to 0.
+#
+#max_processes 16
+
+# RRD updates are per default, performed directly on the rrd files.
+# To reduce IO and enable the use of the rrdcached, uncomment it and set it to
+# the location of the socket that rrdcached uses.
+#
+rrdcached_socket /var/run/rrdcached.sock
+
+# Drop somejuser@fnord.comm and anotheruser@blibb.comm an email everytime
+# something changes (OK -> WARNING, CRITICAL -> OK, etc)
+contact.admin.command mail -s "Munin notification" admin@fripost.org
+#
+# For those with Nagios, the following might come in handy. In addition,
+# the services must be defined in the Nagios server as well.
+#contact.nagios.command /usr/bin/send_nsca nagios.host.comm -c /etc/nsca.conf
+
+local_address 127.0.0.1
+
+{% set n = 0 %}
+{% for node in groups.all | sort %}
+{% set n = n + 1 %}
+[all;{{ hostvars[node].inventory_hostname_short }}]
+{% if node == inventory_hostname %}
+    address 127.0.0.1
+{% else %}
+    address 127.0.{{ n }}.1
+{% endif %}
+    port 4994
+
+{% for g in hostvars[node].group_names | sort %}
+[{{ g }};{{ hostvars[node].inventory_hostname_short }}]
+    update no
+
+{% endfor %}
+
+{% endfor %}
diff --git a/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2 b/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2
new file mode 100644
index 0000000..c025183
--- /dev/null
+++ b/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2
@@ -0,0 +1,62 @@
+; **************************************************************************
+; * Global options                                                         *
+; **************************************************************************
+
+; setuid()/setgid() to the specified user/group in daemon mode
+setuid = stunnel4
+setgid = stunnel4
+
+; PID is created inside the chroot jail
+pid = /var/run/stunnel4/munin-master.pid
+
+; Only log messages at severity warning (4) and higher
+debug = 4
+
+; **************************************************************************
+; * Service defaults may also be specified in individual service sections  *
+; **************************************************************************
+
+; Certificate/key is needed in server mode and optional in client mode
+cert = /etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
+key  = /etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key
+client = yes
+socket = a:SO_BINDTODEVICE=lo
+
+; Some performance tunings
+socket = l:TCP_NODELAY=1
+socket = r:TCP_NODELAY=1
+
+; Prevent MITM attacks
+verify = 4
+
+; Disable support for insecure protocols
+options = NO_SSLv2
+options = NO_SSLv3
+options = NO_TLSv1
+options = NO_TLSv1.1
+
+; These options provide additional security at some performance degradation
+options = SINGLE_ECDH_USE
+options = SINGLE_DH_USE
+
+; Select permitted SSL ciphers
+ciphers = EECDH+AES:EDH+AES:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1
+
+; **************************************************************************
+; * Service definitions (remove all services for inetd mode)               *
+; **************************************************************************
+
+{% set n = 0 %}
+{% for node in groups.all | sort %}
+{% set n = n + 1 %}
+{% if node != inventory_hostname %}
+[{{ hostvars[node].inventory_hostname_short }}]
+accept  = 127.0.{{ n }}.1:4994
+connect = {{ node }}:4949
+delay   = yes
+CAfile  = /etc/stunnel/certs/munin-{{ hostvars[node].inventory_hostname_short }}.pem
+{% endif %}
+
+{% endfor %}
+
+; vim:ft=dosini