diff options
Diffstat (limited to 'roles/munin-master/templates')
| -rw-r--r-- | roles/munin-master/templates/etc/munin/munin.conf.j2 | 14 | ||||
| -rw-r--r-- | roles/munin-master/templates/etc/stunnel/munin-master.conf.j2 | 62 |
2 files changed, 3 insertions, 73 deletions
diff --git a/roles/munin-master/templates/etc/munin/munin.conf.j2 b/roles/munin-master/templates/etc/munin/munin.conf.j2 index 8273a83..b53ef0e 100644 --- a/roles/munin-master/templates/etc/munin/munin.conf.j2 +++ b/roles/munin-master/templates/etc/munin/munin.conf.j2 @@ -1,31 +1,31 @@ # Example configuration file for Munin, generated by 'make build' # The next three variables specifies where the location of the RRD # databases, the HTML output, logs and the lock/pid files. They all # must be writable by the user running munin-cron. They are all # defaulted to the values you see here. # #dbdir /var/lib/munin #htmldir /var/cache/munin/www #logdir /var/log/munin -#rundir /var/run/munin +#rundir /run/munin # Where to look for the HTML templates # #tmpldir /etc/munin/templates # Where to look for the static www files # #staticdir /etc/munin/static # temporary cgi files are here. note that it has to be writable by # the cgi user (usually nobody or httpd). # # cgitmpdir /var/lib/munin/cgi-tmp # (Exactly one) directory to include all files from. includedir /etc/munin/munin-conf.d # You can choose the time reference for "DERIVE" like graphs, and show # "per minute", "per hour" values instead of the default "per second" # @@ -66,50 +66,42 @@ graph_strategy cgi # - moving to CGI for HTML means you cannot have graph generated by cron. # - cgi html has some bugs, mostly you still have to launch munin-html by hand # html_strategy cgi # munin-update runs in parallel. # # The default max number of processes is 16, and is probably ok for you. # # If set too high, it might hit some process/ram/filedesc limits. # If set too low, munin-update might take more than 5 min. # # If you want munin-update to not be parallel set it to 0. # #max_processes 16 # RRD updates are per default, performed directly on the rrd files. # To reduce IO and enable the use of the rrdcached, uncomment it and set it to # the location of the socket that rrdcached uses. # -rrdcached_socket /var/run/rrdcached.sock +rrdcached_socket /run/rrdcached.sock # Drop somejuser@fnord.comm and anotheruser@blibb.comm an email everytime # something changes (OK -> WARNING, CRITICAL -> OK, etc) contact.admin.command mail -s "Munin notification" admin@fripost.org # # For those with Nagios, the following might come in handy. In addition, # the services must be defined in the Nagios server as well. #contact.nagios.command /usr/bin/send_nsca nagios.host.comm -c /etc/nsca.conf -local_address 127.0.0.1 - -{% set n = 0 %} {% for node in groups.all | sort %} -{% set n = n + 1 %} [all;{{ hostvars[node].inventory_hostname_short }}] -{% if node == inventory_hostname %} - address 127.0.0.1 -{% else %} - address 127.0.{{ n }}.1 -{% endif %} + address {{ ipsec[ hostvars[node].inventory_hostname_short ] }} port 4994 {% for g in hostvars[node].group_names | sort %} [{{ g }};{{ hostvars[node].inventory_hostname_short }}] update no {% endfor %} {% endfor %} diff --git a/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2 b/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2 deleted file mode 100644 index c025183..0000000 --- a/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2 +++ /dev/null @@ -1,62 +0,0 @@ -; ************************************************************************** -; * Global options * -; ************************************************************************** - -; setuid()/setgid() to the specified user/group in daemon mode -setuid = stunnel4 -setgid = stunnel4 - -; PID is created inside the chroot jail -pid = /var/run/stunnel4/munin-master.pid - -; Only log messages at severity warning (4) and higher -debug = 4 - -; ************************************************************************** -; * Service defaults may also be specified in individual service sections * -; ************************************************************************** - -; Certificate/key is needed in server mode and optional in client mode -cert = /etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem -key = /etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key -client = yes -socket = a:SO_BINDTODEVICE=lo - -; Some performance tunings -socket = l:TCP_NODELAY=1 -socket = r:TCP_NODELAY=1 - -; Prevent MITM attacks -verify = 4 - -; Disable support for insecure protocols -options = NO_SSLv2 -options = NO_SSLv3 -options = NO_TLSv1 -options = NO_TLSv1.1 - -; These options provide additional security at some performance degradation -options = SINGLE_ECDH_USE -options = SINGLE_DH_USE - -; Select permitted SSL ciphers -ciphers = EECDH+AES:EDH+AES:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1 - -; ************************************************************************** -; * Service definitions (remove all services for inetd mode) * -; ************************************************************************** - -{% set n = 0 %} -{% for node in groups.all | sort %} -{% set n = n + 1 %} -{% if node != inventory_hostname %} -[{{ hostvars[node].inventory_hostname_short }}] -accept = 127.0.{{ n }}.1:4994 -connect = {{ node }}:4949 -delay = yes -CAfile = /etc/stunnel/certs/munin-{{ hostvars[node].inventory_hostname_short }}.pem -{% endif %} - -{% endfor %} - -; vim:ft=dosini |