Merge remote-tracking branch 'origin/master' into jenkins-build-234

README.md

@@ -50,6 +50,7 @@ At this stage, the module is being redeveloped and being built to the latest sta
 - configures the main nagios configuration file and sets values as (pre)configured per values in params, which can be overwritten.
 - if `ng_include_nrpe`is set to `true`, the confdroid_nrpe module is automatically applied on clients ([confdroid_nrpe](https://sourcecode.confdroid.com/confdroid/confdroid_nrpe) must be in the catalogue then)
 - if `ng_enable_fail2ban`is set to `true`, a fail2ban jail and filter will be added for the Nagios service (requires confdroid_fail2ban).
+- manage remoteIP logging if running behind a Loadbalancer like HAproxy: if `ng_use_lb` is set to `true`, a configuration file `etc/httpd/conf.d/loadbalancer-remoteip.conf`is created and configures apache/httpd to use the remote header. This allows proper fail2ban protection even behind the Loadbalancer. Make sure to set `ng_trusted_proxy`to the proper IP or range for the loadbalancer!
 
 ## Repo Documentation
 

doc/file.README.html

@@ -143,6 +143,8 @@
 <p>if <code>ng_include_nrpe</code>is set to <code>true</code>, the confdroid_nrpe module is automatically applied on clients (<a href="https://sourcecode.confdroid.com/confdroid/confdroid_nrpe">confdroid_nrpe</a> must be in the catalogue then)</p>
 </li><li>
 <p>if <code>ng_enable_fail2ban</code>is set to <code>true</code>, a fail2ban jail and filter will be added for the Nagios service (requires confdroid_fail2ban).</p>
+</li><li>
+<p>manage remoteIP logging if running behind a Loadbalancer like HAproxy: if <code>ng_use_lb</code> is set to <code>true</code>, a configuration file <code>etc/httpd/conf.d/loadbalancer-remoteip.conf</code>is created and configures apache/httpd to use the remote header. This allows proper fail2ban protection even behind the Loadbalancer. Make sure to set <code>ng_trusted_proxy</code>to the proper IP or range for the loadbalancer!</p>
 </li></ul>
 
 <h2 id="label-Repo+Documentation">Repo Documentation</h2>

doc/index.html

@@ -143,6 +143,8 @@
 <p>if <code>ng_include_nrpe</code>is set to <code>true</code>, the confdroid_nrpe module is automatically applied on clients (<a href="https://sourcecode.confdroid.com/confdroid/confdroid_nrpe">confdroid_nrpe</a> must be in the catalogue then)</p>
 </li><li>
 <p>if <code>ng_enable_fail2ban</code>is set to <code>true</code>, a fail2ban jail and filter will be added for the Nagios service (requires confdroid_fail2ban).</p>
+</li><li>
+<p>manage remoteIP logging if running behind a Loadbalancer like HAproxy: if <code>ng_use_lb</code> is set to <code>true</code>, a configuration file <code>etc/httpd/conf.d/loadbalancer-remoteip.conf</code>is created and configures apache/httpd to use the remote header. This allows proper fail2ban protection even behind the Loadbalancer. Make sure to set <code>ng_trusted_proxy</code>to the proper IP or range for the loadbalancer!</p>
 </li></ul>
 
 <h2 id="label-Repo+Documentation">Repo Documentation</h2>

doc/puppet_classes/confdroid_nagios_3A_3Aparams.html

@@ -4075,6 +4075,42 @@ inherited by all classes except defines.
       
     </li>
   
+    <li>
+      
+        <span class='name'>ng_use_lb</span>
+      
+      
+        <span class='type'>(<tt>Boolean</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>false</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>Whether to use load balancing for the Nagios server. Default is false.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>ng_trusted_proxy</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;10.0.0.10&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>The IP address of the trusted proxy to access the Nagios server. Default is ‘10.0.0.10’.</p>
+</div>
+      
+    </li>
+  
     <li>
       
         <span class='name'>ng_use_ssl_auth</span>
@@ -4099,10 +4135,6 @@ inherited by all classes except defines.
         <pre class="lines">
 
 
-445
-446
-447
-448
 449
 450
 451
@@ -4443,10 +4475,17 @@ inherited by all classes except defines.
 786
 787
 788
-789</pre>
+789
+790
+791
+792
+793
+794
+795
+796</pre>
       </td>
       <td>
-        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 445</span>
+        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 449</span>
 
 class confdroid_nagios::params (
 
@@ -4464,6 +4503,8 @@ class confdroid_nagios::params (
   String $ng_user                       = &#39;nagios&#39;,
   Boolean $ng_enable_target             = true,
   Boolean $ng_purge_target              = true,
+  Boolean $ng_use_lb                    = false,
+  String $ng_trusted_proxy              = &#39;10.0.0.10&#39;,
 
 # contact groups
   String $ng_contactgroup_name          = &#39;admins&#39;,
@@ -4734,6 +4775,7 @@ class confdroid_nagios::params (
   $ng_nagios_cfg_erb          = &#39;confdroid_nagios/nagios/nagios_cfg.erb&#39;
   $ng_cgi_cfg_file            = &quot;${ng_main_dir}/cgi.cfg&quot;
   $ng_cgi_cfg_erb             = &#39;confdroid_nagios/nagios/cgi_cfg.erb&#39;
+  $ng_remoteip_file           = &#39;/etc/httpd/conf.d/loadbalancer-remoteip.conf&#39;
 
 # nagios
   $ng_target_templates        = &quot;${ng_conf_d_dir}/nagios_templates.cfg&quot;

doc/puppet_classes/confdroid_nagios_3A_3Aserver_3A_3Afiles.html

@@ -143,7 +143,22 @@
 45
 46
 47
-48</pre>
+48
+49
+50
+51
+52
+53
+54
+55
+56
+57
+58
+59
+60
+61
+62
+63</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/server/files.pp', line 6</span>
@@ -189,6 +204,21 @@ class confdroid_nagios::server::files (
       seltype  =&gt; nagios_var_run_t,
       seluser  =&gt; system_u,
     }
+
+    if $ng_use_lb == true {
+      file { $ng_remoteip_file:
+        ensure   =&gt; file,
+        owner    =&gt; &#39;root&#39;,
+        group    =&gt; &#39;root&#39;,
+        mode     =&gt; &#39;0644&#39;,
+        selrange =&gt; s0,
+        selrole  =&gt; object_r,
+        seltype  =&gt; httpd_conf_t,
+        seluser  =&gt; system_u,
+        content  =&gt; template(&#39;confdroid_nagios/loadbalancer/remoteip.conf.erb&#39;),
+        notify   =&gt; Service[&#39;httpd&#39;],
+      }
+    }
   }
 }</pre>
       </td>

manifests/params.pp

@@ -441,6 +441,10 @@
 #   in fail2ban. Default is '3600'.
 # @param [String] ng_fail2ban_ignoreip A comma-separated list of IP addresses 
 #   to ignore in fail2ban. Default is '127.0.0.1/8 ::1 192.168.1.0/24'.
+# @param [Boolean] ng_use_lb Whether to use load balancing for the Nagios server. 
+#   Default is false.
+# @param [String] ng_trusted_proxy The IP address of the trusted proxy to access 
+#   the Nagios server. Default is '10.0.0.10'.
 ###############################################################################
 class confdroid_nagios::params (
 
@@ -458,6 +462,8 @@ class confdroid_nagios::params (
   String $ng_user                       = 'nagios',
   Boolean $ng_enable_target             = true,
   Boolean $ng_purge_target              = true,
+  Boolean $ng_use_lb                    = false,
+  String $ng_trusted_proxy              = '10.0.0.10',
 
 # contact groups
   String $ng_contactgroup_name          = 'admins',
@@ -728,6 +734,7 @@ class confdroid_nagios::params (
   $ng_nagios_cfg_erb          = 'confdroid_nagios/nagios/nagios_cfg.erb'
   $ng_cgi_cfg_file            = "${ng_main_dir}/cgi.cfg"
   $ng_cgi_cfg_erb             = 'confdroid_nagios/nagios/cgi_cfg.erb'
+  $ng_remoteip_file           = '/etc/httpd/conf.d/loadbalancer-remoteip.conf'
 
 # nagios
   $ng_target_templates        = "${ng_conf_d_dir}/nagios_templates.cfg"

manifests/server/files.pp

@@ -44,5 +44,20 @@ class confdroid_nagios::server::files (
       seltype  => nagios_var_run_t,
       seluser  => system_u,
     }
+
+    if $ng_use_lb == true {
+      file { $ng_remoteip_file:
+        ensure   => file,
+        owner    => 'root',
+        group    => 'root',
+        mode     => '0644',
+        selrange => s0,
+        selrole  => object_r,
+        seltype  => httpd_conf_t,
+        seluser  => system_u,
+        content  => template('confdroid_nagios/loadbalancer/remoteip.conf.erb'),
+        notify   => Service['httpd'],
+      }
+    }
   }
 }

templates/loadbalancer/remoteip.conf.erb

@@ -0,0 +1,12 @@
+###############################################################################
+##########    parameterized remoteip config created by Puppet        ##########
+##########      manual changes will be overwritten !!!               ##########
+###############################################################################
+
+RemoteIPHeader X-Forwarded-For
+RemoteIPTrustedProxy <%= @ng_trusted_proxy %>
+RemoteIPInternalProxy <%= @ng_trusted_proxy %>
+
+# mod_remoteip rewrites client address for %a; use it in common/combined logs.
+LogFormat "%a %l %u %t \"%r\" %>s %b" common
+LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined