Adds full CheckMK CE 2.3 monitoring integration to the ansipa policy
enforcement system. Monitoring is group-driven — adding a host to an
IPA hostgroup installs the relevant agent checks automatically.
New monitoring groups:
dev_mon_base — install check-mk-agent, register host in CMK;
packages check + built-in CPU/RAM/disk/uptime
dev_mon_malware — ClamAV scan results from dev_security-scan log
dev_mon_timeshift — Timeshift snapshot age (WARN >5d, CRIT >10d)
dev_mon_power — CPU package TDP via Intel RAPL or lm-sensors
usr_mon_logins — SSH login attempts (success/failed/invalid-user)
Key implementation details:
- ansipa-checkmk-setup.sh: one-time folder/group creation on FreeIPA
container; reads automation secret from shared cmk-creds volume;
stores credentials in IPA dev_mon_base description for clients
- ansipa-checkmk.service: starts after IPA first-boot, retries until
both IPA and CheckMK are ready
- docker-compose.yml: CheckMK container adds port 8000 (agent receiver
for push mode); command override writes automation.secret to shared
volume, patches cookie_auth.conf for API access, and polls
/cmk-creds/push-mode-*.req to configure push-agent hosts in hosts.mk
- ansipa-enforce-policies.sh: local check scripts for all 5 groups;
cmk-agent-ctl registration + auto push timer when push mode is active
- CheckMK REST API path corrected to /cmk/check_mk/api/1.0/ (not
/cmk/api/1.0/ which returns 404 in 2.3)
- .gitignore added to prevent accidental commit of .env test creds
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHops6PU4c2Mv5UyhUj8Ms
Amir Alexander Abdelbaki