rename dmc12 inventory to cloudlorean and vault admin_password

- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
2026-09-09 14:14:18 +02:00
parent a31751af1d
commit 30f3e9a4c6
96 changed files with 3602 additions and 138 deletions
@@ -0,0 +1,63 @@
+---
+id: TECH-INTEGRATIONS-ZABBIX
+type: technical
+status: active
+title: Integrations - Zabbix
+created: 2026-09-09
+updated: 2026-09-09
+tags:
+- technical
+- integration
+- zabbix
+related:
+- MOD-003
+source_paths:
+- roles/monitoring/
+- inventory/group_vars/
+confidence: confirmed
+---
+
+# Integrations - Zabbix
+
+## Agent Side (outbound/inbound to monitored hosts)
+
+- Package source: `repo.zabbix.com` (release package for Zabbix 7.0 on
+  Debian, downloaded to `/tmp` and installed).
+- Agent: `zabbix-agent2`, listen port 10050, config
+  `/etc/zabbix/zabbix_agent2.conf`.
+- TLS: PSK only (`tls_connect=psk`, `tls_accept=psk`), identity per host,
+  PSK file `/etc/zabbix/zabbix_agent2.psk`.
+- Docker monitoring: plugin config `/etc/zabbix/zabbix_agent2.d/plugins.d/
+  docker.conf` pointing at `unix:///var/run/docker.sock`, deployed when the
+  socket exists.
+- Passive/active server lists come from site group_vars
+  (`monitoring_zabbix_passive_servers`).
+
+## Controller Side (Zabbix API registration)
+
+- API endpoint per site: `https://mon.cloudlorean.de/api_jsonrpc.php`
+  (group_vars); credentials `monitoring_zabbix_api_user: Admin` +
+  `monitoring_zabbix_api_password` from `vault.yml`.
+- Module: `community.zabbix.zabbix_host` over `httpapi`; connection
+  parameters derived from the API URL with `urlsplit` (scheme, port, path).
+- Host object: name = `monitoring_zabbix_host_name` (default
+  `inventory_hostname`), agent interface IP = `ansible_host`, host groups
+  and templates per site, `inventory_mode: manual`, TLS PSK identity/value
+  from the deployed PSK, `status: enabled`, `state: present` (idempotent
+  register-or-update).
+- Optional proxy: when `monitoring_zabbix_proxy` is set, `monitored_by`
+  switches to the proxy (`gatekeeper.cloudlorean.de` for cloudlorean,
+  `gatekeeper.meyer-kempen.de` for home).
+
+## Site Overrides (observed)
+
+| Site | Passive servers | Proxy | Host groups |
+| --- | --- | --- | --- |
+| cloudlorean | 192.168.212.1 | gatekeeper.cloudlorean.de (192.168.212.1) | Linux servers, Cloudlorean |
+| home | 10.13.37.1 | gatekeeper.meyer-kempen.de (10.13.37.1) | Linux servers, Meyer-Kempen |
+| external | 2a01:4f8:1c1e:62dd::1 (see OQ-004) | none | Linux servers, Cloudlorean |
+
+## Other External Services
+
+- `download.docker.com` (docker role apt repository), Debian mirrors
+  (`deb.debian.org`, `security.debian.org` default; site-overridable).