snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/kandra/templates/dotfiles/aws_config.erb

@@ -0,0 +1,10 @@
+[default]
+region = us-east-1
+output = text
+<% if @is_ec2 -%>
+# Credentials are from the IAM role attached to the EC2 instance
+<% else -%>
+# We pull the Teleport host certificate and use that to auth to AWS
+# using IAM Roles Anywhere
+credential_process = /usr/local/bin/teleport-aws-credentials --trust-anchor-arn <%= @aws_trust_arn %> --profile-arn <%= @aws_profile_arn %> --role-arn <%= @aws_role_arn %>
+<% end %>

puppet/kandra/templates/grafana.ini.template.erb

@@ -0,0 +1,64 @@
+#################################### Paths ####################################
+[paths]
+# Path to where grafana can store temp files, sessions, and the sqlite3 db
+data = /var/lib/grafana
+
+# Directory where grafana can store logs
+logs = /var/log/grafana
+
+# Directory where grafana will automatically scan and look for plugins
+plugins = /var/lib/grafana/plugins
+
+
+#################################### Server ####################################
+[server]
+# Protocol (http, https, h2, socket)
+protocol = http
+
+# The ip address to bind to, empty will bind to all interfaces
+http_addr = 127.0.0.1
+
+# The http port to use
+http_port = 3000
+
+# The public facing domain name used to access grafana from a browser
+domain = monitoring.teleport.zulipchat.net
+
+# The full public facing url you use in browser, used for redirects and emails
+# If you use reverse proxy and sub path specify full url (with sub path)
+root_url = https://monitoring.teleport.zulipchat.net/
+
+
+#################################### SMTP ####################################
+[smtp]
+enabled = true
+from_name = Grafana
+from_address = <%= @email_from %>
+host = <%= @email_host %>
+user = <%= @email_user %>
+password = <%= @email_password %>
+startTLS_policy = MandatoryStartTLS
+
+
+#################################### Auth JWT ####################################
+[auth.jwt]
+# Grafana should trust the JWT that is provided in a header from Teleport; see
+# https://goteleport.com/docs/application-access/guides/jwt/ and
+# https://grafana.com/docs/grafana/latest/auth/jwt/
+enabled = true
+header_name = Teleport-Jwt-Assertion
+username_claim = sub
+jwk_set_url = https://teleport.zulipchat.net/.well-known/jwks.json
+cache_ttl = 24h
+expect_claims = {"iss": "teleport.zulipchat.net"}
+auto_sign_up = true
+skip_org_role_sync = true
+
+#################################### Alerting ####################################
+# Switch to the Grafana 8 unified alerting
+# https://grafana.com/docs/grafana/latest/alerting/unified-alerting/opt-in/#enable-grafana-alerting
+[unified_alerting]
+enabled = true
+
+[alerting]
+enabled = false

puppet/kandra/templates/msmtprc_nagios.template.erb

@@ -0,0 +1,15 @@
+from <%= @nagios_alert_email %>
+user postmaster@nagios.<%= @default_host_domain %>
+password <%= @nagios_mail_password %>
+
+host <%= @nagios_mail_host %>
+port 587
+auth on
+
+protocol smtp
+
+maildomain <%= @nagios_mail_domain %>
+domain <%= @nagios_mail_domain %>
+
+tls on
+tls_trust_file /etc/ssl/certs/ca-certificates.crt

puppet/kandra/templates/nagios4/cgi.cfg.template.erb

@@ -0,0 +1,375 @@
+#################################################################
+#
+# CGI.CFG - Sample CGI Configuration File for Nagios
+#
+#################################################################
+
+
+# MAIN CONFIGURATION FILE
+# This tells the CGIs where to find your main configuration file.
+# The CGIs will read the main and host config files for any other
+# data they might need.
+
+main_config_file=/etc/nagios4/nagios.cfg
+
+
+
+# PHYSICAL HTML PATH
+# This is the path where the HTML files for Nagios reside.  This
+# value is used to locate the logo images needed by the statusmap
+# and statuswrl CGIs.
+
+physical_html_path=/usr/share/nagios4/htdocs
+
+
+
+# URL HTML PATH
+# This is the path portion of the URL that corresponds to the
+# physical location of the Nagios HTML files (as defined above).
+# This value is used by the CGIs to locate the online documentation
+# and graphics.  If you access the Nagios pages with an URL like
+# http://www.myhost.com/nagios, this value should be '/nagios'
+# (without the quotes).
+
+url_html_path=/nagios4
+
+
+
+# CONTEXT-SENSITIVE HELP
+# This option determines whether or not a context-sensitive
+# help icon will be displayed for most of the CGIs.
+# Values: 0 = disables context-sensitive help
+#         1 = enables context-sensitive help
+
+show_context_help=1
+
+
+
+# PENDING STATES OPTION
+# This option determines what states should be displayed in the web
+# interface for hosts/services that have not yet been checked.
+# Values: 0 = leave hosts/services that have not been check yet in their original state
+#         1 = mark hosts/services that have not been checked yet as PENDING
+
+use_pending_states=1
+
+# NAGIOS PROCESS CHECK COMMAND
+# This is the full path and filename of the program used to check
+# the status of the Nagios process.  It is used only by the CGIs
+# and is completely optional.  However, if you don't use it, you'll
+# see warning messages in the CGIs about the Nagios process
+# not running and you won't be able to execute any commands from
+# the web interface.  The program should follow the same rules
+# as plugins; the return codes are the same as for the plugins,
+# it should have timeout protection, it should output something
+# to STDIO, etc.
+#
+# Note: The command line for the check_nagios plugin below may
+# have to be tweaked a bit, as different versions of the plugin
+# use different command line arguments/syntaxes.
+
+nagios_check_command=/usr/lib/nagios/plugins/check_nagios /var/cache/nagios4/status.dat 5 '/usr/sbin/nagios4'
+
+
+# AUTHENTICATION USAGE
+# This option controls whether or not the CGIs will use any
+# authentication when displaying host and service information, as
+# well as committing commands to Nagios for processing.
+#
+# Read the HTML documentation to learn how the authorization works!
+#
+# NOTE: It is a really *bad* idea to disable authorization, unless
+# you plan on removing the command CGI (cmd.cgi)!  Failure to do
+# so will leave you wide open to kiddies messing with Nagios and
+# possibly hitting you with a denial of service attack by filling up
+# your drive by continuously writing to your command file!
+#
+# Setting this value to 0 will cause the CGIs to *not* use
+# authentication (bad idea), while any other value will make them
+# use the authentication functions (the default).
+
+use_authentication=1
+
+
+
+
+# x509 CERT AUTHENTICATION
+# When enabled, this option allows you to use x509 cert (SSL)
+# authentication in the CGIs.  This is an advanced option and should
+# not be enabled unless you know what you're doing.
+
+use_ssl_authentication=0
+
+
+
+
+# DEFAULT USER
+# Setting this variable will define a default user name that can
+# access pages without authentication.  This allows people within a
+# secure domain (i.e., behind a firewall) to see the current status
+# without authenticating.  You may want to use this to avoid basic
+# authentication if you are not using a secure server since basic
+# authentication transmits passwords in the clear.
+#
+# Important:  Do not define a default username unless you are
+# running a secure web server and are sure that everyone who has
+# access to the CGIs has been authenticated in some manner!  If you
+# define this variable, anyone who has not authenticated to the web
+# server will inherit all rights you assign to this user!
+
+default_user_name=nagiosadmin
+
+
+
+# SYSTEM/PROCESS INFORMATION ACCESS
+# This option is a comma-delimited list of all usernames that
+# have access to viewing the Nagios process information as
+# provided by the Extended Information CGI (extinfo.cgi).  By
+# default, *no one* has access to this unless you choose to
+# not use authorization.  You may use an asterisk (*) to
+# authorize any user who has authenticated to the web server.
+
+authorized_for_system_information=*
+
+
+
+# CONFIGURATION INFORMATION ACCESS
+# This option is a comma-delimited list of all usernames that
+# can view ALL configuration information (hosts, commands, etc).
+# By default, users can only view configuration information
+# for the hosts and services they are contacts for. You may use
+# an asterisk (*) to authorize any user who has authenticated
+# to the web server.
+
+authorized_for_configuration_information=*
+
+
+
+# SYSTEM/PROCESS COMMAND ACCESS
+# This option is a comma-delimited list of all usernames that
+# can issue shutdown and restart commands to Nagios via the
+# command CGI (cmd.cgi).  Users in this list can also change
+# the program mode to active or standby. By default, *no one*
+# has access to this unless you choose to not use authorization.
+# You may use an asterisk (*) to authorize any user who has
+# authenticated to the web server.
+
+authorized_for_system_commands=*
+
+
+
+# GLOBAL HOST/SERVICE VIEW ACCESS
+# These two options are comma-delimited lists of all usernames that
+# can view information for all hosts and services that are being
+# monitored.  By default, users can only view information
+# for hosts or services that they are contacts for (unless you
+# you choose to not use authorization). You may use an asterisk (*)
+# to authorize any user who has authenticated to the web server.
+
+
+authorized_for_all_services=*
+authorized_for_all_hosts=*
+
+
+
+# GLOBAL HOST/SERVICE COMMAND ACCESS
+# These two options are comma-delimited lists of all usernames that
+# can issue host or service related commands via the command
+# CGI (cmd.cgi) for all hosts and services that are being monitored.
+# By default, users can only issue commands for hosts or services
+# that they are contacts for (unless you choose to not use
+# authorization).  You may use an asterisk (*) to authorize any
+# user who has authenticated to the web server.
+
+authorized_for_all_service_commands=*
+authorized_for_all_host_commands=*
+
+
+
+# READ-ONLY USERS
+# A comma-delimited list of usernames that have read-only rights in
+# the CGIs.  This will block any service or host commands normally shown
+# on the extinfo CGI pages.  It will also block comments from being shown
+# to read-only users.
+
+#authorized_for_read_only=user1,user2
+
+
+
+
+# STATUSMAP BACKGROUND IMAGE
+# This option allows you to specify an image to be used as a
+# background in the statusmap CGI.  It is assumed that the image
+# resides in the HTML images path (i.e. /usr/local/nagios/share/images).
+# This path is automatically determined by appending "/images"
+# to the path specified by the 'physical_html_path' directive.
+# Note:  The image file may be in GIF, PNG, JPEG, or GD2 format.
+# However, I recommend that you convert your image to GD2 format
+# (uncompressed), as this will cause less CPU load when the CGI
+# generates the image.
+
+#statusmap_background_image=smbackground.gd2
+
+
+
+
+# STATUSMAP TRANSPARENCY INDEX COLOR
+# These options set the r,g,b values of the background color used the statusmap CGI,
+# so normal browsers that can't show real png transparency set the desired color as
+# a background color instead (to make it look pretty).
+# Defaults to white: (R,G,B) = (255,255,255).
+
+#color_transparency_index_r=255
+#color_transparency_index_g=255
+#color_transparency_index_b=255
+
+
+
+
+# DEFAULT STATUSMAP LAYOUT METHOD
+# This option allows you to specify the default layout method
+# the statusmap CGI should use for drawing hosts.  If you do
+# not use this option, the default is to use user-defined
+# coordinates.  Valid options are as follows:
+#       0 = User-defined coordinates
+#       1 = Depth layers
+#       2 = Collapsed tree
+#       3 = Balanced tree
+#       4 = Circular
+#       5 = Circular (Marked Up)
+
+default_statusmap_layout=5
+
+
+
+# DEFAULT STATUSWRL LAYOUT METHOD
+# This option allows you to specify the default layout method
+# the statuswrl (VRML) CGI should use for drawing hosts.  If you
+# do not use this option, the default is to use user-defined
+# coordinates.  Valid options are as follows:
+#       0 = User-defined coordinates
+#       2 = Collapsed tree
+#       3 = Balanced tree
+#       4 = Circular
+
+default_statuswrl_layout=4
+
+
+
+# STATUSWRL INCLUDE
+# This option allows you to include your own objects in the
+# generated VRML world.  It is assumed that the file
+# resides in the HTML path (i.e. /usr/local/nagios/share).
+
+#statuswrl_include=myworld.wrl
+
+
+
+# PING SYNTAX
+# This option determines what syntax should be used when
+# attempting to ping a host from the WAP interface (using
+# the statuswml CGI.  You must include the full path to
+# the ping binary, along with all required options.  The
+# $HOSTADDRESS$ macro is substituted with the address of
+# the host before the command is executed.
+# Please note that the syntax for the ping binary is
+# notorious for being different on virtually ever *NIX
+# OS and distribution, so you may have to tweak this to
+# work on your system.
+
+ping_syntax=/bin/ping -n -U -c 5 $HOSTADDRESS$
+
+
+
+# REFRESH RATE
+# This option allows you to specify the refresh rate in seconds
+# of various CGIs (status, statusmap, extinfo, and outages).
+
+refresh_rate=90
+
+# DEFAULT PAGE LIMIT
+# This option allows you to specify the default number of results
+# displayed on the status.cgi.  This number can be adjusted from
+# within the UI after the initial page load. Setting this to 0
+# will show all results.
+
+# Zulip config: Show all results on the same page
+result_limit=0
+
+
+# ESCAPE HTML TAGS
+# This option determines whether HTML tags in host and service
+# status output is escaped in the web interface.  If enabled,
+# your plugin output will not be able to contain clickable links.
+
+escape_html_tags=1
+
+
+
+
+# SOUND OPTIONS
+# These options allow you to specify an optional audio file
+# that should be played in your browser window when there are
+# problems on the network.  The audio files are used only in
+# the status CGI.  Only the sound for the most critical problem
+# will be played.  Order of importance (higher to lower) is as
+# follows: unreachable hosts, down hosts, critical services,
+# warning services, and unknown services. If there are no
+# visible problems, the sound file optionally specified by
+# 'normal_sound' variable will be played.
+#
+#
+# <varname>=<sound_file>
+#
+# Note: All audio files must be placed in the /media subdirectory
+# under the HTML path (i.e. /usr/local/nagios/share/media/).
+
+#host_unreachable_sound=hostdown.wav
+#host_down_sound=hostdown.wav
+#service_critical_sound=critical.wav
+#service_warning_sound=warning.wav
+#service_unknown_sound=warning.wav
+#normal_sound=noproblem.wav
+
+
+
+# URL TARGET FRAMES
+# These options determine the target frames in which notes and
+# action URLs will open.
+
+action_url_target=_blank
+notes_url_target=_blank
+
+
+
+
+# LOCK AUTHOR NAMES OPTION
+# This option determines whether users can change the author name
+# when submitting comments, scheduling downtime.  If disabled, the
+# author names will be locked into their contact name, as defined in Nagios.
+# Values: 0 = allow editing author names
+#         1 = lock author names (disallow editing)
+
+lock_author_names=1
+
+
+
+
+# SPLUNK INTEGRATION OPTIONS
+# These options allow you to enable integration with Splunk
+# in the web interface.  If enabled, you'll be presented with
+# "Splunk It" links in various places in the CGIs (log file,
+# alert history, host/service detail, etc).  Useful if you're
+# trying to research why a particular problem occurred.
+# For more information on Splunk, visit http://www.splunk.com/
+
+# This option determines whether the Splunk integration is enabled
+# Values: 0 = disable Splunk integration
+#         1 = enable Splunk integration
+
+#enable_splunk_integration=1
+
+
+# This option should be the URL used to access your instance of Splunk
+
+#splunk_url=http://127.0.0.1:8000/

puppet/kandra/templates/nagios4/contacts.cfg.template.erb

@@ -0,0 +1,111 @@
+###############################################################################
+# contacts.cfg
+###############################################################################
+
+
+
+###############################################################################
+###############################################################################
+#
+# CONTACTS
+#
+###############################################################################
+###############################################################################
+
+define contact{
+        contact_name                    monitoring
+        alias                           Monitoring
+        service_notification_period     24x7
+        host_notification_period        24x7
+        service_notification_options    w,u,c,r
+        host_notification_options       d,r
+        service_notification_commands   notify-service-by-email
+        host_notification_commands      notify-host-by-email
+        email                           <%= @nagios_alert_email %>
+        }
+
+define contact{
+        contact_name                    test
+        alias                           Test Monitoring
+        service_notification_period     24x7
+        host_notification_period        24x7
+        service_notification_options    w,u,c,r
+        host_notification_options       d,r
+        service_notification_commands   notify-service-by-email
+        host_notification_commands      notify-host-by-email
+        email                           <%= @nagios_test_email %>
+        }
+
+define contact {
+       contact_name                             pager
+       alias                                    Pseudo-contact to an email that pages
+       service_notification_period              24x7
+       host_notification_period                 24x7
+       service_notification_options             w,u,c,r
+       host_notification_options                d,r
+       email                                    <%= @nagios_pager_email %>
+       service_notification_commands            notify-service-by-email
+       host_notification_commands               notify-host-by-email
+}
+
+define contact {
+       contact_name                    kandra-ops-in-czo
+       alias                           Notify kandra-ops on chat.zulip.org
+       service_notification_period     24x7
+       host_notification_period        24x7
+       service_notification_options    w,u,c,r
+       host_notification_options       d,r
+       service_notification_commands   notify-service-by-zulip
+       host_notification_commands      notify-host-by-zulip
+}
+
+define contact {
+       contact_name                    kandra-ops-in-czo-warnings
+       alias                           Notify kandra-ops on chat.zulip.org on warnings
+       service_notifications_enabled   1
+       host_notifications_enabled      0
+       service_notification_period     24x7
+       host_notification_period        24x7
+       service_notification_options    w,r
+       host_notification_options       n
+       service_notification_commands   notify-service-by-zulip
+       host_notification_commands      notify-host-by-zulip
+}
+
+###############################################################################
+###############################################################################
+#
+# CONTACT GROUPS
+#
+###############################################################################
+###############################################################################
+
+define contactgroup{
+        contactgroup_name       admins
+        alias                   Nagios Administrators
+        members                 monitoring
+        }
+
+define contactgroup{
+        contactgroup_name       page_admins
+        alias                   Nagios Administrators
+        members                 monitoring,pager
+        }
+
+define contactgroup{
+        contactgroup_name       page_admins_and_warn_czo
+        alias                   Nagios Administrators
+        members                 monitoring,pager,kandra-ops-in-czo-warnings
+        }
+
+define contactgroup{
+        contactgroup_name       ops_message
+        alias                   Message admins on CZO
+        members                 monitoring,kandra-ops-in-czo
+}
+
+define contactgroup{
+        contactgroup_name       test
+        alias                   Nagios Test Administrators
+        members                 test
+        }

puppet/kandra/templates/nagios4/hosts.cfg.template.erb

@@ -0,0 +1,79 @@
+<% @hosts_fullstack.each do |host| -%>
+define host{
+       use              generic-host
+       host_name        <%= host %>
+       alias            <%= host %>
+       address          <%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %>
+       hostgroups       all,fullstack,non_aws_host,frontends,not_pageable_servers,postgresql
+       }
+<% end -%>
+
+<% @hosts_app_prod.each do |host| -%>
+define host{
+       use              generic-host
+       host_name        <%= host %>
+       alias            <%= host %>
+       address          <%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %>
+       hostgroups       all,aws_host,prod_frontends,pageable_servers
+       }
+<% end -%>
+
+<% @hosts_app_staging.each do |host| -%>
+define host{
+       use              generic-host
+       host_name        <%= host %>
+       alias            <%= host %>
+       address          <%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %>
+       hostgroups       all,aws_host,staging_frontends,not_pageable_servers
+       }
+<% end -%>
+
+<% @hosts_postgresql_primary.each do |host| -%>
+define host{
+       use              generic-host
+       host_name        <%= host %>
+       alias            <%= host %>
+       address          <%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %>
+       hostgroups       all,aws_host,postgresql_primary,pageable_servers
+       }
+<% end -%>
+
+<% @hosts_postgresql_replica.each do |host| -%>
+define host{
+       use              generic-host
+       host_name        <%= host %>
+       alias            <%= host %>
+       address          <%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %>
+       hostgroups       all,aws_host,postgresql_replica,pageable_servers
+       }
+<% end -%>
+
+<% @hosts_redis.each do |host| -%>
+define host{
+       use              generic-host
+       host_name        <%= host %>
+       alias            <%= host %>
+       address          <%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %>
+       hostgroups       all,aws_host,not_pageable_servers, redis
+       }
+<% end -%>
+
+<% @hosts_smokescreen.each do |host| -%>
+define host{
+       use              generic-host
+       host_name        <%= host %>
+       alias            <%= host %>
+       address          <%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %>
+       hostgroups       all,aws_host,pageable_servers,smokescreen
+       }
+<% end -%>
+
+<% @hosts_other.each do |host| -%>
+define host{
+       use              generic-host
+       host_name        <%= host %>
+       alias            <%= host %>
+       address          <%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %>
+       hostgroups       all,<% if host.include?(".") %>non_<% end %>aws_host,not_pageable_servers,other
+       }
+<% end -%>

puppet/kandra/templates/nagios4/localhost.cfg.template.erb

@@ -0,0 +1,62 @@
+define host{
+        use                     generic-host
+        host_name               nagios
+        alias                   nagios
+        address                 127.0.0.1
+        hostgroups              all
+}
+
+define service{
+        use                             generic-service
+        host_name                       nagios
+        service_description             Current Users
+        check_command                   check_users!20!50
+}
+
+define service{
+        use                             generic-service
+        host_name                       nagios
+        service_description             Total Processes
+        check_command                   check_procs_nokthreads!500!650
+}
+
+define service{
+        use                             generic-service
+        host_name                       nagios
+        service_description             Disk Space
+        check_command                   check_local_disk!20%!10%
+}
+
+define service{
+        use                             generic-service
+        host_name                       nagios
+        service_description             Current Load
+        check_command                   check_load!7.0!6.0!5.0!10.0!8.0!6.0
+}
+
+
+
+### External resources, only run on localhost
+
+define service{
+        use                             generic-service
+        host_name                       nagios
+        service_description             Check Camo is operational
+        check_command                   check_camo!<%= @nagios_camo_check_host %>!<%= @nagios_camo_check_path %>!6!12
+}
+
+define service {
+        use                             generic-service
+        service_description             Check desktop APT repository
+        host_name                       nagios
+        check_command                   check_apt_repo_status!download.zulip.com!/desktop/apt
+        contact_groups                  admins
+}
+
+define service {
+        use                             generic-service
+        service_description             Check chat.fhir.org cert
+        host_name                       nagios
+        check_command                   check_ssl_certificate!chat.fhir.org
+        contact_groups                  admins
+}

puppet/kandra/templates/nagios_apache_site.conf.template.erb

@@ -0,0 +1,40 @@
+<VirtualHost 127.0.0.1>
+    ServerName nagios.teleport.<%= @default_host_domain %>
+
+    Header add Strict-Transport-Security "max-age=31536000; includeSubdomains; preload"
+    Header add X-Frame-Options DENY
+
+    ScriptAlias /cgi-bin/nagios4 /usr/lib/cgi-bin/nagios4
+    ScriptAlias /nagios4/cgi-bin /usr/lib/cgi-bin/nagios4
+
+    # Where the stylesheets (config files) reside
+    Alias /nagios4/stylesheets /etc/nagios4/stylesheets
+
+    # Where the HTML pages live
+    Alias /nagios4 /usr/share/nagios4/htdocs
+
+    <Location "/">
+        Require all granted
+    </Location>
+
+    RedirectMatch ^/?$ https://nagios.teleport.<%= @default_host_domain %>/cgi-bin/nagios4/status.cgi?host=all
+
+    <DirectoryMatch (/usr/share/nagios4/htdocs|/usr/lib/cgi-bin/nagios4|/etc/nagios4/stylesheets)>
+        Options FollowSymLinks
+
+        DirectoryIndex index.php index.html
+
+        Order Allow,Deny
+        Allow From All
+    </DirectoryMatch>
+
+    <Directory /usr/share/nagios4/htdocs>
+        Options +ExecCGI
+    </Directory>
+
+    # Enable this ScriptAlias if you want to enable the grouplist patch.
+    # See http://apan.sourceforge.net/download.html for more info
+    # It allows you to see a clickable list of all hostgroups in the
+    # left pane of the Nagios web interface
+    ScriptAlias /nagios4/side.html /usr/lib/cgi-bin/nagios4/grouplist.cgi
+</VirtualHost>

puppet/kandra/templates/nagios_autossh.template.erb

@@ -0,0 +1,6 @@
+define service{
+        use                             generic-service
+        host_name                       nagios
+        service_description             Number of autossh processes
+        check_command                   check_named_procs!autossh!<%= @hosts.length %>:<%= @hosts.length %>!<%= @hosts.length %>:<%= @hosts.length + 2 %>
+        }

puppet/kandra/templates/prometheus/grok_exporter.yaml.template.erb

@@ -0,0 +1,69 @@
+global:
+  config_version: 3
+input:
+  type: file
+  path: /var/log/nginx/access.log
+  fail_on_missing_logfile: false
+  readall: false
+imports:
+- type: grok_patterns
+  dir: <%= @include_dir %>
+grok_patterns:
+  - 'NONQUERY [^? ]+'
+  - 'OPTIONALQUERY (?:\?%{NOTSPACE})?'
+  - 'APIPATH /+(api/v1|json)(?<apipath>/(events|users/me/presence|messages(/flags)?|remotes/push/(register|unregister|notify)|remotes/server/(register|analytics|analytics/status)|typing|register|server_settings|tus/))'
+  - 'EXTERNALPATH /+(?<external>api/v1/external/)[a-zA-Z0-9_-]+'
+  - 'ROOTPATH (?<rootpath>/+)'
+  - 'TOPPATH /+(?<toppath>(api/internal/(email_mirror_message|tusd)|compatibility|error_tracing))'
+  - 'PREFIXPATH /+(?<prefixpath>(static|user_uploads|avatar|api/v1/tus)/)\S+'
+  - 'ANYPATH (%{APIPATH}|%{EXTERNALPATH}|%{TOPPATH}|%{PREFIXPATH}|%{ROOTPATH}|%{NONQUERY:otherpath})%{OPTIONALQUERY}'
+  - 'OURHOSTNAME (?<hostname>((?<realm><%= @realm_names_regex %>)|%{NOTSPACE}))'
+  - 'OURLOG %{IPORHOST:clientip} - \S+ \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{ANYPATH} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{OURHOSTNAME} %{NUMBER:response_time}'
+metrics:
+- type: counter
+  name: nginx_http_response_codes_total
+  help: Total number of requests, by response code, normalized path, and HTTP method
+  match: '%{OURLOG}'
+  labels:
+    code: '{{.response}}'
+    method: '{{.verb}}'
+    path: '{{if .apipath}}/api/v1{{.apipath}}{{else if .external}}/api/v1/external/...{{else if .rootpath}}{{if .realm}}/{{else}}(other){{end}}{{else if .toppath}}/{{.toppath}}{{else if .prefixpath}}/{{.prefixpath}}...{{else}}(other){{end}}'
+- type: counter
+  name: nginx_http_response_bytes
+  help: Total number of bytes, by normalized path
+  match: '%{OURLOG}'
+  value: '{{.bytes}}'
+  labels:
+    path: '{{if .apipath}}/api/v1{{.apipath}}{{else if .external}}/api/v1/external/...{{else if .rootpath}}{{if .realm}}/{{else}}(other){{end}}{{else if .toppath}}/{{.toppath}}{{else if .prefixpath}}/{{.prefixpath}}...{{else}}(other){{end}}'
+- type: histogram
+  name: nginx_http_response_time_seconds
+  help: Response time in seconds, from first request byte to last response byte
+  match: '%{OURLOG}'
+  value: '{{.response_time}}'
+  buckets:
+    - 0.001
+    - 0.002
+    - 0.005
+    - 0.010
+    - 0.025
+    - 0.050
+    - 0.100
+    - 0.200
+    - 0.500
+    - 1.000
+    - 2.000
+    - 5.000
+    - 10.00
+    - 20.00
+    - 50.00
+    - 60.00
+    - 120.0
+  labels:
+    code: '{{.response}}'
+    method: '{{.verb}}'
+    path: '{{if .apipath}}/api/v1{{.apipath}}{{else if .external}}/api/v1/external/...{{else if .rootpath}}{{if .realm}}/{{else}}(other){{end}}{{else if .toppath}}/{{.toppath}}{{else if .prefixpath}}/{{.prefixpath}}...{{else}}(other){{end}}'
+
+server:
+  protocol: http
+  host: 127.0.0.1
+  port: 9144

puppet/kandra/templates/prometheus/prometheus.yaml.template.erb

@@ -0,0 +1,157 @@
+global:
+  # Set the scrape interval to every 15 seconds. Default is every 1 minute.
+  scrape_interval: 15s
+  # Evaluate rules every 15 seconds. The default is every 1 minute.
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: "prometheus"
+    static_configs:
+      - targets: ["localhost:9090"]
+
+  - job_name: "grafana"
+    static_configs:
+      - targets: ["localhost:3000"]
+
+  - job_name: "pushgateway"
+    scrape_interval: 2m
+    honor_labels: true
+    static_configs:
+      - targets: ["localhost:9091"]
+
+  - job_name: "wal-g"
+    scrape_interval: 5m
+    scrape_timeout: 20s
+    static_configs:
+      - targets:
+<% @backup_buckets.each do |bucket| -%>
+        - <%= bucket %>
+<% end -%>
+    relabel_configs:
+      - source_labels: [__address__]
+        target_label: __param_bucket
+      - source_labels: [__param_bucket]
+        target_label: bucket
+      - target_label: __address__
+        replacement: localhost:9188
+
+  - job_name: "vector"
+    scrape_interval: 30s
+    scrape_timeout: 3s
+    static_configs:
+      - targets: ["localhost:9081"]
+
+  - job_name: "node"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=node_exporter"
+        refresh_interval: 1m
+    relabel_configs: &relabels
+      # This relabel config is reused across all teleport-sd scrape configs.  Because
+      # of https://github.com/prometheus/prometheus/issues/2347 (lack of <<: support),
+      # we include some exporter-specific rules in here, with a source_label/regex pair.
+      - source_labels: ["exporter"]
+        regex: rabbitmq
+        # Rabbitmq should use the heaver-weight but more useful per-object endpoint
+        target_label: __metrics_path__
+        replacement: "/metrics/per-object"
+      - source_labels: ["role"]
+        regex: "(prod|staging)_app_frontend"
+        # Prod and staging get a deploy=
+        replacement: "${1}"
+        target_label: "deploy"
+      - source_labels: ["role"]
+        regex: "chat"
+        # So does chat.zulip.org
+        replacement: "prod"
+        target_label: "deploy"
+      - source_labels: ["exporter"]
+        regex: "node_exporter"
+        # The historical node_exporter data does not like getting a surprise deploy=
+        # label, so strip it off
+        target_label: "deploy"
+        replacement: ""
+      - action: labeldrop
+        # Finally, strip Teleport-specific labels
+        regex: "type|exporter|name"
+
+  - job_name: "camo"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=camo"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "smokescreen"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=smokescreen"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "redis"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=redis_exporter"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "postgres"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=postgres_exporter"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "access_logs"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=grok_exporter"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "uwsgi"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=uwsgi_exporter"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "rabbitmq"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=rabbitmq"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "tornado"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=process_exporter"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "memcached"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=memcached_exporter"
+        refresh_interval: 1m
+    relabel_configs: *relabels
+
+  - job_name: "tusd"
+    proxy_url: "http://127.0.0.1:8080"
+    scheme: http
+    http_sd_configs:
+      - url: "http://127.0.0.1:9092/targets?type=prometheus&exporter=tusd"
+        refresh_interval: 1m
+    relabel_configs: *relabels

puppet/kandra/templates/supervisor/conf.d/autossh_tunnels.conf.erb

@@ -0,0 +1,23 @@
+; This file was auto-generated by Puppet.  Do not edit by hand.
+
+<%
+i = 0
+@hosts.each do |host|
+-%>
+[program:autossh-tunnel-<%= host %>]
+environment=AUTOSSH_DEBUG=1
+command=bash -c 'exec autossh -N -M <%= 20000 + 2 * i %> -o ControlMaster=yes nagios@<%= host %><% unless host.include?(".") %>.<%= @default_host_domain %><% end %> 2>&1 | ts "%%b %%d %%H:%%M:%%.S"'
+priority=200                   ; the relative start priority (default 999)
+autostart=true                 ; start at supervisord start (default: true)
+autorestart=true               ; whether/when to restart (default: unexpected)
+stopsignal=TERM                 ; signal used to kill process (default TERM)
+stopwaitsecs=30                ; max num secs to wait b4 SIGKILL (default 10)
+stopasgroup=true
+user=nagios                    ; setuid to this UNIX account to run the program
+redirect_stderr=true           ; redirect proc stderr to stdout (default false)
+stdout_logfile=/var/log/zulip/autossh.<%= host %>.log         ; stdout log path, NONE for none; default AUTO
+
+<%
+i += 1
+end
+-%>

puppet/kandra/templates/supervisor/conf.d/grafana.conf.erb

@@ -0,0 +1,7 @@
+[program:grafana]
+command=<%= @bin %> -config /etc/grafana/grafana.ini
+directory=<%= @dir %>
+priority=15
+autostart=true
+autorestart=true
+user=grafana

puppet/kandra/templates/supervisor/conf.d/memcached_exporter.conf.template.erb

@@ -0,0 +1,12 @@
+[program:memcached_exporter]
+# We record the hash of the script so that we can update this file
+# with it, which will make `supervisorctl reread && supervisorctl
+# update` restart this job.
+command=<%= @bin %>
+process_name=memcached_exporter_<%= @exporter_hash %>
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/memcached_exporter.log

puppet/kandra/templates/supervisor/conf.d/mirror_to_czo.conf.template.erb

@@ -0,0 +1,13 @@
+[program:mirror_to_czo]
+# We record the hash of the script so that we can update this file
+# with it, which will make `supervisorctl reread && supervisorctl
+# update` restart this job.
+command=uv run --no-sync /usr/local/bin/mirror_to_czo
+directory=/home/zulip/deployments/current/
+process_name=mirror_to_czo_<%= @script_hash %>
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/mirror_to_czo.log

puppet/kandra/templates/supervisor/conf.d/prometheus.conf.template.erb

@@ -0,0 +1,9 @@
+[program:prometheus]
+command=<%= @bin %> --storage.tsdb.path="<%= @data_dir %>" --config.file="/etc/prometheus/prometheus.yaml" --web.listen-address="127.0.0.1:9090" --storage.tsdb.retention.time=1y
+directory=<%= @dir %>
+priority=10
+autostart=true
+autorestart=true
+user=prometheus
+redirect_stderr=true
+stdout_logfile=/var/log/prometheus.log

puppet/kandra/templates/supervisor/conf.d/prometheus_grok_exporter.conf.template.erb

@@ -0,0 +1,8 @@
+[program:prometheus_grok_exporter]
+command=<%= @bin %> -config /etc/grok_exporter.yaml
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/grok_exporter.log

puppet/kandra/templates/supervisor/conf.d/prometheus_node_exporter.conf.template.erb

@@ -0,0 +1,8 @@
+[program:prometheus_node_exporter]
+command=<%= @bin %> --collector.supervisord --collector.supervisord.url=unix:///var/run/supervisor.sock --no-collector.hwmon --web.listen-address=127.0.0.1:9100
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/node_exporter.log

puppet/kandra/templates/supervisor/conf.d/prometheus_postgres_exporter.conf.template.erb

@@ -0,0 +1,9 @@
+[program:prometheus_postgres_exporter]
+command=<%= @bin %> --collector.stat_user_indexes --web.listen-address=127.0.0.1:9187
+environment=DATA_SOURCE_NAME="postgresql://prometheus@:5432/zulip?host=/var/run/postgresql"
+priority=10
+autostart=true
+autorestart=true
+user=prometheus
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/postgres_exporter.log

puppet/kandra/templates/supervisor/conf.d/prometheus_process_exporter.conf.template.erb

@@ -0,0 +1,8 @@
+[program:prometheus_process_exporter]
+command=<%= @bin %> -config.path <%= @conf %> -recheck-with-time-limit 1m -web.listen-address 127.0.0.1:9256
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/process_exporter.log

puppet/kandra/templates/supervisor/conf.d/prometheus_pushgateway.conf.template.erb

@@ -0,0 +1,8 @@
+[program:prometheus_pushgateway]
+command=<%= @bin %> --web.listen-address=127.0.0.1:9091
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/pushgateway.log

puppet/kandra/templates/supervisor/conf.d/prometheus_redis_exporter.conf.template.erb

@@ -0,0 +1,8 @@
+[program:prometheus_redis_exporter]
+command=/usr/local/bin/secret-env-wrapper REDIS_PASSWORD=redis_password <%= @bin %> --web.listen-address=127.0.0.1:9121
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/redis_exporter.log

puppet/kandra/templates/supervisor/conf.d/prometheus_uwsgi_exporter.conf.template.erb

@@ -0,0 +1,8 @@
+[program:prometheus_uwsgi_exporter]
+command=<%= @bin %> --stats.uri=unix:///home/zulip/deployments/uwsgi-stats --web.listen-address=127.0.0.1:9238
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/uwsgi_exporter.log

puppet/kandra/templates/supervisor/conf.d/prometheus_wal_g_exporter.conf.template.erb

@@ -0,0 +1,12 @@
+[program:prometheus_wal_g_exporter]
+# We record the hash of the script so that we can update this file
+# with it, which will make `supervisorctl reread && supervisorctl
+# update` restart this job.
+command=/usr/local/bin/wal-g-exporter
+process_name=wal-g-exporter_<%= @exporter_hash %>
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/wal_g_exporter.log

puppet/kandra/templates/supervisor/conf.d/redis_tunnel.conf.template.erb

@@ -0,0 +1,8 @@
+[program:redis-tunnel]
+command=autossh -M 0 -N -L 127.0.0.1:6379:127.0.0.1:6379 -o ServerAliveInterval=30 -o ServerAliveCountMax=3 <%= @redis_hostname %>
+priority=50
+user=redistunnel
+autostart=true
+autorestart=true
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/redis_tunnel.log

puppet/kandra/templates/supervisor/conf.d/statuspage-pusher.conf.template.erb

@@ -0,0 +1,8 @@
+[program:statuspage-pusher]
+command=<%= @bin %>
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/statuspage-pusher.log

puppet/kandra/templates/supervisor/conf.d/teleport-sd.conf.erb

@@ -0,0 +1,6 @@
+[program:teleport-sd]
+command=<%= @bin %> --listen 127.0.0.1:9092 --proxy teleport.zulipchat.net:443 --identity /var/lib/teleport/bot-identity/identity
+priority=15
+autostart=true
+autorestart=true
+user=teleport

puppet/kandra/templates/supervisor/conf.d/vector.conf.template.erb

@@ -0,0 +1,8 @@
+[program:vector]
+command=<%= @bin %> --config <%= @conf %> --require-healthy true
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/vector.log

puppet/kandra/templates/supervisor/conf.d/weblate_exporter.conf.template.erb

@@ -0,0 +1,12 @@
+[program:weblate_exporter]
+# We record the hash of the script so that we can update this file
+# with it, which will make `supervisorctl reread && supervisorctl
+# update` restart this job.
+command=<%= @bin %>
+process_name=weblate_exporter_<%= @exporter_hash %>
+priority=10
+autostart=true
+autorestart=true
+user=zulip
+redirect_stderr=true
+stdout_logfile=/var/log/zulip/weblate_exporter.log

puppet/kandra/templates/teleport.service.template.erb

@@ -0,0 +1,15 @@
+[Unit]
+Description=Teleport <%= @part %> Service
+After=network.target
+
+[Service]
+Type=simple
+Restart=on-failure
+EnvironmentFile=-/etc/default/teleport_<%= @part %>
+ExecStart=/usr/local/bin/teleport start --pid-file=/run/teleport_<%= @part %>.pid --config=/etc/teleport_<%= @part %>.yaml
+ExecReload=/bin/kill -HUP $MAINPID
+PIDFile=/run/teleport_<%= @part %>.pid
+LimitNOFILE=524288
+
+[Install]
+WantedBy=multi-user.target

puppet/kandra/templates/teleport_db.yaml.template.erb

@@ -0,0 +1,49 @@
+# See https://goteleport.com/docs/config-reference/ and
+# https://goteleport.com/docs/database-access/guides/postgres-self-hosted/
+#
+# This establishes a reverse proxy back to the central auth server,
+# allowing that to connect to the postgres server running on
+# localhost:5432.  Auth is checked using role-based access control,
+# which determines which hosts, databases, and database users the
+# remote user is allowed to connect to.
+teleport:
+  ca_pin: "sha256:062db37249ea74c450579da8f02043b317cb8a174d653bb5090a89752d68efe7"
+  auth_servers:
+    # Use the proxy address, to support running the db_service, which requires
+    # a reverse tunnel.
+    - teleport.zulipchat.net:443
+<% if @is_ec2 -%>
+  join_params:
+    method: iam
+    token_name: iam-token
+<% else -%>
+  join_params:
+    method: token
+    token_name: <%= @join_token %>
+<% end %>
+
+ssh_service:
+  enabled: no
+app_service:
+  enabled: no
+proxy_service:
+  enabled: no
+auth_service:
+  enabled: no
+
+db_service:
+  enabled: yes
+  databases:
+    - name: "<%= @hostname %>"
+      protocol: "postgres"
+      uri: "<%= @fqdn %>:5432"
+      static_labels:
+        hostname: "<%= @hostname %>"
+      dynamic_labels:
+        # Every hour, refresh the label that describes if this
+        # instance is a replica; this allows access to be granted only
+        # to replicas.
+        - name: "is_replica"
+          command:
+            ["sudo", "-u", "zulip", "psql", "-tc", "select pg_is_in_recovery()"]
+          period: 1h

puppet/kandra/templates/teleport_node.yaml.template.erb

@@ -0,0 +1,42 @@
+# See https://goteleport.com/docs/config-reference/
+teleport:
+  ca_pin: "sha256:062db37249ea74c450579da8f02043b317cb8a174d653bb5090a89752d68efe7"
+  auth_servers:
+    # Use the proxy address, to support running the app_service, which requires
+    # a reverse tunnel.
+    - teleport.zulipchat.net:443
+<% if @is_ec2 -%>
+  join_params:
+    method: iam
+    token_name: iam-token
+<% else -%>
+  join_params:
+    method: token
+    token_name: <%= @join_token %>
+<% end %>
+ssh_service:
+  enabled: "yes"
+  commands:
+    - name: hostname
+      command: ["/bin/hostname"]
+      period: 1h0m0s
+    - name: uname
+      command: ["/usr/bin/uptrack-uname", "-r"]
+      period: 1h0m0s
+    - name: distro
+      command:
+        ["/bin/sh", "-c", '. /etc/os-release && printf "%s\n" "$PRETTY_NAME"']
+      period: 1h0m0s
+    - name: classes
+      command:
+        - /usr/bin/crudini
+        - --get
+        - /etc/zulip/zulip.conf
+        - machine
+        - puppet_classes
+      period: 1h0m0s
+
+proxy_service:
+  enabled: no
+auth_service:
+  enabled: no

puppet/kandra/templates/uptrack/uptrack.conf.erb

@@ -0,0 +1,66 @@
+[Auth]
+accesskey = <%= @ksplice_access_key %>
+
+[Network]
+# Proxy to use when accessing the Uptrack server, of the form
+# [protocol://][username:password@]<host>[:port], where
+# * protocol is the protocol to connect to the proxy (http or https)
+# * the username and password are the authentication
+#   information needed to use your proxy (if any).
+# * host and port are the hostname/ip address and port number used to
+#   connect to the proxy
+#
+# The proxy must support making HTTPS connections. If this is unset,
+# Uptrack will look for the https_proxy, HTTPS_PROXY, and http_proxy
+# environment variables in that order, and then finally look for a
+# proxy setting in the system-wide GConf database, if available and
+# enabled below.
+#
+# You can also set this to "None" to force Uptrack not to use a proxy,
+# even if one is set in the environment.
+https_proxy =
+
+# Look for proxy setting in the system-wide GConf database, if it's
+# not set in the above variable or in an environment variable.
+#
+# This is broken in later versions of Ubuntu (and other distros too)
+# so we disable this by default. See LP: #812940.
+gconf_proxy_lookup = no
+
+### Uptrack Local Server options ###
+
+# The path to the CA certificate file used to verify the Uptrack
+# server.
+#ssl_ca_cert_file =
+
+# The directory for CA certificate files used to verify the Uptrack
+# server.
+#ssl_ca_cert_dir =
+
+# The location of the Uptrack updates repository.
+#update_repo_url=
+
+### End of Uptrack Local Server options ###
+
+[Settings]
+# Automatically install updates at boot time. If this is set, on
+# reboot into the same kernel, Uptrack will re-install the same set of
+# updates that were present before the reboot.
+install_on_reboot = yes
+
+# Automatically install all available updates at boot time, even if
+# rebooted into a different kernel.
+#upgrade_on_reboot = yes
+
+# Uptrack runs in a cron job every few hours to check for and download
+# new updates. You can configure this cron job to automatically
+# install new updates as they become available.
+#
+# Enable this option to make the cron job automatically install new
+# updates.
+#
+# Please note that enabling autoinstall does not mean the Uptrack
+# client itself is automatically upgraded. You will be notified via
+# e-mail when a new Uptrack client is available, and it can be
+# upgraded through your package manager.
+autoinstall = yes

puppet/kandra/templates/vector_akamai.toml.template.erb

@@ -0,0 +1,62 @@
+# Akamai Datastream2 logs all accesses into AWS S3:
+# https://techdocs.akamai.com/datastream2/docs/stream-amazon-s3
+#
+# The S3 bucket is configured to send event notifications to the SQS
+# queue, which this host is allowed to read from.  This consumer
+# deletes the messages from the queue, and the S3 bucket is
+# configured to purge old logs.
+# https://vector.dev/docs/reference/configuration/sources/aws_s3/
+
+<% @pipelines.each do |key,sqs_url| %>
+[sources.s3_akamai_<%= key %>]
+  type = "aws_s3"
+  region = "us-east-1"
+  compression = "gzip"
+  sqs.delete_message = true
+  sqs.poll_secs = 15
+  sqs.queue_url = "<%= sqs_url %>"
+
+[transforms.akamai_parse_<%= key %>]
+  type = "remap"
+  inputs = ["s3_akamai_<%= key %>"]
+  source = '''
+  . = parse_json!(string!(.message))
+  .turnAroundTimeSec = to_int!(.turnAroundTimeMSec) / 1000.0
+  '''
+
+[transforms.akamai_logs2metrics_<%= key %>]
+  type = "log_to_metric"
+  inputs = ["akamai_parse_<%= key %>"]
+
+  [[transforms.akamai_logs2metrics_<%= key %>.metrics]]
+    field = "cacheStatus"
+    name = "requests_cache_count"
+    namespace = "akamai_<%= key %>"
+    type = "counter"
+      [transforms.akamai_logs2metrics_<%= key %>.metrics.tags]
+      status_code = "{{statusCode}}"
+      cached = "{{cacheStatus}}"
+      host = "{{reqHost}}"
+
+  [[transforms.akamai_logs2metrics_<%= key %>.metrics]]
+    field = "bytes"
+    name = "requests_bytes"
+    namespace = "akamai_<%= key %>"
+    type = "counter"
+    increment_by_value = true
+      [transforms.akamai_logs2metrics_<%= key %>.metrics.tags]
+      status_code = "{{statusCode}}"
+      cached = "{{cacheStatus}}"
+      host = "{{reqHost}}"
+
+  [[transforms.akamai_logs2metrics_<%= key %>.metrics]]
+    field = "turnAroundTimeSec"
+    name = "turnaround_time_sec"
+    namespace = "akamai_<%= key %>"
+    type = "histogram"
+      [transforms.akamai_logs2metrics_<%= key %>.metrics.tags]
+      status_code = "{{statusCode}}"
+      cached = "{{cacheStatus}}"
+      host = "{{reqHost}}"
+
+<% end %>

puppet/kandra/templates/vector_ses.toml.template.erb

@@ -0,0 +1,25 @@
+# SES writes all of its logs to a single SQS queue; we consume them,
+# batch them, and write them to files in S3 for later analysis.
+[sources.ses_logs_sqs]
+  type = "aws_sqs"
+  queue_url = "<%= @ses_logs_sqs_url %>"
+
+[transforms.extract_ses_message]
+  type = "remap"
+  inputs = ["ses_logs_sqs"]
+  # SES puts its JSON into the text .Message field of the SQS JSON
+  # event, which itself is serialized before we get it
+  source = '''
+  . = parse_json!(string!(.message)).Message
+  '''
+
+[sinks.ses_logs_s3]
+  type = "aws_s3"
+  inputs = ["extract_ses_message"]
+  bucket = "<%= @ses_logs_s3_bucket %>"
+  compression = "gzip"
+  batch.max_bytes = 10000000  # 100k, before compression
+  batch.timeout_secs = 300    # ..or 5min, whichever is first
+  encoding.codec = "text"
+  key_prefix = "%F/"
+  storage_class = "STANDARD_IA"