Thank you for your reply, it seems we’re on the same page.
It’s a specific product that will be installed in hundreds-to-thousands of sites distributed over different locations and countries, so it sounds to be really public.
I also have the same thoughts about using a dedicated satellite with specific permission and preferable for using certificate-based authentication. At this moment I only need a hostalive check, which makes it a little bit easier and will be implemented using heartbeats to icinga’s process-check-result api.
Besides that, our servers use to be hardened, secured, and patch managed. So my main concern is because icinga API allowed several kinds of actions that I intend to restrict via user’s permissions settings (allow only process-check-result).
Is it possible to restrict it only for GET (read-only) queries?