Icinga local installation powershell

Terrorkkar · July 18, 2024, 4:54am

Hello all,

My servers dont have access to the web and i chose in self service API settings to install agent from local network. The path and everything is there, i regenerated the selfservice API key but when i run it, it again tries to download the agent from the web… Im using the kickstart script from the Agent tab in host template

Do you know how i can control this? I have the installation on a network drive and all it needs is to either install it from there or dont install it at all. Possilby i run the SCCM first to install agent.msi, for kickstart script to only configure it later for me.

BR,
Terro

moreamazingnick · July 18, 2024, 6:28am

you can place the binaries on a internal webserver or networkshare

you have to set the agent version here too in order for icinga director to provide the right url to the binary

Terrorkkar · July 18, 2024, 10:33am

I found out that the problem is the kickstart powershell script from: https://packages.icinga.com/IcingaForWindows/stable/ifw.repo.json

Is there a way to use the selfservice script without it going looking to the internet for the PS, i can provide the file locally on file server.

Or would that require rewriting of the whole script?

Thank you,
Terro

moreamazingnick · July 18, 2024, 10:47am

which script do you use?

Terrorkkar · July 18, 2024, 11:32am

The script im using is:

[Net.ServicePointManager]::SecurityProtocol = 'tls12, tls11';
$ProgressPreference                         = 'SilentlyContinue';
[string]$ScriptFile                         = 'C:\Users\Public\IcingaForWindows.ps1';

Invoke-WebRequest `
    -UseBasicParsing `
    -Uri             'https://packages.icinga.com/IcingaForWindows/IcingaForWindows.ps1' `
    -OutFile         $ScriptFile;

& $ScriptFile `
    -ModuleDirectory  'C:\Program Files\WindowsPowerShell\Modules\' `
    -InstallCommand   '{"IfW-DirectorSelfServiceKey":{"Values":["aaaaaaaaaaaaaaaaaaaaaaaa"]},"IfW-DirectorUrl":{"Values":["http://icinga/icingaweb2/director/"]},"IfW-StableRepository":{"Values":["https://packages.icinga.com/IcingaForWindows/stable"]}}' `
    -IcingaRepository 'https://packages.icinga.com/IcingaForWindows/stable/ifw.repo.json'

This is the script provided by the director selfservice, to be used to deploy a certain host template.

I have also tried the Offline kickstart script:

$global:IcingaFrameworkKickstartSource = 'C:\icinga\kickstart\icinga-powershell-kickstart.ps1';

$Script = Get-Content -Path $global:IcingaFrameworkKickstartSource -Raw;
$Script += "`r`n`r`n Start-IcingaFrameworkWizard;";

Invoke-Command -ScriptBlock ([Scriptblock]::Create($Script));

This one errors out:

[Error]: Unable to load the Icinga PowerShell Framework. Please check your PowerShell execution policies for possible problems. Error: System.Management.Automation.CommandNotFoundException: Th
e term 'Use-Icinga' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path
 is correct and try again.
   at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception)
   at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
   at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)

moreamazingnick · July 18, 2024, 12:38pm

the kickstarter is deprecated.

you can use the icinga powersehll framework to create a local mirror of packages.icinga.com

github.com

Icinga/icinga-powershell-framework/blob/master/doc/120-Repository-Manager/02-Sync-Repositories.md?plain=1

# Sync Repositories

In case you require local copies of repositories to frequently access them or to make a public repository available for systems unable to access public spaces, you can use `Sync-IcingaRepository`.

Like with [adding existing repositories](01-Add-Repositories.md), each synced repositories require a unique name you can set with `-Name`. The name will not interfere on how the sync works.

## Available Arguments

| Argument     | Type   | Description                                                                     |
| ---          |---     | ---                                                                             |
| Name         | String | The unique name of the repository. This name can only exist once on your system |
| Path         | String | The location on where the files from the remote repository will be synced to. This can either be a local path, a network share or a Linux path, including user and hostname like `icinga@example.com:/vaw/www/icingarepo/`
| RemotePath   | String | The path pointing to the location Icinga for Windows tries to lookup all your files. You can either replicate the `Path` variable for network shares for example, or use a web url which is made available based on `Path` to fetch and download files from. If left empty, it will default to the `Path` variable content |
| Source       | String | The source from where the repository will be synced from. This can either be pointing directly to the `ifw.repo.json` or the root directory, as long as the file is fetch able from this point. A source can be a web, local or network share |
| UseSCP       | Switch | If you set `Path` to a Linux path as mentioned in the first example, you will have to enable this switch to use SCP to copy files from the source to the Linux system. Requires `scp` and `ssh` being installed on the system |
| SkipSCPMkdir | Switch | Allows you to skip the `mkdir` operation while using `-UseSCP` and relies on the folder already existing |
| Force        | Switch | This will force the creation of the repository, even if the name of the repository is already assigned. Should be used with caution |
| ForceTrust   | Switch | By default repositories are validated with a hash, based on all files present inside the repository. If a repository is not providing a hash, it will be disabled after the sync for security reasons. In case the hash does not match with all files synced afterwards, the repository files will be deleted and the sync aborted. You can use this flag to ignore both states and always add the repository, regardless if the hash matches or the hash is not given |

## Sync Public Repository

This file has been truncated. show original

Terrorkkar · July 18, 2024, 2:05pm

Hello again, im really sorry but this whole thing is a mess and i cannot make it work.

Now im having an issue syncing the repo to the local PC. It starts, gets to 17% progress, then powershell just closes and no files get written to local folder.