Using AWS RDS for IcingaDB instead of a local PSQL setup

Icinga 2
1

Hi,

I’m trying to setup Icinga2 as a standalone setup but with IcingaDB running with an AWS Postgres 16 RDS instance instead of a local psql instance. I’ve ran through the install and configuration successfully, everything appears happy, however, when I login to the UI I see this message:

It seems that Icinga DB is not running. Make sure Icinga DB is running and writing into the database.

When I run systemctl status icingadb.service I see database: Can't connect to database. Retrying and then an additional message pq: no pg_hba.conf entry for host "10.6.9.207", user "******", database "icingadb", no encryption. Since there is no local install for postgres there won’t be a pg_hba.conf file. So it seems like icingadb still thinks the DB should be local instead of remote.

When I go to Configuration...Application...Resources and run a Validation Configuration test, it’s successful. So from a networking and authentication standpoint everything is fine. It’s just that the icingadb service isn’t happy and is expecting to find a pg_hba.conf file for some reason, and I can’t determine why. Is this a supported setup to use icingadb with a remote DB or should I switch over to IDO?

Any help would be greatly appreciated. Thanks in advance.

Don

2

that really should work. So I would like to ask you to verify, that address/IP, username, password and port in the icingadb config are valid and you can connect to that postgres database from the icingadb machine (via psql or something like that).

3

Hi Lorenz,

Thanks for the reply. I can definitely connect, here’s the output:

psql -h vpc3a-dev-icinga2.cbjphexxj3vv.us-east-1.rds.amazonaws.com -U icingadb
Password for user icingadb:
psql (16.3 (Ubuntu 16.3-0ubuntu0.24.04.1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)
Type "help" for help.

icingadb=>

When I do a systemctl status icingadb.service I see the connection attempt. Curious why it is trying Connecting to database at 'vpc3a-dev-icinga2.cbjphexxj3vv.us-east-1.rds.amazonaws.com:0' instead of Connecting to database at 'vpc3a-dev-icinga2.cbjphexxj3vv.us-east-1.rds.amazonaws.com'. That zero at the end looks more like a Redis thing than a psql thing.

Thanks,
Don

4

Could you share your icingadb configuration (without passwords etc of course)?

5

Here’s everything in the config.yml that’s uncommented.

database:
  type: pgsql
  host: vpc3a-dev-icinga2.cbjphexxj3vv.us-east-1.rds.amazonaws.com
  database: icingadb
  user: icingadb
  password: ********

redis:
  host: localhost

Here’s authentication.ini file.

[icingaweb2]
backend = "db"
resource = "icingaweb_db"

And here’s the resources.ini file.

[icingaweb_db]
type = "db"
db = "pgsql"
host = "vpc3a-dev-icinga2.cbjphexxj3vv.us-east-1.rds.amazonaws.com"
port = "5432"
dbname = "icingadb"
username = "icingadb"
password = *******
use_ssl = "0"
charset = "utf8"

[icingadb]
type = "db"
skip_validation = "0"
db = "pgsql"
host = "vpc3a-dev-icinga2.cbjphexxj3vv.us-east-1.rds.amazonaws.com"
port = "5432"
dbname = "icingadb"
username = "icingadb"
password = ********
charset = "utf8"
use_ssl = "0"

Thanks again,
Don

6

hm, tried to replicate this, could you add port: 5432 to your icingadb.yml?

7

I added the port to the /etc/icingadb/config.yml file but that didn’t change anything.

When you mention that you tried to replicate this, are you unable to? Everything works fine with the DB being non-local? It seems like there is something in this setup making icingadb think the DB is local, hence it wants the pg_hba.conf file, which doesn’t exist since I never installed postgresql on this system.

I pivoted and built a 2nd server and used the IDO option instead of icingadb and have a working setup now, but I thought I read somewhere that this option is deprecated.

Thanks again,
Don

8

I am unable to replicate this. Works fine for me. I have no idea how you reach this error.
And yes, the IDO backend is deprecated, although still functional.

9

Well, I thank you for your help, you were awesome, and I appreciate you trying to replicate this. Since I have a working solution I think I’ll just move forward with this and the IDO option. I may migrate at some point in the future with using MySQL instead of Postgres, but our DB standard here is Postgres so that’s what our CTO prefers. Thanks for everything.

Don

10

Hi Don,
it seems connections to AWS need to use SSL as described here:

So if you set use_ssl=1 it might work (if everything else is configured correctly).

Regards,
Dirk