Monitoring a Split Installation¶

In a split installation, each role runs on its own Docker Swarm cluster. The portal joins the API through an haproxy proxy (reemo_api) and the API’s traefik, which requires a client certificate from the internal PKI (mTLS).

The monitoring server has no certificate from the internal PKI: the API is therefore monitored through the portal’s healthcheck, supplemented by a port 443 control of the API.

Supervise each profile present in your installation. The “System”, “Swarm Nodes”, and “Swarm Services” checks apply to all clusters.

Checks common to all clusters (NRPE)¶
Check	Probe
System	`check_load`, `check_disk`…
Swarm Nodes	check_reemo_swarm_nodes
Swarm Services	check_reemo_swarm_services

portal_manager¶

Check	Probe	Condition
Portal Healthcheck : functional check of the entire chain, API included	`reemo_healthcheck`	`HEALTHCHECK_ENABLE=true`
Incoming HTTPS Certificates	check_reemo_cert	Always
Signal	check_http	Always
Admin portal healthcheck	check_http	`PORTALADMIN_URL` and `HEALTHCHECK_PORTALADMIN_ENABLE=true`
Workstation (port 8445)	`check_tcp` + `check_reemo_cert`	`WORKSTATION_ENABLED=true`
Appliance portal (port 8444)	`check_tcp` + `check_reemo_cert`	`APPLIANCE_ENABLED=true`
Credential portal (port 8446)	`check_tcp` + `check_reemo_cert`	`CREDENTIALPORTAL_ENABLED=true`
haproxy proxy `reemo_api`	check_reemo_swarm_services	Always

api_manager¶

Check	Probe	Condition
Port 443 open and mTLS required	check_reemo_api_port	Always
API server certificate expiration	check_reemo_cert (`VERIF_CHAINE=0`)	Always
Database	check_reemo_mariadb or check_reemo_ndb	According to `DB_DIALECT`
Vault sealed	check_reemo_vault	`VAULT_ENABLED=true`
Backups	check_reemo_backup_age	`BACKUP_ENABLED=true`

turn_manager¶

Check	Probe	Condition
Actual TURN allocation on each `TURN1_IP` / `TURN2_IP`	check_reemo_turn	Always
Port `TURN_PORT` (58200) in TCP and UDP, from outside	`check_tcp` / `check_udp`	Always
Traefik (ports 80/443)	check_reemo_swarm_services	Always

Important

TURN_SECRET must be identical in the inventory for turn_manager and for api_manager. The check_reemo_turn probe uses this secret: an authentication failure indicates a mismatch between the two sides.

relayws_manager and provisionN_manager¶

Check	Probe	Condition
Relay WebSocket : public certificate (443), nginx mTLS (8443)	`check_reemo_cert` + `check_tcp`	Profile `relayws_manager`
Provisioning : nginx mTLS (8443), worker capacity	`check_tcp` + `check_disk` / `check_load`	Profiles `provisionN_manager`
Reachability of relays and container providers by the API	`ws-relays` and `container-providers` entries of the portal healthcheck	Always

Other Checks¶

Internal PKI certificates : probe check_reemo_pki, on the Ansible administration workstation
Network flows : particularly the flow portal_manager → api_manager (443), which is tested from a portal machine