# Mangaged by puppet
# modules/icinga2_files/files/applyrules/service_check_linux_base.conf

apply Service "icinga" {
  import "generic-service"
    check_command = "icinga"
    command_endpoint = host.vars.client_endpoint
    assign where host.name == NodeName
}

apply Service "basic diskspace " for (partition in host.vars.basic_partitions) {
  import "generic-service"
    display_name = "Check basic diskspace " + partition
    check_command = "disk"
    vars.disk_partitions = partition
    command_endpoint = host.vars.client_endpoint
    assign where host.vars.basic_partitions
    if (host.vars.notification_bereitschaft) {
      vars.sections = [ "bereitschaft","sysops" ]
    }
}

apply Service "Other diskpace " for (partition in host.vars.disk_partitions) {
  import "generic-service"
    display_name = "Check diskspace " + partition
    check_command = "disk"
    vars.disk_partitions = partition
    command_endpoint = host.vars.client_endpoint
    assign where host.vars.disk_partitions
    if (host.vars.notification_bereitschaft) {
      vars.sections = [ "bereitschaft","sysops" ]
    }
}

apply Service "load" {
  import "generic-service"
    command_endpoint = host.vars.client_endpoint
    check_command = "load"
    /* Used by the ScheduledDowntime apply rule in `downtimes.conf`. */
    vars.backup_downtime = "02:00-03:00"
    assign where host.vars.os == "Linux"
    ignore where host.vars.virtual_machine_type == "lxc"
}

apply Service "cpu" {
  import "generic-service"
    command_endpoint = host.vars.client_endpoint
    check_command = "check-cpu"
    assign where host.vars.os == "Linux"
    ignore where host.vars.virtual_machine_type == "lxc"
}

apply Service "procs" {
  import "generic-service"
    command_endpoint = host.vars.client_endpoint
    check_command = "procs"
    assign where host.vars.os == "Linux"
    ignore where host.vars.virtual_machine_type == "lxc"
}

apply Service "swap" {
  import "generic-service"
    command_endpoint = host.vars.client_endpoint
    check_command = "swap"
    assign where ( host.vars.os == "Linux" && host.vars.architecture != "armv7l")
}

apply Service "memory" {
  import "generic-service"
    command_endpoint = host.vars.client_endpoint
    check_command = "mem"
    vars.mem_used = true
    vars.mem_cache = true
    vars.mem_warning = 85
    vars.mem_critical = 95
    assign where host.vars.os == "Linux"
}

apply Service "users" {
  import "generic-service"
    check_command = "users"
    command_endpoint = host.vars.client_endpoint
    assign where host.vars.os == "Linux"
}

# Custom checkcommands and may overwrites
class profile::icinga2::checkcommands {

  $templates = '/etc/icinga2/zones.d/global-templates'
  $commands = "${templates}/commands.d"
  $master_confd = '/etc/icinga2/zones.d/master/conf.d'

  file { $commands:
    ensure =>  directory,
    owner  =>  nagios,
    group  =>  nagios,
    mode   =>  '0750',
    purge  =>   true
  }

  # Extend check_mysql_health ITL
  -> file { "${commands}/check-custom-mysql-health.conf":
    ensure =>  file,
    owner  =>  nagios,
    group  =>  nagios,
    tag    =>  'icinga2::config::file',
    source =>  [
      'puppet:///modules/icinga2_files/commands/check_custom_mysql_health.conf',
    ],
  }

  # Extend check_mongodb.py ITL
  -> file { "${commands}/check-custom-mongodb.conf":
    ensure =>  file,
    owner  =>  nagios,
    group  =>  nagios,
    tag    =>  'icinga2::config::file',
    source =>  [
      'puppet:///modules/icinga2_files/commands/check_custom_mongodb.conf',
    ],
  }

  # Extend check_squid ITL
  -> file { "${commands}/check-custom-squid.conf":
    ensure =>  file,
    owner  =>  nagios,
    group  =>  nagios,
    tag    =>  'icinga2::config::file',
    source =>  [
      'puppet:///modules/icinga2_files/commands/check_custom_squid.conf',
    ],
  }

  # Extend check_apt ITL
  -> file { "${commands}/check-custom-apt.conf":
    ensure =>  file,
    owner  =>  nagios,
    group  =>  nagios,
    tag    =>  'icinga2::config::file',
    source =>  [
      'puppet:///modules/icinga2_files/commands/check_custom_apt.conf',
    ],
  }

  # Used for other disks
  icinga2::object::checkcommand { 'check-smart':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_smart',
    ],
    arguments => {
      '-d' => '$smart_device$',
      '-i' => '$smart_interface$',
      '-b' => '$smart_bad_threshold$',
    },
    vars      => {
      'smart_device'    => '/dev/sda',
      'smart_interface' => 'scsi',
    },
    target    => "${commands}/check-smart-command.conf",
  }

  # Crucial health check
  icinga2::object::checkcommand { 'check-crucial-ssd':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_crucial',
    ],
    arguments => {
      '-d'               => '$smart_device$',
      '-m'               => '$crucial_check$',
      '-w'               => '$crucial_warning$',
      '-c'               => '$crucial_critical$',
      '-s' => { 'set_if' => '$crucial_sudo$' },
    },
    vars      => {
      'smart_device'  => '/dev/sda',
      'crucial_check' => 'health',
      'crucial_sudo'  => true,
    },
    target    => "${commands}/check-smart-command.conf",
  }

  # Used for SSDs
  icinga2::object::checkcommand { 'check-smart-attributes':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_smart_attributes/check_smart_attributes',
    ],
    arguments => {
      '-d'      => '$smart_device$',
      '-dbj'    => '$smart_dbj$',
      '-ucfgj'  => '$smart_ucfgj$',
      '-nosudo' => { 'set_if' => '$smart_nosudo$' },
      '-ap' => { 'set_if' => '$smart_allperf$' },
    },
    vars      => {
      'smart_device'  => '/dev/sda',
      'smart_dbj'     => '/usr/lib/nagios/plugins/3dparty/check_smart_attributes/check_smartdb.json',
      'smart_allperf' => 'true',
    },
    target    =>  "${commands}/check-smart-attributes-command.conf",
  }

  # Ceph Checks
  icinga2::object::checkcommand { 'check-ceph-health':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /check_ceph_health',
    ],
    arguments => {
      '-e' => '$ceph_bin$',
      '-c' => '$ceph_conf$',
      '-m' => '$ceph_mon_address$',
      '-i' => '$ceph_client_id$',
      '-n' => '$ceph_client_name$',
      '-k' => '$ceph_client_keyring$',
      '-w' => '$ceph_whitelist_health_regex$',
      '-d' => '$ceph_health_detail$',
    },
    vars      => {
      'ceph_client_id'      => 'nagios',
      'ceph_client_keyring' => '/etc/icinga2/secrets/client.nagios.keyring',
    },
    target    => "${commands}/check-ceph-command.conf",

  }

  icinga2::object::checkcommand { 'check-ceph-mon':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /check_ceph_mon',
    ],
    arguments => {
      '-e' => '$ceph_bin$',
      '-c' => '$ceph_conf$',
      '-m' => '$ceph_mon_address$',
      '-I' => '$ceph_mon_id$',
      '-i' => '$ceph_client_id$',
      '-k' => '$ceph_client_keyring$',
    },
    vars      => {
      'ceph_client_id'      => 'nagios',
      'ceph_client_keyring' => '/etc/icinga2/secrets/client.nagios.keyring',
    },
    target    => "${commands}/check-ceph-command.conf",

  }

  icinga2::object::checkcommand { 'check-ceph-osd':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /check_ceph_osd',
    ],
    arguments => {
      '-e' => '$ceph_bin$',
      '-c' => '$ceph_conf$',
      '-m' => '$ceph_mon_address$',
      '-I' => '$ceph_osd_id$',
      '-H' => '$ceph_osd_host$',
      '-i' => '$ceph_client_id$',
      '-k' => '$ceph_client_keyring$',
      '-o' => '$ceph_osd_out$',
    },
    vars      => {
      'ceph_client_id'      => 'nagios',
      'ceph_client_keyring' => '/etc/icinga2/secrets/client.nagios.keyring',
      'ceph_osd_host'       => '$address$',
    },
    target    =>  "${commands}/check-ceph-command.conf",

  }

  icinga2::object::checkcommand { 'check-ceph-rgw':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /check_ceph_rgw',
    ],
    arguments => {
      '-c' => '$ceph_conf$',
      '-e' => '$radosgw_admin_bin$',
      '-d' => '$ceph_perf_detail$',
      '-B' => '$ceph_perf_byte$',
      '-i' => '$ceph_client_id$',
    },
    vars      => {
      'radosgw_admin_bin' => '/usr/bin/radosgw-admin',
      'ceph_conf'         => '/etc/ceph/ceph.conf',
    },
    target    => "${commands}/check-ceph-command.conf",

  }

  icinga2::object::checkcommand { 'check-ceph-df':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /check_ceph_df',
    ],
    arguments => {
      '-e' => '$ceph_bin$',
      '-c' => '$ceph_conf$',
      '-m' => '$ceph_mon_address$',
      '-i' => '$ceph_client_id$',
      '-n' => '$ceph_client_name$',
      '-k' => '$ceph_client_keyring$',
      '-d' => '$ceph_pool_detail$',
      '-W' => '$ceph_pool_warning$',
      '-C' => '$ceph_pool_critical$',
    },
    vars      => {
      'ceph_client_id'      => 'nagios',
      'ceph_client_keyring' => '/etc/icinga2/secrets/client.nagios.keyring',
      'ceph_pool_warning'   => '85',
      'ceph_pool_critical'  => '95',
    },
    target    =>  "${commands}/check-ceph-command.conf",

  }

  # Check Fortigate Firewall
  icinga2::object::checkcommand { 'check-fortigate':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_fortigate',
    ],
    arguments => {
      '-H' => '$snmp_address$',
      '-v' => '$snmp_version$',
      '-U' => '$snmpv3_user$',
      '-X' => '$snmpv3_priv_key$',
      '-A' => '$snmpv3_auth_key$',
      '-x' => '$snmpv3_priv_alg$',
      '-a' => '$snmpv3_auth_alg$',
      '-w' => '$snmp_warn$',
      '-c' => '$snmp_crit$',
      '-T' => '$snmp_fortigate_checktype$',
      '-S' => '$snmp_fortigate_serial$',
      '-V' => '$snmp_fortigate_vpnmode$',
      '-M' => '$snmp_fortigate_mode$',
      '-p' => '$snmp_fortigate_store_path$',
    },
    vars      => {
      'snmp_version'              => '3',
      'snmpv3_priv_alg'           => 'aes',
      'snmpv3_auth_alg'           => 'sha',
      'snmp_fortigate_store_path' => '/var/lib/nagios/',
    },
    target    => "${commands}/check-snmp-devices-command.conf",
  }

  # Check Apache2 status
  icinga2::object::checkcommand { 'check-apache2-status':
    import    => [
      'plugin-check-command',
      'ipv4-or-ipv6',
    ],
    command   => [
      'PluginDir + /3dparty/check_apache2',
    ],
    arguments => {
      '-H' => '$apache2_status_address$',
      '-p' => '$apache2_status_port$',
      '-u' => '$apache2_status_uri$',
      '-U' => '$apache2_status_username$',
      '-P' => '$apache2_status_password$',
      '-s' => {
        set_if => '$apache2_status_ssl$',
      },
      '-N' => '$apache2_status_no_validate$',
      '-w' => '$apache2_status_warning$',
      '-c' => '$apache2_status_critical$',
    },
    vars      => {
      'apache2_status_address' => '$check_address$',
    },
    target    => "${commands}/check-http-command.conf",
  }

  icinga2::object::checkcommand {'httpsping':
    import  => [
      'http',
    ],
    command => [
      'PluginDir + /check_http',
    ],
    vars    => {
      'http_ssl' => true,
    },
    target  => "${commands}/check-http-command.conf",
  }

  # Check Windows Powershell command
  icinga2::object::checkcommand { 'check-powershell':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'C:\\\Windows\\\system32\\\WindowsPowerShell\\\v1.0\\\powershell.exe'
    ],
    arguments => {
      '-command' => {
        required => true,
        'value'  => '$ps_command$',
        order    => -1,
      },
      '-args'    => {
        'value'  => '$ps_args$',
        order    => 97,
      },
      ';exit'    => {
        'value' => '$$LASTEXITCODE',
        order   => 99,
      },
    },
    target   => "${commands}/check-windows-plugins.conf",
  }

  icinga2::object::checkcommand { 'check-powershell-x64':
    import    => [
      'plugin-check-command',
    ],

    command   => [
      'C:\\\Windows\\\sysnative\\\WindowsPowerShell\\\v1.0\\\powershell.exe'
    ],

    arguments => {
      '-args'    => {
        order    => 97,
        'value'  => '$ps_args$',
      },
      '-command' => {
        order    => -1,
        required => true,
        'value'  => '$ps_command$',
      },
      ';exit'    => {
        order   => 99,
        'value' => '$$LASTEXITCODE',
      },
    },
    target   => "${commands}/check-windows-plugins.conf",
  }

  # Check mail flow -> Send -> Receive -> check
  icinga2::object::checkcommand { 'check-imap-receive':
    import    => [
      'ipv4-or-ipv6',
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_imap_receive',
    ],
    arguments => {
      '--plugin'              => {
        'value'  => '/usr/lib/nagios/plugins/3dparty/check_imap_receive',
        skip_key => true,
        required => true,
      },
      '-w'                    => {
        'value'               => '$imap_warn$',
      },
      '-c'                    => {
        'value'               => '$imap_crit$',
      },
      '-t'                    => {
        'value'               => '$imap_timeout$',
      },
      '--imap-check-interval' => {
        'value'               => '$imap_check_intervall$',
      },
      '--imap-check-retries'  => {
        'value'               => '$imap_check_retries$',
      },
      '--ssl'                 => {
        'set_if'              => '$imap_ssl$',
      },
      '-H'                    => {
        'value'               => '$check_address$',
      },
      '--port'                => {
        'value'               => '$port$',
      },
      '--username'            => {
        'value'               => '$imap_user$',
      },
      '--password'            => {
        'value'               => '$imap_password$',
      },
      '-s'                    => {
        'value'               => 'SUBJECT',
      },
      '-s'                    => {
        'value'               => 'Icinga Test %TOKEN1%.',
      },
    },
    vars      => {
      'imap_server'          => '$check_address$',
      'imap_user'            => '$mail_username$',
      'imap_password'        => '$mail_password$',
      'imap_check_intervall' => 5,
      'imap_check_retries'   => 10,
      'imap_search_string'   => 'SUBJECT',
      'imap_warn'            => '220',
      'imap_crit'            => '230',
      'imap_ssl'             => true,
    },
    target    => "${commands}/check-imap-receive-command.conf",
  }

  icinga2::object::checkcommand { 'check-smtp-send':
    import    => [
      'ipv4-or-ipv6',
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_smtp_send',
    ],
    arguments => {
      '--plugin'   => {
        'value'  => '/usr/lib/nagios/plugins/3dparty/check_smtp_send',
        skip_key => true,
        required => true,
      },
      '-w'         => {
        'value'               => '$smtp_warn$',
      },
      '-c'         => {
        'value'               => '$smtp_crit$',
      },
      '-t'         => {
        'value'               => '$smtp_timeout$',
      },
      '--tls'      => {
        'set_if'              => '$smtp_tls$',
      },
      '-H'         => {
        'value'               => '$check_address$',
      },
      '--port'     => {
        'value'               => '$port$',
      },
      '--username' => {
        'value'               => '$imap_user$',
      },
      '--password' => {
        'value'               => '$imap_password$',
      },
      '-auth'      => {
        'value'               => '$smtp_auth_type$',
      },
      '--header'   => {
        'value'               => '$smtp_header$',
      },
      '--mailto'   => {
        'value'               => '$smtp_mailto$',
      },
      '--mailfrom' => {
        'value'               => '$smtp_mailfrom$',
      },
    },
    vars      => {
      'smtp_server'    => '$check_address$',
      'smtp_user'      => '$mail_username$',
      'smtp_password'  => '$mail_password$',
      'smtp_auth_type' => 'plain',
      'smtp_header'    => 'Subject: Icinga2 check',
      'smtp_mailto'    => 'mailcheck@example.com',
      'smtp_mailfrom'  => 'mailcheck@example.com',
      'smtp_warn'      => '220',
      'smtp_crit'      => '230',
      'smtp_tls'       => true,
    },
    target    => "${commands}/check-smtp-send-command.conf",
  }

  icinga2::object::checkcommand { 'check-email-delivery':
    import    => [
      'ipv4-or-ipv6',
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_email_delivery',
    ],
    arguments => {
      '-p'              => {
        'value'  => '/usr/lib/nagios/plugins/3dparty/check_smtp_send',
        skip_key => true,
        order    => -1,
        required => true,
      },
      '-w'              => {
        'value' => '$smtp_warn$,$imap_warn$',
        order   => 0,
      },
      '-c'              => {
        'value' => '$smtp_crit$,$imap_crit$',
        order   => 2,
      },
      '--timeout'       => {
        'value' => '$smtp_timeout$,$imap_timout$',
        order   => 3,
      },
      '--token'         => {
        'value' => '$mail_token$',
        order   => 4,
      },
      '-H'              => {
        'value' => '$mail_host$',
        order   => 5,
      },
      '--smtp-server'   => {
        'value' => '$smtp_host$',
        order   => 6,
      },
      '--mailfrom'      => {
        'value' => '$smtp_mailfrom$',
        order   => 7,
      },
      '--mailto'        => {
        'value' => '$smtp_mailto$',
        order   => 8,
      },
      '--smtp-username' => {
        'value' => '$smtp_username$',
        order   => 9,
      },
      '--smtp-password' => {
        'value' => '$smtp_password$',
        order   => 10,
      },
      '-U'              => {
        'value' => '$mail_username$',
        order   => 11,
      },
      '-P'              => {
        'value' => '$mail_password$',
        order   => 12,
      },
      '--auth'          => {
        'value' => '$smtp_authtype$',
        order   => 13,
      },
      '--notls'         => {
        'set_if' => '$notls$',
        order    => 14,
      },
      '--smtptls'       => {
        'set_if' => '$smtptls$',
        order    => 15,
      },
      '--nosmtptls'     => {
        'set_if' => '$nosmtptls$',
        order    => 16,
      },
      '--tls'           => {
        'set_if' => '$tls$',
        order    => 17,
      },
      '--port'          => {
        'value' => '$smtp_port$',
        order   => 18,
      },
      '--header'        => {
        'value'  => 'Subject: Icinga Test %TOKEN1%.',
        skip_key => false,
        order    => 19,
      },
      '--body'          => {
        'value'  => '$mail_body_text$',
        skip_key => false,
        order    => 20,
      },
      '--plugin'        => {
        'value'  => '/usr/lib/nagios/plugins/3dparty/check_imap_receive',
        skip_key => true,
        required => true,
        order    => 21,
      },
      '--imap-server'   => {
        'value' => '$imap_host$',
        order   => 22,
      },
      '--ssl'           => {
        'set_if' => '$imapssl$',
        order    => 23,
      },
      '--imap-port'     => {
        'value' => '$imap_port$',
        order   => 24,
      },
      '--imap-username' => {
        'value' => '$imap_username$',
        order   => 25,
      },
      '--imap-password' => {
        'value' => '$imap_password$',
        order   => 26,
      },
    },

    vars      => {
      'smtp_mailfrom'  => '$mail_username$',
      'smtp_mailto'    => '$mail_username$',
      'smtp_host'      => '$check_address$',
      'imap_host'      => '$check_address$',
      'smtp_warn'      => 15,
      'smtp_crit'      => 20,
      'imap_warn'      => 220,
      'imap_crit'      => 230,
      'mail_token'     => 'U-X-Y',
      'mail_body_text' => 'Icinga mail flow check.',
      'nosmtptls'      => true,
      'imapssl'        => true,
    },
    target    =>  "${commands}/check-email-delivery-command.conf",
  }

  # Check with iftraffic
  icinga2::object::checkcommand { 'check-iftraffic-nrpe':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_iftraffic_nrpe',
    ],
    arguments => {
      '-i' => '$iftraffic_nrpe_include_regex$',
      '-X' => '$iftraffic_nrpe_exclude_regex$',
      '-p' => {
        'set_if' => '$iftraffic_nrpe_enable_perf$',
      },
      '-P' => '$iftraffic_nrpe_bits_s$',
      '-b' => '$iftraffic_nrpe_brief_output$',
      '-I' => '$iftraffic_nrpe_must_include$',
      '-a' => '$iftraffic_nrpe_semi_automatic$',
      '-d' => '$iftraffic_nrpe_must_exclude$',
      '-B' => '$iftraffic_nrpe_bits_s_output$',
      '-s' => '$iftraffic_nrpe_interface_speed$',
      '-w' => '$iftraffic_nrpe_warning$',
      '-c' => '$iftraffic_nrpe_critical$',
      '-u' => '$iftraffic_nrpe_unknown_to_warning$',
    },
    vars      => {
      'iftraffic_nrpe_enable_perf'     => true,
      'iftraffic_nrpe_interface_speed' => 1000,
    },
    target    => "${commands}/check-iftraffic-nrpe-command.conf",
  }

  # Check TCP connections
  icinga2::object::checkcommand { 'check-connections':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_connections',
    ],
    arguments => {
      '-s' => '$connections_state$',
      '-f' => '$connections_filter$',
      '-p' => '$connections_protocol_family$',
      '-w' => '$connections_warning$',
      '-c' => '$connections_critical$',
      '-e' => '$connections_exact_count$',
    },
    vars      => {
      'connections_state'    => 'established',
      'connections_warning'  => 800,
      'connections_critical' => 1200,
    },
    target    => "${commands}/check-connections-command.conf",
  }

  # Check Password expire
  icinga2::object::checkcommand { 'check-password-expire':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_password_expire',
    ],
    arguments => {
      '-x' => '$password_exclude$',
      '-w' => '$password_warning$',
      '-c' => '$password_critical$',
    },
    vars      => {
      'password_warning'  => 14,
      'password_critical' => 7,
    },
    target    => "${commands}/password-expire.conf",
  }

  icinga2::object::checkcommand { 'check-cpu':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_cpu',
    ],
    arguments => {
      '-w'  => '$cpu_global_percent_warning$',
      '-uw' => '$cpu_user_percent_warning$',
      '-iw' => '$cpu_iowait_percent_warning$',
      '-sw' => '$cpu_system_percent_warning$',
      '-c'  => '$cpu_global_percent_critical$',
      '-uc' => '$cpu_user_percent_critical$',
      '-ic' => '$cpu_iowait_percent_critical$',
      '-sc' => '$cpu_system_percent_critical$',
      '-i'  => '$cpu_iostat_interval_seconds$',
      '-n'  => '$cpu_iostat_number$',
    },
    target    => "${commands}/check-cpu.conf",
  }

  # Check Apach2 processes
  icinga2::object::checkcommand { 'check-apache-process':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /check_procs',
    ],
    arguments => {
      '-w' => '$apache_procs_warning$',
      '-c' => '$apache_procs_critical$',
      '-a' => '$apache_procs_argument$',
    },
    vars      => {
      'check_interval'        => 300,
      'apache_procs_warning'  => '1:15',
      'apache_procs_critical' => '1:20',
      'apache_procs_argument' => '/usr/sbin/apache2 -k start',
    },
    target    => "${commands}/check-http-command.conf",
  }

  # Check HTTP flow with HolyGhost  (phantomjs)
  icinga2::object::checkcommand { 'check-holyghost':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_holyghost/HolyGhost',
    ],
    arguments => {
      '--param' => '$holyghost_options$',
      '--test' => '$holyghost_testcase$',
      '--path' => '$holyghost_path$',
      '--proxy' => '$holyghost_proxy$',
      '--protocol' => '$holyghost_ssl_protocol$',
      '--html' => {
        set_if => '$holyghost_print_html$',
      },
      '--delete' => {
        set_if => '$holyghost_cleanup$',
      },
      '--keep' => {
        set_if => '$holyghost_keep$',
      },
    },
    vars      => {
      'check_interval'    => 300,
      'holyghost_path' => '/var/tmp',
    },
    target    => "${commands}/check-http-command.conf",
  }

  # Check APC UPS
  icinga2::object::checkcommand { 'check-ups-health':
    import    => [
      'ipv4-or-ipv6',
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_ups_health',
    ],
    arguments => {
      '-H'                 => '$ups_health_address$',
      '-t'                 => '$ups_health_timeout$',
      '--domain'           => '$ups_health_domain$',
      '--protocol'         => '$ups_health_protocol$',
      '--community'        => '$ups_health_community$',
      '--username'         => '$ups_health_username$',
      '--authpassword'     => '$ups_health_authpassword$',
      '--authprotocol'     => '$ups_health_authprotocol$',
      '--privpassword'     => '$ups_health_privpassword$,',
      '--privprotocol'     => '$ups_health_privprotocol$,',
      '--contextengineid'  => '$ups_health_contextengineid$,',
      '--contextname'      => '$ups_health_contextname$,',
      '--community2'       => '$ups_health_community2$,',
      '--servertype'       => '$ups_health_servertype$,',
      '--oids'             => '$ups_health_oids$',
      '--offline'          => '$ups_health_offline$',
      '--mode'             => '$ups_health_mode$',
      '--regexp'           => '$ups_health_regexp$',
      '--warning'          => '$ups_health_warning$',
      '--critical'         => '$ups_health_critical$',
      '--warningx'         => '$ups_health_warningx$',
      '--criticalx'        => '$ups_health_criticalx$',
      '--units'            => '$ups_health_units$',
      '--name'             => '$ups_health_name$',
      '--name2'            => '$ups_health_name2$',
      '--name3'            => '$ups_health_name3$',
      '--extra-opts'       => '$ups_health_extra-opts$',
      '--blacklist'        => '$ups_health_blacklist$',
      '--mitigation'       => {
        set_if => '$ups_health_mitigation$',
      },
      '--lookback'         => '$ups_health_lookback$',
      '--environment'      => '$ups_health_environment$',
      '--negate'           => '$ups_health_negate$',
      '--morphmessage'     => '$ups_health_morphmessage$',
      '--morphperfdata'    => '$ups_health_morphperfdata$',
      '--selectedperfdata' => '$ups_health_selectedperfdata$',
      '--report'           => '$ups_health_report$',
      '--statefilesdir'    => '$ups_health_statefilesdir$',
      '--isvalidtime'      => '$ups_health_isvalidtime$',
    },
    vars      =>  {
      'ups_health_address' => '$hostaddress$',
    },
    target    => "${commands}/check-ups-health-command.conf",
  }

  # Check MySQL Perf
  icinga2::object::checkcommand { 'check-mysql-perf':
    import    => [
      'ipv4-or-ipv6',
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/mysql/perf_mysql.pl',
    ],
    arguments => {
      '--host'     => '$mysql_perf_hostname$',
      '--user'     => '$mysql_username$',
      '--password' => '$mysql_password$',
      '--output'   => '$mysql_perf_output$',
      '--socket'   => {
        set_if => '$mysql_socket$',
      },
      '--port'     => {
        set_if => '$mysql_port$',
      },
      '--module'   => '$mysql_perf_module$',
    },
    vars      =>  {
      'mysql_perf_hostname' => '$hostaddress$',
      'mysql_perf_output'   => 'icinga',
    },
    target    => "${commands}/check-mysql-perf-command.conf",
  }

  # Check MySQL Galery state
  icinga2::object::checkcommand { 'check-mysql-galera':
    import    => [
      'ipv4-or-ipv6',
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/mysql/check_galera_nodes.pl',
    ],
    arguments => {
      '--hostname' => '$mysql_galera_hostname$',
      '--user'     => '$mysql_username$',
      '--password' => '$mysql_password$',
      '--nodes'    => '$mysql_galera_nodes$',
      '--socket'   => {
        set_if => '$mysql_perf_socket$',
      },
      '--port'     => {
        set_if => '$mysql_port$',
      },
    },
    vars      =>  {
      'mysql_perf_hostname' => '$hostaddress$',
    },
    target    => "${commands}/check-mysql-galera-command.conf",
  }

  # Used for APC USV
  icinga2::object::checkcommand { 'check-usv-apc':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_snmp_usv',
    ],
    arguments => {
      '-H' => '$snmp_address$',
      '-v' => '$snmp_version$',
      '-C' => '$snmp_community$',
      '-u' => '$snmpv3_user$',
      '-l' => '$snmpv3_seclevel$',
      '-x' => '$snmpv3_priv_alg$',
      '-X' => '$snmpv3_priv_key$',
      '-a' => '$snmpv3_auth_alg$',
      '-A' => '$snmpv3_auth_key$',
      '-t' => '$snmp_check_type$',
      '-w' => '$snmp_usv_warn$',
      '-c' => '$snmp_usv_crit$',
      '-S' => '$snmp_usv_separator$',
    },
    vars      => {
      'snmpv3_seclevel' => 'authPriv',
      'snmpv3_priv_alg' => 'AES',
      'snmpv3_auth_alg' => 'SHA',
      'snmp_check_type' => 'status',
      'snmp_version'    => '3',
      'snmp_address'    => '$address$',
    },
    target    =>  "${commands}/check-snmp-devices-command.conf",
  }

  # Check APC transfer switch
  # Used for APC ATS
  icinga2::object::checkcommand { 'check-ats-apc':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_apc_ats',
    ],
    arguments => {
      '-H' => '$snmp_address$',
      '-u' => '$snmpv3_user$',
      '-l' => '$snmpv3_seclevel$',
      '-x' => '$snmpv3_priv_alg$',
      '-X' => '$snmpv3_priv_key$',
      '-a' => '$snmpv3_auth_alg$',
      '-A' => '$snmpv3_auth_key$',
      '-t' => '$snmp_check_type$',
      '-w' => '$snmp_ats_warn$',
      '-c' => '$snmp_ats_crit$',
      '-S' => '$snmp_ats_selected_source$',
    },
    vars      => {
      'snmpv3_seclevel' => 'authPriv',
      'snmpv3_priv_alg' => 'SHA',
      'snmpv3_auth_alg' => 'MD5',
      'snmp_check_type' => 'status',
      'snmp_address'    => '$address$',
    },
    target    =>  "${commands}/check-snmp-devices-command.conf",
  }

  # Used for Quagga BGPD
  icinga2::object::checkcommand { 'check-quagga-bgpd':
    import  => [
      'plugin-check-command',
    ],
    command => [
      'PluginDir + /3dparty/check_quagga_bgpd',
    ],
    target  =>  "${commands}/check-quagga-command.conf",
  }

  # Used for Quagga route
  icinga2::object::checkcommand { 'check-quagga-route':
    import  => [
      'plugin-check-command',
    ],
    command => [
      'PluginDir + /3dparty/check_quagga_route',
    ],
    target  =>  "${commands}/check-quagga-command.conf",
  }

  # Used for Synology
  icinga2::object::checkcommand { 'check-snmp-synology':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_snmp_synology',
    ],
    arguments => {
      '-h' => '$snmp_address$',
      '-u' => '$snmpv3_user$',
      '-p' => '$snmpv3_auth_key$',
      '-v' => '$snmp_synology_verbose$',
      '-w' => '$snmp_synology_storage_warning$',
      '-c' => '$snmp_synology_storage_critical$',
      '-W' => '$snmp_synology_temp_warning$',
      '-C' => '$snmp_synology_temp_critical$',
      '-i' => {
        set_if => '$snmp_synology_ignore_dsm_updates$',
      },
      '-v' => {
        set_if => '$snmp_synology_verbose_output$',
      },
    },
    vars      => {
      'snmp_address' => '$address$',
    },
    target    => "${commands}/check-snmp-devices-command.conf",
  }

  # Used for Crypto vault
  icinga2::object::checkcommand { 'check-crypto-vault':
    import  => [
      'plugin-check-command',
    ],
    command => [
      'PluginDir + /3dparty/check_crypto_vault',
    ],
    arguments => {
      '-H' => '$crypto_address$',
      '-u' => '$crypto_user$',
      '-p' => '$crypto_password$',
      '-f' => '$crypto_password_file$',
      },
      vars      => {
        'crypto_address' => '$address$',
        'crypto_user' => 'cryptotest',
        'crypto_password' => 'cryptotest',
      },

      target  =>  "${commands}/check-crypto-vault-command.conf",
  }

  # Used for ZFS check
  icinga2::object::checkcommand { 'check-zfs-linux':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_zfs_linux',
    ],
    arguments => {
      '--pool'         => {
        'value'  => '$zfs_pool$',
        order  => '1',
        skip_key => true,
        required => true,
      },
      '--capacity' =>  {
        set_if => '$zfs_pool_usage_warning$',
        order  => '2',
      },
      '--warning'  => {
        'value'  => '$zfs_pool_usage_warning$',
        skip_key => true,
        required => true,
        order    => 3,
      },
      '--critical' => {
        set_if   => '$zfs_pool_usage_warning$',
        'value'  => '$zfs_pool_usage_critical$',
        skip_key => true,
        required => true,
        order    => 4,
      },
    },
    vars      => {
      'zfs_pool'                => 'rpool',
      'zfs_pool_usage_warning'  => '80',
      'zfs_pool_usage_critical' => '90',
    },
    target    => "${commands}/check-zfs-linux-command.conf",
  }

  # Used for checking open files
  icinga2::object::checkcommand { 'check-open-fds':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_open_fds',
    ],
    arguments => {
      '-w' => '$open_files_warning$',
      '-c' => '$open_files_critical$',
      '-W' => '$open_files_percent_warning$',
      '-C' => '$open_files_percent_critical$',
    },
    target    => "${commands}/check-open-fds-command.conf",
  }

  # Mellanox SNMPv3 Check
  icinga2::object::checkcommand { 'check-mellanox':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_snmp_mlnx',
    ],
    arguments => {
      '-H' => '$snmp_address$',
      '-U' => '$snmpv3_user$',
      '-C' => '$snmp_community$',
      '-X' => '$snmpv3_priv_key$',
      '-A' => '$snmpv3_auth_key$',
      '-x' => '$snmpv3_priv_alg$',
      '-a' => '$snmpv3_auth_alg$',
      '-e' => '$snmp_mlnx_checktype$',
      '-P' => '$snmp_version$',
      '-v' => '$snmp_mlnx_debug$',
    },
    vars      => {
      'snmp_version'    => '3',
      'snmpv3_priv_alg' => 'AES',
      'snmpv3_auth_alg'  => 'SHA',
      'snmp_address'  => '$address$',
    },
    target    => "${commands}/check-snmp-devices-command.conf",
  }

  # Raspberry Pi external GPIO Sensor
  icinga2::object::checkcommand { 'check-rasbi-sensor':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_rasbi/check_rasbi_sensor.py',
    ],
    arguments => {
      '-s' => '$rasbi_sensor$',
      '-c' => '$rasbi_critical$',
      '-w' => '$rasbi_warning$',
      '-t' => '$rasbi_sensor_type$',
      '-n' => '$rasbi_sensor_name$',
    },
    target    => "${commands}/check-rasbi-command.conf",
  }

  # Add Consul checkcommand for the services
  icinga2::object::checkcommand { 'check-consul-service':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_consul_service',
    ],
    arguments => {
      '-t' => {
        set_if   => '$consul_token$',
        'value'  => '$consul_token$',
      },
      '-H' => '$consul_address$',
      '-p' => '$consul_port$',
      '-w' => '$consul_warning$',
      '-c' => '$consul_critical$',
      '-s' => {
        set_if => '$consul_tls$',
      },
      '-d' => {
        set_if => '$consul_datacenter$',
      },
      '--service'          => {
        'value'  => '$consul_service$',
        skip_key => true,
      },
    },
    vars      => {
      'consul_address' => '$address$',
      'consul_port'    => '8500',
    },
    target    => "${commands}/check-consul-command.conf",
  }
  # Add Redis Sentinel check
  icinga2::object::checkcommand { 'check-sentinel-health-service':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_sentinel_master_health',
    ],
    arguments => {
      '-H' => '$sentinel_address$',
      '-p' => '$sentinel_port$',
      '-c' => '$sentinel_critical$',
      '-w' => '$sentinel_warning$',
      '-m' => '$sentinel_master$',
    },
    vars      => {
      'sentinel_address' => '$address$',
      'sentinel_port'    => '17700',
      'sentinel_master'    => 'mymaster',
    },
    target    => "${commands}/check-redis-command.conf",
  }

  # SNMP check for Allnet, because check_snmp get string, intead of needed integer
  icinga2::object::checkcommand { 'check-snmp-allnet':
    import    => [
      'snmp',
    ],
    command   => [
      'PluginDir + /3dparty/check_snmp_allnet',
    ],
    arguments => {
      '-H' => '$snmp_address$',
      '-C' => '$snmp_community$',
      '-c' => '$snmp_crit$',
      '-w' => '$snmp_warn$',
      '-o' => '$snmp_oid$',
    },
    vars      => {
      'snmp_address' => '$address$',
      'snmp_community' => '$snmp_community$',
      'snmp_oid' => '$snmp_oid$',
    },
    target    => "${commands}/check-snmp-devices-command.conf",
  }

  # Check rack door 
  icinga2::object::checkcommand { 'check-fcdoor':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_fcdoor.pl',
    ],
    arguments => {
      '-U' => '$fcdoor_url$',
      '-t' => '$fcdoor_timeout$',
    },
    target    => "${commands}/check-http-command.conf",
  }

  # Add Generic command
  icinga2::object::checkcommand { 'check-generic':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_generic',
    ],
    arguments => {
      '-e'              => {
        'value' => "\$generic_execute_cmd$",
      },
      '-u' => {
        'value' => "\$generic_unknown_expr$",
      },
      '-w' => {
        'value' => "\$generic_warning_expr$",
      },
      '-c' => {
        'value' => "\$generic_critical_expr$",
      },
      '-o' => {
        'value' => "\$generic_ok_expr$",
      },
      '-f' => {
        'value' => "\$generic_false_expr$",
      },
      '-y' => '$generic_data_type$',
      '-i' => '$generic_ignore_rc$',
      '-n' => '$generic_name$',
      '-t' => '$generic_timeout$',
      '-d' => '$generic_tmpdir$',
      '-v' => '$generic_verbose$',
    },
    vars      => {
      'generic_tmpdir' => '/tmp/',
    },
    target    => "${commands}/check-generic-command.conf",
  }

  # Check with JSON
  icinga2::object::checkcommand { 'check-json':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_json.py',
    ],
    arguments => {
      '-u'  => '$json_url$',
      '-w'  => '$json_warning$',
      '-c'  => '$json_critical$',
      '-f'  => '$json_function$',
      '-R'  => '$json_regex$',
      '-tf' => '$json_timeformat$',
      '-td' => '$json_timeduration$',
      '-tz' => '$json_timezone$',
      '-m'  => '$json_match$',
      '-k'  => {
        'value' => '$json_key$',
      },
      '-H'  => {
        'value'    => '$json_header$',
        repeat_key => true,
      },
      '-fs' => {
        'value' => '$json_secret$',
      },
    },
    target    => "${commands}/check-http-command.conf",
  }

  # Check network bonding
  icinga2::object::checkcommand { 'check-linux-bonding':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_linux_bonding',
    ],
    arguments => {
      '--verbose'       => '$bonding_verbose$',
      '--slave-down'    => '$bonding_slave_down_state$',
      '--ignore-num-ad' => '$bonding_ignore_num_ad$',
      '--blacklist'     => '$bonding_blacklist$',
      '--no-bonding'    => '$bonding_no_bonding_state$',
    },
    target    => "${commands}/check-linux-bonding.conf",
  }

  # Check with SNMP interfaces
  icinga2::object::checkcommand { 'check-snmp-interfaces':
    import    => [
      'plugin-check-command',
    ],
    command   => [
      'PluginDir + /3dparty/check_interfaces',
    ],
    arguments => {
      '-h' => '$snmp_address$',
      '-u' => '$snmpv3_user$',
      '-K' => '$snmpv3_priv_key$',
      '-k' => '$snmpv3_priv_alg$',
      '-J' => '$snmpv3_auth_key$',
      '-j' => '$snmpv3_auth_alg$',
      '-m' => '$snmp_interface_mode$',
      '-A' => '$snmp_interface_match_alias$',
      '-b' => '$snmp_interface_bandwidth$',
      '-r' => '$snmp_interface_regex_include$',
      '-R' => '$snmp_interface_regex_exclude$',
      '-N' => { 'set_if' => '$snmp_interface_ifnames$' },
      '-d' => { 'set_if' => '$snmp_interface_down_ok$' },
      '-a' => { 'set_if' => '$snmp_interface_getalias$' },
    },
    vars      => {
      'snmp_privprotocol'      => 'AES',
      'snmp_authprotocol'      => 'SHA',
      'snmp_interface_ifnames' => 'true',
      'snmp_address'           => '$address$',
      'snmp_interface_down_ok' => true,
    },
    target    => "${commands}/check-snmp-devices-command.conf",
  }
}

# Install the Icinga monitoring plugins
class profile::icinga2::plugins (
){
  # Sudo template
  sudo::conf { 'nagios':
    priority => 10,
    content  =>  template('profile/icinga2/sudoers_nagios.erb'),
  }

  if ($::kernel == 'linux') and ($::role != master)   {

    $linuxdeps = [
      'monitoring-plugins-standard',
      'nagios-plugins-contrib',
      'libmonitoring-plugin-perl',
      'libcrypt-des-perl',
      'nagios-snmp-plugins',
    ]
    package { $linuxdeps:
      install_options => ['--no-install-recommends'],
    }
  }

  # For Ceph
  if 'ceph' in $::role {
    $cephdeps = [
      'nagios-plugins-ceph',
    ]

    # For MongoDB
    if 'mongodb' in $::role {
      package { 'python-pymongo':
        ensure          => installed,
        install_options => ['--no-install-recommends'],
      }
    }

    # For NSLAN -> required for quagga check
    if 'nslan' in $::role {
      package { 'libnet-telnet-perl':
        ensure => installed,
        install_options => ['--no-install-recommends'],
      }
    }

    # Needed: ceph.conf group is www-data on Proxmox ceph mon node.
    user { 'nagios': groups => www-data }

    package { $cephdeps:
      install_options => ['--no-install-recommends'],
    }

    # Key on ceph generated with: ceph auth get-or-create client.nagios mon 'allow r' > client.nagios.keyring
    $ceph_nagios_key = Sensitive(hiera('ceph_nagios_keyring'))
    file {'/etc/icinga2/secrets/client.nagios.keyring':
      ensure  => file,
      mode    => '0640',
      owner   => 'root',
      group   => 'nagios',
      content =>  "[client.nagios]\n\tkey = ${ceph_nagios_key.unwrap}\n",
      require =>  File['/etc/icinga2/secrets'],
    }
  }

  file {'/etc/icinga2/secrets':
    ensure  => directory,
    mode    => '0750',
    owner   => 'root',
    group   => 'nagios',
  }

  if $::role == 'master' {
    $plugin_source = "puppet:///modules/icinga2_files/plugins"
  } else {
    $plugin_source = "puppet:///modules/icinga2_files/plugins_agent"
  }

  file { '/usr/lib/nagios/plugins/3dparty':
    ensure    => directory,
    mode      => '0755',
    owner     => 'root',
    group     => 'root',
    force     => true,
    show_diff => false,
    source    => [
      $plugin_source,
    ],
    recurse   => true,
    require   => Package['monitoring-plugins-standard'],
  }

  # Workarounds for some checks, that are not included, but in 3dparty/ folder
  file { '/usr/lib/nagios/plugins/check_iostat':
    ensure  =>   link,
    target  =>   '/usr/lib/nagios/plugins/3dparty/check_iostat',
    require =>   File['/usr/lib/nagios/plugins/3dparty'],
  }

  file { '/usr/lib/nagios/plugins/check_mem.pl':
    ensure  =>   link,
    target  =>   '/usr/lib/nagios/plugins/3dparty/check_mem',
    require =>   File['/usr/lib/nagios/plugins/3dparty'],
  }

  file { '/usr/lib/nagios/plugins/check_iostats':
    ensure  =>   link,
    target  =>   '/usr/lib/nagios/plugins/3dparty/check_iostats',
    require =>   File['/usr/lib/nagios/plugins/3dparty'],
  }

  file { '/usr/lib/nagios/plugins/check_mysql_health':
    ensure  =>   link,
    target  =>   '/usr/lib/nagios/plugins/3dparty/mysql/check_mysql_health.pl',
    require =>   File['/usr/lib/nagios/plugins/3dparty'],
  }

  file { '/usr/lib/nagios/plugins/check_nginx_status.pl':
    ensure  =>   link,
    target  =>   '/usr/lib/nagios/plugins/3dparty/check_nginx_status.pl',
    require =>   File['/usr/lib/nagios/plugins/3dparty'],
  }

  # Install perl modules for check_ngi
  if ('nginx' in $::puppet_classes) or
  ('apache' in $::puppet_classes) {
    $webdeps = [
      'libwww-perl',
    ]
    package { $webdeps:
      ensure          => installed,
      install_options => ['--no-install-recommends'],
    }
  }

  # Install IPMI tools for physical hosts
  unless ( $facts['is_virtual'] == true ) {
    $hwdeps = [ 'libipc-run-perl','freeipmi-tools','libconfig-json-perl' ]
    package { $hwdeps:
      ensure          => installed,
      install_options => ['--no-install-recommends'],
    }
  }

  case $::role {
    'master': {
      $mondeps = [
        'libnet-snmp-perl',
        'libcrypt-hcesha-perl',
        'libcrypt-des-perl',
        'libdigest-hmac-perl',
        'libcrypt-rijndael-perl',
        'libxml-simple-perl',
        'libconfig-json-perl',
        'libredis-perl',
        'nagios-snmp-plugins',
        'libhttp-date-perl',
        'liburi-perl',
        'libxml-libxml-perl',
        'libtest-lwp-useragent-perl',
        'libtime-duration-perl',
        'libcrypt-ssleay-perl',
        'openjdk-11-jre-headless',
        'liblist-compare-perl',
        'monitoring-plugins-standard',
        'icinga2-bin',
      ]
      package { $mondeps:
        install_options => ['--no-install-recommends'],
      }

      file { '/usr/local/lib/site_perl':
        ensure => directory,
        mode   => '0755',
        owner  => 'root',
        group  => 'root',
      }

      file { '/usr/lib/nagios/plugins/contrib':
        ensure => directory,
        mode   => '0755',
        owner  => 'root',
        group  => 'root',
      }

      file {'/usr/lib/nagios/plugins/check_icmp':
        ensure => file,
        mode   => '4755',
        owner  => 'root',
        group  => 'root',
      }

      file {'/usr/lib/nagios/plugins/check_ping':
        ensure => file,
        mode   => '4755',
        owner  => 'root',
        group  => 'root',
      }
    }
    default: { }
  }
}