# Nagios / Icinga checks

The scripts in this directory use the authenticated RustProxy administration API. They do not read the SQLite database and do not require access to the proxy process.

## Checks

- `check_rustproxy_api` — administration API response time and availability.
- `check_rustproxy_backends` — unavailable/checking backends for all vhosts or selected `--pool` vhost IDs.
- `check_rustproxy_latency` — the highest current backend EWMA/check latency.
- `check_rustproxy_queues` — dropped live-log records and dropped cold-cache queue work.

All scripts follow the Nagios plugin exit codes (`0 OK`, `1 WARNING`, `2 CRITICAL`, `3 UNKNOWN`) and expose performance data after `|`.

## Authentication

Use the HTTPS administration hostname that is already allowed by RustProxy. For frequent checks, persist the browser session so Nagios does not create a new session on every probe:

```sh
export RUSTPROXY_NAGIOS_USER='nagios'
export RUSTPROXY_NAGIOS_PASSWORD='replace-me'
install -d -m 0700 /var/lib/nagios/rustproxy
./nagios/check_rustproxy_api \
  --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies
```

The cookie file is written with mode `0600`. Keep the password environment variable in a root/Nagios-readable service environment, not on the command line. Once a valid cookie exists, it is reused until RustProxy expires or revokes the session.

For an internal CA, use `--ca-file /path/to/ca.pem`. `--insecure` is intended only for temporary diagnostics.

## Examples

```sh
# API warning at 150 ms, critical at 500 ms
./nagios/check_rustproxy_api --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies \
  --warning-ms 150 --critical-ms 500

# Any backend currently down is CRITICAL; checking/unknown is WARNING
./nagios/check_rustproxy_backends --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies

# Only one vhost/backend pool
./nagios/check_rustproxy_backends --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies --pool app-example

# Slowest backend warning/critical thresholds
./nagios/check_rustproxy_latency --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies \
  --warning-ms 500 --critical-ms 1500

# Cumulative dropped-work counters
./nagios/check_rustproxy_queues --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies \
  --warning 1 --critical 20
```

The status API identifies backend pools by vhost ID. Disabled and draining members are intentionally ignored by availability and latency checks.