feat(roles): validate Icinga 2 config before restart in icinga2_master and icingadb

Add a chained `icinga2 daemon --validate` handler that runs before the icinga2
restart in both roles. Tasks now notify the validate handler, which is defined
ahead of the restart handler and chains into it, so a broken config fails the
run loudly instead of bouncing the daemon into a down state.

This closes the one gap versus the upstream Icinga install guides, which run
`icinga2 daemon -C` before reloading.

Author: markuslf

CHANGELOG.md

@@ -21,6 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+* **role:icinga2_master, role:icingadb, role:icingaweb2, role:icingaweb2_module_reporting, role:icingaweb2_module_x509**: Add explicit Ubuntu variable files, making Ubuntu support visible alongside Debian. The Icinga repository, GPG key and package names were verified on Debian 13 and Ubuntu 24.04.
 * **role:nextcloud**: Add `meta/argument_specs.yml` declaring the user-facing variables, so role-entry validation catches type mismatches and missing mandatory variables.
 * **role:clamav**: Add `meta/argument_specs.yml` declaring the user-facing variables, so role-entry validation catches type mismatches and unknown variables.
 * **role:core_dumps**: New role that disables core dumps (which can leak sensitive process memory to disk) following the CIS Benchmark recommendations. Runs as part of `setup_basic`.
@@ -68,6 +69,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+* **role:icinga2_master, role:icingadb**: Validate the Icinga 2 configuration before restarting the service. A faulty config now fails the playbook run loudly instead of bouncing the daemon into a broken state and leaving Icinga 2 down.
 * **role:nextcloud**: Automatic app updates are now enabled by default (`nextcloud__timer_app_update_enabled`). The scheduled app update only switches Nextcloud into maintenance mode when an app update is actually pending, so an instance that is already up to date keeps serving requests without interruption. After updating, the recommended database migrations are applied automatically. A failed run no longer leaves the instance stuck in maintenance mode.
 * **role:clamav**: Now runs on Debian and Ubuntu in addition to Red Hat-family systems, and works on RHEL 10. The role seeds the signature database on first install so the scanner starts reliably, and runs an EICAR self-test (also available on its own via the `clamav:test` tag) that confirms detection actually works.
 * **role:sshd**: Ship hardened SSH defaults: X11 forwarding, agent forwarding and TCP keepalives are now off, `MaxAuthTries` is `3`, `ClientAliveCountMax` is `2`, and the log level is `VERBOSE`. All are overridable via the new `sshd__allow_agent_forwarding`, `sshd__allow_tcp_forwarding`, `sshd__client_alive_count_max`, `sshd__max_auth_tries`, `sshd__max_sessions`, `sshd__tcp_keep_alive` and `sshd__x11_forwarding` variables. Note: a client offering more than three keys from its SSH agent can be rejected by `MaxAuthTries 3`; use an explicit identity on the client or raise `sshd__max_auth_tries`.

roles/icinga2_master/handlers/main.yml

@@ -1,3 +1,13 @@
+# Validation runs before the restart: it is defined first, so when both are
+# notified in the same flush it executes first, and it chains into the restart.
+# `icinga2 daemon --validate` (-C) catches a broken config before the running
+# daemon is bounced, so a bad deploy fails loudly here instead of leaving icinga2
+# down after the restart.
+- name: 'icinga2_master: icinga2 daemon --validate'
+  ansible.builtin.command: 'icinga2 daemon --validate'
+  changed_when: true # must report changed so the chained restart handler is triggered
+  notify: 'icinga2_master: restart icinga2'
+
 - name: 'icinga2_master: restart icinga2'
   ansible.builtin.service:
     name: 'icinga2'

roles/icinga2_master/tasks/main.yml

@@ -54,21 +54,21 @@
       owner: 'root'
       group: 'root'
       mode: 0o644
-    notify: 'icinga2_master: restart icinga2'
+    notify: 'icinga2_master: icinga2 daemon --validate'
     tags:
       - 'icinga2_master:api_users'
 
   - name: 'icinga2 feature enable api'
     community.general.icinga2_feature:
       name: 'api'
       state: 'present'
-    notify: 'icinga2_master: restart icinga2'
+    notify: 'icinga2_master: icinga2 daemon --validate'
 
   - name: 'icinga2 feature enable notification'
     community.general.icinga2_feature:
       name: 'notification'
       state: 'present'
-    notify: 'icinga2_master: restart icinga2'
+    notify: 'icinga2_master: icinga2 daemon --validate'
 
   - name: 'Deploy /etc/icinga2/features-available/influxdb.conf'
     ansible.builtin.template:
@@ -78,13 +78,13 @@
       owner: '{{ icinga2_master__icinga_user }}'
       group: '{{ icinga2_master__icinga_user }}'
       mode: 0o640
-    notify: 'icinga2_master: restart icinga2'
+    notify: 'icinga2_master: icinga2 daemon --validate'
 
   - name: 'icinga2 feature enable influxdb'
     community.general.icinga2_feature:
       name: 'influxdb'
       state: 'present'
-    notify: 'icinga2_master: restart icinga2'
+    notify: 'icinga2_master: icinga2 daemon --validate'
 
   tags:
     - 'icinga2_master'
@@ -105,7 +105,7 @@
     args:
       creates: '/var/lib/icinga2/certs/{{ icinga2_master__cn }}.crt'
     register: 'icinga2_master__node_setup_result'
-    notify: 'icinga2_master: restart icinga2'
+    notify: 'icinga2_master: icinga2 daemon --validate'
 
   - name: 'Output of the node setup'
     ansible.builtin.debug:
@@ -172,7 +172,7 @@
       {% endif %}
     args:
       creates: "/var/lib/icinga2/certs/{{ icinga2_master__cn }}.crt"
-    notify: 'icinga2_master: restart icinga2'
+    notify: 'icinga2_master: icinga2 daemon --validate'
 
   - name: 'Make sure that the api-users.conf is included in /etc/icinga2/icinga2.conf'
     ansible.builtin.lineinfile:
@@ -198,7 +198,7 @@
       owner: '{{ icinga2_master__icinga_user }}'
       group: '{{ icinga2_master__icinga_user }}'
       mode: 0o640
-    notify: 'icinga2_master: restart icinga2'
+    notify: 'icinga2_master: icinga2 daemon --validate'
 
   tags:
     - 'icinga2_master'

roles/icingadb/handlers/main.yml

@@ -1,3 +1,13 @@
+# Validation runs before the icinga2 restart: it is defined first, so when both
+# are notified in the same flush it executes first, and it chains into the
+# restart. `icinga2 daemon --validate` (-C) catches a broken icingadb feature
+# config before the running daemon is bounced, so a bad deploy fails loudly here
+# instead of leaving icinga2 down after the restart.
+- name: 'icingadb: icinga2 daemon --validate'
+  ansible.builtin.command: 'icinga2 daemon --validate'
+  changed_when: true # must report changed so the chained restart handler is triggered
+  notify: 'icingadb: restart icinga2'
+
 - name: 'icingadb: restart icinga2'
   ansible.builtin.service:
     name: 'icinga2'

roles/icingadb/tasks/main.yml

@@ -30,7 +30,7 @@
       owner: '{{ icingadb__icinga_user }}'
       group: '{{ icingadb__icinga_user }}'
       mode: 0o640
-    notify: 'icingadb: restart icinga2'
+    notify: 'icingadb: icinga2 daemon --validate'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:
@@ -43,7 +43,7 @@
     community.general.icinga2_feature:
       name: 'icingadb'
       state: 'present'
-    notify: 'icingadb: restart icinga2'
+    notify: 'icingadb: icinga2 daemon --validate'
 
   - name: 'Flush handlers so that the icinga2 icingadb feature is active' # else /var/lib/icinga2/icingadb.env is missing later on
     ansible.builtin.meta: 'flush_handlers'