Set up Netdata slave nodes for centralized monitoring with parent-child architecture

#!/usr/bin/env bash

set -euo pipefail

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Global variables
PARENT_IP=""
NODE_TYPE=""
API_KEY=""
HOSTNAME=""
SSL_ENABLED="true"

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  --parent              Setup as parent node"
    echo "  --child <parent_ip>   Setup as child node with parent IP"
    echo "  --api-key <key>       API key for authentication (optional, will generate if not provided)"
    echo "  --hostname <name>     Custom hostname for child node"
    echo "  --no-ssl              Disable SSL encryption"
    echo "  --help                Show this help message"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function
cleanup() {
    log_error "Installation failed. Cleaning up..."
    if systemctl is-active --quiet netdata 2>/dev/null; then
        systemctl stop netdata || true
    fi
    rm -f /tmp/netdata-kickstart.sh
}

trap cleanup ERR

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --parent)
            NODE_TYPE="parent"
            shift
            ;;
        --child)
            NODE_TYPE="child"
            PARENT_IP="$2"
            shift 2
            ;;
        --api-key)
            API_KEY="$2"
            shift 2
            ;;
        --hostname)
            HOSTNAME="$2"
            shift 2
            ;;
        --no-ssl)
            SSL_ENABLED="false"
            shift
            ;;
        --help)
            usage
            ;;
        *)
            log_error "Unknown option: $1"
            usage
            ;;
    esac
done

# Validate arguments
if [[ -z "$NODE_TYPE" ]]; then
    log_error "Must specify --parent or --child"
    usage
fi

if [[ "$NODE_TYPE" == "child" && -z "$PARENT_IP" ]]; then
    log_error "Parent IP required for child node"
    usage
fi

# Check prerequisites
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root"
    exit 1
fi

# Detect distribution
echo "[1/10] Detecting distribution..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    log_info "Detected: $PRETTY_NAME"
else
    log_error "Cannot detect distribution"
    exit 1
fi

# Update system packages
echo "[2/10] Updating system packages..."
$PKG_UPDATE

# Install prerequisites
echo "[3/10] Installing prerequisites..."
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL curl openssl uuid-runtime
else
    $PKG_INSTALL curl openssl util-linux
fi

# Generate API key if not provided
if [[ -z "$API_KEY" ]]; then
    echo "[4/10] Generating API key..."
    API_KEY=$(openssl rand -hex 32)
    log_info "Generated API key: $API_KEY"
else
    echo "[4/10] Using provided API key..."
fi

# Install Netdata
echo "[5/10] Installing Netdata..."
curl -Ss 'https://my-netdata.io/kickstart.sh' > /tmp/netdata-kickstart.sh
bash /tmp/netdata-kickstart.sh --stable-channel --disable-telemetry --dont-wait

# Configure based on node type
if [[ "$NODE_TYPE" == "parent" ]]; then
    echo "[6/10] Configuring parent node..."
    
    # Generate UUID for stream configuration
    STREAM_UUID=$(uuidgen)
    
    # Create stream configuration
    cat > /etc/netdata/stream.conf << EOF
[$STREAM_UUID]
    enabled = yes
    default history = 3600
    default memory = ram
    health enabled by default = auto
    allow from = *
    api key = $API_KEY
    default postpone alarms on connect seconds = 60
EOF
    
    if [[ "$SSL_ENABLED" == "true" ]]; then
        echo "[7/10] Configuring SSL..."
        mkdir -p /etc/netdata/ssl
        cd /etc/netdata/ssl
        openssl genrsa -out netdata-key.pem 2048
        openssl req -new -key netdata-key.pem -out netdata-csr.pem -subj "/C=US/ST=State/L=City/O=Organization/CN=netdata"
        openssl x509 -req -in netdata-csr.pem -signkey netdata-key.pem -out netdata-cert.pem -days 365
        
        # Set proper permissions
        chown netdata:netdata /etc/netdata/ssl/*
        chmod 600 /etc/netdata/ssl/netdata-key.pem
        chmod 644 /etc/netdata/ssl/netdata-cert.pem
        
        # Configure SSL in netdata.conf
        cat >> /etc/netdata/netdata.conf << EOF

[global]
    bind socket to IP = 0.0.0.0
    allow connections from = *
    enable web responses gzip compression = yes

[web]
    web files owner = root
    web files group = netdata
    ssl key = /etc/netdata/ssl/netdata-key.pem
    ssl certificate = /etc/netdata/ssl/netdata-cert.pem
EOF
    else
        echo "[7/10] Configuring without SSL..."
        cat >> /etc/netdata/netdata.conf << EOF

[global]
    bind socket to IP = 0.0.0.0
    allow connections from = *
    enable web responses gzip compression = yes
EOF
    fi
    
    echo "[8/10] Configuring firewall..."
    if [[ "$FIREWALL_CMD" == "ufw" ]]; then
        ufw allow 19999/tcp || log_warn "UFW not enabled or already configured"
    else
        firewall-cmd --permanent --add-port=19999/tcp || log_warn "Firewall not running or already configured"
        firewall-cmd --reload || true
    fi
    
else
    echo "[6/10] Configuring child node..."
    
    # Set hostname if provided
    if [[ -n "$HOSTNAME" ]]; then
        CHILD_HOSTNAME="$HOSTNAME"
    else
        CHILD_HOSTNAME=$(hostname)
    fi
    
    # Configure streaming to parent
    cat > /etc/netdata/stream.conf << EOF
[stream]
    enabled = yes
    api key = $API_KEY
    destination = $PARENT_IP:19999
    timeout seconds = 60
    reconnect delay seconds = 5
    initial clock resync iterations = 60
EOF
    
    echo "[7/10] Configuring child node settings..."
    cat >> /etc/netdata/netdata.conf << EOF

[global]
    memory mode = ram
    history = 1200
    hostname = $CHILD_HOSTNAME

[web]
    mode = none
EOF
    
    echo "[8/10] Firewall configuration not needed for child node..."
fi

# Set proper ownership for configuration files
chown netdata:netdata /etc/netdata/stream.conf
chmod 640 /etc/netdata/stream.conf
chown netdata:netdata /etc/netdata/netdata.conf
chmod 644 /etc/netdata/netdata.conf

# Restart and enable Netdata
echo "[9/10] Starting Netdata service..."
systemctl restart netdata
systemctl enable netdata

# Wait a moment for service to fully start
sleep 3

# Verify installation
echo "[10/10] Verifying installation..."
if systemctl is-active --quiet netdata; then
    log_info "Netdata service is running"
else
    log_error "Netdata service failed to start"
    exit 1
fi

# Display final information
echo ""
log_info "Netdata $NODE_TYPE node installation completed successfully!"

if [[ "$NODE_TYPE" == "parent" ]]; then
    echo ""
    log_info "Parent node configuration:"
    log_info "- Web interface: http://$(hostname -I | awk '{print $1}'):19999"
    if [[ "$SSL_ENABLED" == "true" ]]; then
        log_info "- HTTPS interface: https://$(hostname -I | awk '{print $1}'):19999"
    fi
    log_info "- API Key: $API_KEY"
    log_info "- Stream UUID: $STREAM_UUID"
    echo ""
    log_warn "Save the API key and Stream UUID for configuring child nodes!"
else
    echo ""
    log_info "Child node configuration:"
    log_info "- Hostname: $CHILD_HOSTNAME"
    log_info "- Parent: $PARENT_IP:19999"
    log_info "- Web interface disabled (view metrics on parent node)"
fi

# Cleanup
rm -f /tmp/netdata-kickstart.sh

log_info "Installation completed successfully!"