Skip to main content

Configuring Centreon to receive a Docker poller connection

This procedure describes how to configure Gorgone (a submodule of Centreon) between a distant poller and a Central server using pullwss mode. This is the only method allowed for pollers running in a Docker container, because the poller cannot be reached from the Central server.

  • In pullwss mode, the poller opens a WebSocket connection to the Central.

  • Because the connection uses HTTP(S), certificates are needed to secure the connection. To simplify certificate lifecycle management, Apache (which already hosts the Centreon web interface) is used as a reverse proxy to terminate the TLS connection and forward the traffic to Gorgone.

Installation requirements​

If you are using Centreon cloud, you can skip this configuration, and directly use the one-line command to configure the poller to connect to the Central using pullwss. You can retrieve this command in the Centreon web interface, in the poller configuration page.

Ensure the Central server and Gorgone are already installed and up to date with the latest major version.

Requirement: If not already done, configure certificates for Apache. See the documentation to auto-generate them here.

The poller must be able to reach the Central server. Docker poller are available starting from version 26.10. Older versions of Centreon poller are still compatible if used in VM mode.

Configure Gorgone​

In previous versions of Centreon, Gorgone could listen for pullwss connections directly on the network if manually configured to do so. Starting with version 26.10, the recommended method is to use Apache as a reverse proxy for Gorgone. If you already use pullwss, see the compatibility mode section below.

Update the file /etc/centreon-gorgone/config.d/40-gorgoned.yaml on the central as follows:

gorgone:
  modules:
    - name: nodes
      package: "gorgone::modules::core::nodes::hooks"
      enable: true
      
    - name: proxy
      package: "gorgone::modules::core::proxy::hooks"
      enable: true
      httpserver:
        enable: true
        ssl: false
        address: "localhost"
        port: 8087

Please note this file is a yaml file, so indentation are important. Use 2 spaces for each indentation level.

The nodes module should already be present, and does not need modification in a default installation. The proxy module is already present too, but not the httpserver sub-key, which you should add.

Explanation of the configuration:

  • ssl: false and address: "localhost": Gorgone only accepts connections from the local machine, in plain HTTP. Apache is the one terminating TLS for the pollers and forwarding the traffic locally, so Gorgone itself does not need a certificate.
  • port: 8087: internal port used only for the connection between Apache and Gorgone on the same host. It should not be exposed to the network.

Restart Gorgone after this change:

systemctl restart gorgoned

Check gorgone correctly listen to port 8087:

sudo ss -tnlp | grep 8087

Should return one line similar to this:

LISTEN 0      4096                [::1]:8087          [::]:*    users:(("gorgone-proxy-h",pid=2305,fd=28))

Configure Apache as a reverse proxy​

Apache modules prerequisites​

Make sure the proxy_wstunnel Apache module is enabled:

Contrary to deb packages, the Alma 9 httpd package already has the proxy_wstunnel module enabled by default, so there is nothing to do.

Apache reverse proxy configuration​

Centreon offers an example of a configuration file to enable HTTPS and serving gorgone as a reverse proxy, available in the following directory: /usr/share/centreon/examples/centreon.apache.https.conf

if your configuration is specific, this is the required configuration to add inside your Apache virtual host:

    <IfModule mod_proxy_wstunnel.c>
        ProxyPass "/${base_uri}/gorgone/pullwss/websocket"  "ws://localhost:8087/"
        ProxyPassReverse "/${base_uri}/gorgone/pullwss/websocket"  "ws://localhost:8087/"
    </IfModule>

If you already used pullwss in a previous version, you have multiple options:

  • Update all pollers to the same version, and configure them to access the Central on port 443 (Recommended).
  • If you cannot update all pollers at the same time, you can add an Apache configuration to keep the legacy pullwss port 8086, and redirect the traffic to Gorgone. This is explained in the next section.

Old poller configuration with no certificate (plain HTTP)​

This section should be used only if you already configured pullwss in a previous version of Centreon, and you have many pollers that cannot be reconfigured easily.

Centreon offers an example of an Apache configuration file to redirect the traffic from port 8086 to Gorgone to keep the older pollers working. Please note that using pullwss without TLS is not recommended in production, and should be migrated as soon as possible. This configuration is only for compatibility with old pollers that cannot be configured to use TLS.

cp /usr/share/centreon/examples/centreon-apache-gorgone.conf /etc/httpd/conf.d/
systemctl restart httpd

Old poller configuration with certificate (HTTPS)​

This section should be used only if you already configured pullwss in a previous version of Centreon, and you have many pollers that cannot be reconfigured easily.

Centreon offers an example of an apache configuration file to redirect the traffic from port 8086 to Gorgone to keep the older pollers working.

cp /usr/share/centreon/examples/centreon-apache-https-gorgone.conf /etc/httpd/conf.d/
systemctl restart httpd

Poller configuration​

You can now add a poller in the Central web interface and configure it as a "docker" poller. Once done, you can use the one-line command to configure the poller to connect to the Central using pullwss.

debug installation​

If your installation does not work, there is multiples thing you can check:

  • does the poller can reach the central on port 443? you can check from the poller with the command nc -zv <central_hostname> 443
  • Does gorgone correctly listen on port 8087 ?
curl --header "Connection: Upgrade" --header "Upgrade: websocket" http://localhost:8087/

Expected output is:

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Sec-WebSocket-Accept: Kfh9QIsMVZcl6xEPYxPHzW8SZ8w=
Server: Mojolicious (Perl)
Upgrade: websocket
  • Does Apache2 redirect the traffic to gorgone correctly ?
curl -v --header "Connection: Upgrade" --header "Upgrade: websocket" https://localhost:443/centreon/gorgone/pullwss/websocket

Expected output is:

< HTTP/1.1 101 Switching Protocols
< Connection: Upgrade
< Sec-WebSocket-Accept: Kfh9QIsMVZcl6xEPYxPHzW8SZ8w=
< Server: Mojolicious (Perl)
< Upgrade: websocket

If you see an html page indicating You need to enable JavaScript to run this app. the apache reverse proxy is not correctly configured, and the traffic is redirected to the Centreon web interface instead of gorgone. Check your apache configuration and restart apache after any change.