cmdbsyncer 4.3.4__tar.gz → 4.4.0__tar.gz

{cmdbsyncer-4.3.4 → cmdbsyncer-4.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.3.4
+Version: 4.4.0
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>
@@ -102,31 +102,24 @@ CMDBsyncer is a powerful, web-based tool designed to solve the complex challenge
 
 ## ⚡ Quick Start
 
-Get started quickly using Docker Compose:
+Every release is published as a container image — nothing to clone, nothing to build:
 
 ```bash
-# Clone the repository
-git clone https://github.com/your-username/cmdbsyncer.git
-cd cmdbsyncer
-
-# For production: check out the last released version.
-# For testing the bleeding edge: stay on main.
-git checkout stable
-
-# Start the application
-./helper up
-
-# Access the container
-./helper shell
+# Fetch the compose file and start CMDBsyncer together with its MongoDB
+curl -O https://raw.githubusercontent.com/kuhn-ruess/cmdbsyncer/main/docker-compose.registry.yml
+docker compose -f docker-compose.registry.yml up -d
 
 # Create your first user
-./helper create_user 'your-email@example.com'
+docker compose -f docker-compose.registry.yml exec api \
+    ./cmdbsyncer sys create_user 'your-email@example.com'
 
-# Access the web interface
-# Open http://your-host:5003 in your browser
+# Open http://your-host:8080 in your browser
 ```
 
-This runs a development version that you can use to test everything.
+The compose file tracks `latest`. Replace the tag with `4.3.3` to pin a release
+or with `4.3` to stay on a minor line; the images cover `linux/amd64` and
+`linux/arm64`. Full walkthrough — configuration volume, upgrades, reverse proxy
+— in [Installation with Docker](https://docs.cmdbsyncer.de/installation/setup_docker/).
 
 ## 📸 Screenshots
 
@@ -257,35 +250,43 @@ This runs a development version that you can use to test everything.
 
 ### Production Installation
 
-1. **Clone the repository and pick a version**
+1. **Fetch the compose file**
    ```bash
-   git clone https://github.com/your-username/cmdbsyncer.git
-   cd cmdbsyncer
-
-   # Use the stable branch (last released version) for production:
-   git checkout stable
-   # …or pin to a specific release tag for reproducible deployments:
-   # git checkout v3.12.12
+   curl -O https://raw.githubusercontent.com/kuhn-ruess/cmdbsyncer/main/docker-compose.registry.yml
    ```
-   See [RELEASE.md](RELEASE.md) for the full branching/versioning policy.
 
-2. **Configure environment**
-   ```bash
-   # Copy and edit configuration files
-   cp docker-compose.prod.yml docker-compose.yml
-   # Edit the configuration as needed
-   ```
+2. **Pick a version**
+
+   Edit the `image:` line. `ghcr.io/kuhn-ruess/cmdbsyncer:latest` follows every
+   release, `:4.3.3` pins one, `:4.3` stays on a minor line.
+   See [RELEASE.md](RELEASE.md) for the full branching/versioning policy.
 
 3. **Start the application**
    ```bash
-   docker-compose up -d
+   docker compose -f docker-compose.registry.yml up -d
    ```
 
 4. **Create admin user**
    ```bash
-   ./helper create_user 'admin@your-domain.com'
+   docker compose -f docker-compose.registry.yml exec api \
+       ./cmdbsyncer sys create_user 'admin@your-domain.com'
    ```
 
+The `config` volume in that file holds `local_config.py`, and with it the key
+every stored account password is encrypted with. Keep it across upgrades and
+back it up together with the database.
+
+#### Building the image yourself
+
+For a fork, a custom base image or a preinstalled plugin:
+
+```bash
+git clone https://github.com/kuhn-ruess/cmdbsyncer.git
+cd cmdbsyncer
+git checkout lts/3.12        # or a release tag: git checkout v4.3.3
+docker compose up -d
+```
+
 ### Development Installation
 
 For development and testing purposes:

{cmdbsyncer-4.3.4 → cmdbsyncer-4.4.0}/README.md

@@ -34,31 +34,24 @@ CMDBsyncer is a powerful, web-based tool designed to solve the complex challenge
 
 ## ⚡ Quick Start
 
-Get started quickly using Docker Compose:
+Every release is published as a container image — nothing to clone, nothing to build:
 
 ```bash
-# Clone the repository
-git clone https://github.com/your-username/cmdbsyncer.git
-cd cmdbsyncer
-
-# For production: check out the last released version.
-# For testing the bleeding edge: stay on main.
-git checkout stable
-
-# Start the application
-./helper up
-
-# Access the container
-./helper shell
+# Fetch the compose file and start CMDBsyncer together with its MongoDB
+curl -O https://raw.githubusercontent.com/kuhn-ruess/cmdbsyncer/main/docker-compose.registry.yml
+docker compose -f docker-compose.registry.yml up -d
 
 # Create your first user
-./helper create_user 'your-email@example.com'
+docker compose -f docker-compose.registry.yml exec api \
+    ./cmdbsyncer sys create_user 'your-email@example.com'
 
-# Access the web interface
-# Open http://your-host:5003 in your browser
+# Open http://your-host:8080 in your browser
 ```
 
-This runs a development version that you can use to test everything.
+The compose file tracks `latest`. Replace the tag with `4.3.3` to pin a release
+or with `4.3` to stay on a minor line; the images cover `linux/amd64` and
+`linux/arm64`. Full walkthrough — configuration volume, upgrades, reverse proxy
+— in [Installation with Docker](https://docs.cmdbsyncer.de/installation/setup_docker/).
 
 ## 📸 Screenshots
 
@@ -189,35 +182,43 @@ This runs a development version that you can use to test everything.
 
 ### Production Installation
 
-1. **Clone the repository and pick a version**
+1. **Fetch the compose file**
    ```bash
-   git clone https://github.com/your-username/cmdbsyncer.git
-   cd cmdbsyncer
-
-   # Use the stable branch (last released version) for production:
-   git checkout stable
-   # …or pin to a specific release tag for reproducible deployments:
-   # git checkout v3.12.12
+   curl -O https://raw.githubusercontent.com/kuhn-ruess/cmdbsyncer/main/docker-compose.registry.yml
    ```
-   See [RELEASE.md](RELEASE.md) for the full branching/versioning policy.
 
-2. **Configure environment**
-   ```bash
-   # Copy and edit configuration files
-   cp docker-compose.prod.yml docker-compose.yml
-   # Edit the configuration as needed
-   ```
+2. **Pick a version**
+
+   Edit the `image:` line. `ghcr.io/kuhn-ruess/cmdbsyncer:latest` follows every
+   release, `:4.3.3` pins one, `:4.3` stays on a minor line.
+   See [RELEASE.md](RELEASE.md) for the full branching/versioning policy.
 
 3. **Start the application**
    ```bash
-   docker-compose up -d
+   docker compose -f docker-compose.registry.yml up -d
    ```
 
 4. **Create admin user**
    ```bash
-   ./helper create_user 'admin@your-domain.com'
+   docker compose -f docker-compose.registry.yml exec api \
+       ./cmdbsyncer sys create_user 'admin@your-domain.com'
    ```
 
+The `config` volume in that file holds `local_config.py`, and with it the key
+every stored account password is encrypted with. Keep it across upgrades and
+back it up together with the database.
+
+#### Building the image yourself
+
+For a fork, a custom base image or a preinstalled plugin:
+
+```bash
+git clone https://github.com/kuhn-ruess/cmdbsyncer.git
+cd cmdbsyncer
+git checkout lts/3.12        # or a release tag: git checkout v4.3.3
+docker compose up -d
+```
+
 ### Development Installation
 
 For development and testing purposes:

{cmdbsyncer-4.3.4 → cmdbsyncer-4.4.0}/application/__init__.py

@@ -467,6 +467,17 @@ if not CLI_MODE:
             insecure = False
         return {'show_https_warning': insecure}
 
+    @app.template_filter('localtime')
+    def _localtime(value, fmt='%Y-%m-%d %H:%M:%S'):
+        """
+        Render a stored (UTC) timestamp in the timezone of the browser
+        that asked for the page: ``{{ job.last_start|localtime }}``.
+        Storage stays UTC everywhere — this is presentation only.
+        """
+        # pylint: disable=import-outside-toplevel
+        from application.helpers.timezone import format_local
+        return format_local(value, fmt)
+
     bootstrap = Bootstrap(app)
 
     login_manager = LoginManager()

{cmdbsyncer-4.3.4 → cmdbsyncer-4.4.0}/application/api/syncer.py

@@ -1,8 +1,9 @@
 """
 Syncer API.
 
-Read-only access to log entries, cron status, host counters, plus a
-webhook trigger for cron groups. Authenticated via ``@require_token``;
+Read-only access to log entries, cron status, host counters, the
+repeated Event Driven Ansible events, plus a webhook trigger for cron
+groups. Authenticated via ``@require_token``;
 a user with ``api_roles = ['syncer']`` (or ``'all'``) can call this
 namespace. The ``/cron/trigger/<group>`` route additionally accepts an
 ``X-Webhook-Token`` header tied to the CronGroup, so external systems
@@ -14,12 +15,16 @@ from flask import request
 from flask_restx import Namespace, Resource, fields
 
 from application import log
-from application.api import require_token, scope_host_query
+from application.api import (
+    api_scope_active, hostnames_in_scope, get_api_account_scope,
+    require_token, scope_host_query,
+)
 from application.enterprise import run_hook as _ent_run_hook
 from application.helpers.audit import audit
 from application.modules.log.models import LogEntry
 from application.models.host import Host
 from application.models.cron import CronStats, CronGroup
+from application.plugins.eda.repeats import DEFAULT_OFFENDER_LIMIT, collect_summary
 
 API = Namespace(
     'syncer',
@@ -98,6 +103,62 @@ HOSTS_STATS = API.model('hosts_stats', {
         description='Hosts whose ``last_import_seen`` is older than 24h'),
 })
 
+EDA_COUNTS = {
+    'events_24h': fields.Integer(description='Events sent (or tried) in '
+                                             'the last 24 hours'),
+    'failed_24h': fields.Integer(description='Of those, the ones the event '
+                                             'stream did not accept'),
+    'pending': fields.Integer(description='Open streaks below the '
+                                          'threshold: sent, host still '
+                                          'matches'),
+    'repeating': fields.Integer(description='Open streaks at or above the '
+                                            'threshold: sent again and '
+                                            'again without effect'),
+    'repeating_hosts': fields.Integer(description='Distinct hosts with a '
+                                                  'repeating event'),
+    'failing': fields.Integer(description='Open streaks whose last send '
+                                          'failed'),
+    'max_sends': fields.Integer(description='Most sends of one open streak'),
+}
+
+EDA_ACCOUNT = API.model('eda_account', {
+    'account': fields.String(description='EDA account the events go to'),
+    **EDA_COUNTS,
+})
+
+EDA_OFFENDER = API.model('eda_offender', {
+    'account': fields.String(),
+    'hostname': fields.String(),
+    'event': fields.String(description='Event name as sent'),
+    'rule': fields.String(description='Name of the Event Rule'),
+    'rule_id': fields.String(),
+    'sends': fields.Integer(description='Sends since the host matches'),
+    'failures': fields.Integer(description='Of those, failed sends'),
+    'threshold': fields.Integer(description='Threshold the streak was '
+                                            'measured against'),
+    'first_sent': fields.String(example='2026-10-10 06:00:00'),
+    'last_sent': fields.String(example='2026-10-13 06:00:00'),
+    'last_status': fields.String(example='success',
+                                 description='success or failure'),
+    'last_http_status': fields.Integer(),
+})
+
+EDA_SUMMARY = API.model('eda_summary', {
+    **EDA_COUNTS,
+    'min_sends': fields.Integer(description='Threshold override of the '
+                                            'request, null = per account'),
+    'accounts': fields.List(fields.Nested(EDA_ACCOUNT)),
+    'offenders': fields.List(fields.Nested(EDA_OFFENDER),
+                             description='Repeating streaks, most sends '
+                                         'first'),
+    'offenders_truncated': fields.Boolean(description='True when the '
+                                                      'limit cut the list'),
+})
+
+EDA_RESPONSE = API.model('eda_response', {
+    'result': fields.Nested(EDA_SUMMARY),
+})
+
 ERROR = API.model('error', {
     'error': fields.String(description='Human-readable error message'),
 })
@@ -371,7 +432,7 @@ class SyncerHostsApi(Resource):
     @require_token
     def get(self):
         """Return totals plus a 24-hour staleness counter."""
-        ago_24h = datetime.now() - timedelta(hours=24)
+        ago_24h = datetime.utcnow() - timedelta(hours=24)
         # Restricted API users only see counters for the hosts they may
         # reach — their accounts, carrying their templates.
         return {
@@ -385,3 +446,61 @@ class SyncerHostsApi(Resource):
                 last_import_seen__lt=ago_24h,
             )).count(),
         }, 200
+
+
+def _int_arg(name, default, minimum):
+    """An integer query argument, None when it is not valid."""
+    value = request.args.get(name)
+    if value in (None, ''):
+        return default
+    try:
+        number = int(value)
+    except ValueError:
+        return None
+    return number if number >= minimum else None
+
+
+def _eda_hostname_filter():
+    """Hosts a restricted API user may see, None when unrestricted."""
+    if not api_scope_active():
+        return None
+    scope = get_api_account_scope()
+
+    def allowed(hostnames):
+        return hostnames_in_scope(hostnames, scope)
+    return allowed
+
+
+@API.route('/eda')
+class SyncerEdaApi(Resource):
+    """Event Driven Ansible: events sent again and again without effect."""
+
+    @API.doc(security=['basicAuth', 'apiToken'], params={
+        'account': 'Only this EDA account',
+        'min_sends': 'Count a streak as repeating from this many sends on, '
+                     'instead of the repeat_threshold of each account',
+        'limit': f'Most offenders listed (default {DEFAULT_OFFENDER_LIMIT})',
+    })
+    @API.response(200, 'Counters and repeating events.', EDA_RESPONSE)
+    @API.response(400, 'Invalid query argument', ERROR)
+    @API.response(401, 'Authentication failed', ERROR)
+    @require_token
+    def get(self):
+        """Return how many events repeat without effect, and which.
+
+        A streak starts when a host matches an Event Rule and counts
+        every send of that event. It ends (resolved) on the first run in
+        which the host no longer gives the event. A streak that is still
+        open after ``repeat_threshold`` sends (account field, default 3)
+        is repeating.
+        """
+        min_sends = _int_arg('min_sends', None, 1)
+        limit = _int_arg('limit', DEFAULT_OFFENDER_LIMIT, 0)
+        if (request.args.get('min_sends') and min_sends is None) or limit is None:
+            return {'error': 'min_sends must be >= 1, limit >= 0'}, 400
+        return {
+            'result': collect_summary(
+                account=request.args.get('account') or None,
+                min_sends=min_sends, limit=limit,
+                hostname_filter=_eda_hostname_filter()),
+        }, 200

cmdbsyncer-4.4.0/application/buildinfo.txt

@@ -0,0 +1 @@
+BUILD_DATE=2026-10-13T09:07:44Z

{cmdbsyncer-4.3.4 → cmdbsyncer-4.4.0}/application/changelog/v4.3.md

@@ -1,5 +1,32 @@
 # Version 4.3
 
+## Unreleased
+- FIX: A new account password also takes effect when the change waits for an approval: after the approval the account kept its old password, and until then the new one was stored unencrypted
+- FIX: An account value used through `{{ACCOUNT:name:field}}` now arrives exactly as stored, also when a password contains `{{`, `{%` or `{#`, which used to be read as a template and came out cut short or empty
+- FIX: An Ansible variable reading an account through `{{ACCOUNT:<name>:<field>}}` gets the current value of the account in the inventory: after the account was created or changed, the inventory kept the value from before, or an empty one, until its cache was rebuilt
+- FIX: Opening the debug page of a host no longer puts `********` into its Ansible inventory where a variable reads an account password through `{{ACCOUNT:<name>:password}}`; the debug page still hides the password
+- FIX: The Checkmk notification rule export no longer overwrites the notification parameters chosen by hand in Checkmk — a rule with a custom plug-in whose parameter set had been switched was rewritten on every run and put back on the set holding the parameters of the syncer, and a changed rule could take over the Checkmk rule of an unchanged one sending to the same contact groups, so both swapped their settings; the parameters of a custom plug-in are now only used when the syncer creates a rule, afterwards they belong to Checkmk like those of a built-in plug-in
+- FIX: A rule using `syncer_last_seen` or `syncer_last_sync` now gets the date the host page shows: both were only available on hosts an import had written them onto, so a rule that switches a host off after so many days without a sighting quietly fell back to its else value on every other host, and elsewhere was working with the date of the run before or, on a host the export had already cached, with the date that cache was built with
+- FIX: Every host now records when it was created, whichever way it was created — so far only an import wrote that timestamp, so hosts added in the interface, copies and CSV imports had none
+- FIX: Two Checkmk host tags carrying the same name no longer block the update of their whole tag group — Checkmk read them as a renamed tag and refused the change, so new tag values were never created and the host export kept failing on them
+- FEAT: New option CMK_TAG_REPAIR lets Checkmk update the hosts and rules which use a changed tag group, for the case where Checkmk refuses the change and asks for that permission — the documentation says when that is safe and when it widens your rules
+- FEAT: New option CMK_BULK_FALLBACK_SINGLE sends the hosts of a failed bulk request to Checkmk one by one, so a single rejected host no longer takes its whole batch down with it
+- FIX: An own LDAP filter in the directory search now replaces the search filter of the account instead of being added to it, so a filter looking for something else than the imported hosts finds it; the account's filter can be switched back on with the box below the search field
+- FIX: `./cmdbsyncer` commands start right away instead of setting up the Ansible default project first, which had every call open a database connection before it began — a command now starts in about a second where it waited half a minute on a slow or unreachable database
+- FIX: Host timestamps are now written in UTC everywhere, so the "not seen for X days" cleanup, the stale marking and the API timestamps agree with each other on servers that do not run in UTC
+- FIX: An import source delivering a hostname that is not text now reports a readable error instead of a traceback
+- FIX: Inventorize runs only write a host to the database when an attribute really changed, which noticeably speeds up large Netbox inventories
+- FIX: A database problem while looking up CMDB templates is written to the log instead of silently looking like "no template matched"
+
+## Version 4.3.5
+- FIX: Inventorize applied `rewrite_hostname` twice for CSV, JSON, REST, YML, MySQL, ODBC, JDisc and LDAP accounts, so a template that appends something to the name, a domain for example, missed the host the import had created
+- FIX: When Checkmk applies a bulk host update or create only in part ("Some actions failed"), the log now names each skipped host with the reason Checkmk gives, in one entry, instead of only the host names. A host is also no longer edited several times per export, so the Checkmk audit log no longer fills up with "Nothing was changed" entries, and a host whose attribute was removed is no longer reported as faulty although the removal worked. A bulk update request carries as many hosts as CMK_BULK_UPDATE_OPERATIONS allows, so this needs no more requests than before
+- FIX: A Move to Folder rule whose folder option has no value for a host (it renders to False, True or None, for example a city the host does not have) no longer writes that into the Checkmk folder: Checkmk 2.5 then failed to list any folder and every export stopped with "Mismatch between endpoint and internal data format". The option is left out with a warning naming folder and attribute, a value like this already in a folder is removed, and when Checkmk can no longer list its folders the export continues and repairs the folders its rules manage
+- FIX: A playbook run with an SSH password no longer fails on every host with "Invalid/incorrect password" when the application runs as the web server user — ssh was trying to write its known_hosts into that user's home directory, which is not writable; each run now keeps its known_hosts with its other temporary files, and a run that still hits this says so in the log instead of blaming the password
+- FIX: A Checkmk rule that Checkmk refuses to update is left in place instead of being deleted — a value the target rejects (for example a password store reference written in a format a newer Checkmk no longer accepts) made the export delete the rule and then fail to recreate it, so the rule was gone after every run
+- FEAT: The Checkmk rule export can be tried out before it runs: `export_rules --dry-run` reads the site and prints every rule it would create, update and delete, with the value it would write and the reason behind every deletion, and sends nothing to Checkmk
+- FIX: `--debug` on the Checkmk rule export now shows the full error of a failed run, the same as the other export commands do, instead of only the difference behind each deletion
+
 ## Version 4.3.4
 - FIX: A user the directory created can now log in — a successful directory bind ended in a server error for anybody who has no local password, which is every user created on first login
 - FIX: A directory login that fails records what went wrong, so an unreachable server, a service account with the wrong password and a group mapping naming a role that does not exist can be told apart in Settings → Log

cmdbsyncer-4.4.0/application/changelog/v4.4.md

@@ -0,0 +1,47 @@
+# Version 4.4
+
+## Version 4.4.0
+
+### Setup
+- FEAT: New account option "http_proxy" sends every HTTP request of that account through a proxy — for a target system like ServiceNow that is only reachable through the corporate proxy; `direct` sends a single account past a proxy the environment sets for everything else
+
+### Interface
+- FEAT: The times the interface shows for hosts — created, last seen, last synced, the host timeline, the inventory trees, the data quality page and the API token list — are converted to the timezone of the computer you are reading them on, while they stay stored in UTC; cron and log timestamps are unchanged, they are written in the server's own time
+
+### Hosts & Objects
+- FEAT: One imported record can create several hosts: a `rewrite_hostname` template that renders a list, for example `{{ [HOSTNAME, HOSTNAME | replace('SRV01', 'RTR01')] }}`, imports one host per entry, each with all attributes of the record; every importer handles it the same way, and a template that renders a plain name works exactly as before
+- FEAT: The host and object search finds entries by the day they were created: `created:today`, `created:yesterday` or `created:2026-09-22`, and `created:>=2026-09-01` together with `created:<=2026-09-07` for a range; the day is the one on your own clock — hosts that were created before the syncer recorded a creation time are matched by the day their entry was written to the database
+- FEAT: CMDB objects can be debugged like hosts: the bug icon in the object list opens the same debug page with the object's attributes, matching rules and outcomes, and the new target "Netbox Objects" shows the IP address, prefix, interface, contact and dataflow rules that apply to a host or object
+
+### Rules
+- FEAT: Rules can take a pasted list (CSV, semicolon or tab separated, e.g. copied from a spreadsheet) as their input instead of the hosts: switch the new Rule source to "From a pasted list", and the first line of the list names the columns, which become variables for the outcomes; the rule renders its outcomes once per row instead of once per host, and the form shows the column variables (a click inserts one into the field you were editing), the first rows and every problem with its line while you paste. Available for the Checkmk Setup Rules (rows that only differ in the service name are joined into one Checkmk rule), DCD rules, BI rules and aggregations, notification rules and downtimes, the i-doit custom attributes, the Jira export rules, the Netbox devices, virtual machines, clusters, prefixes, interfaces, IP addresses, contacts and Dataflow fields, the VMware custom attributes, the Ansible custom variables and the Ansible playbook fire rules; where a row stands for one object (an i-doit or Jira object, a Netbox device, the device or virtual machine of Netbox interfaces, an inventory host, the host of a downtime or of a playbook run), its `hostname` or `name` column names it
+- FEAT: Two new condition types, Older Than and Newer Than, compare the value of an attribute holding a date against the clock — they are offered as a value match only, because a hostname and an attribute name are never a date — so a rule can be limited to the hosts that were not seen for longer than a given age (2d, 12h, 30m, 1w or a plain number of days) — and, the other way round, to the ones seen since; the same thing needed a Jinja expression before
+- FIX: A rule working with the date a host was last seen is no longer answered out of the export cache, so a host switched off after days without a sighting is switched on again as soon as it is back instead of keeping the state it was given while it was missing; only the rule sets that work with a date are affected, every other one stays cached and exports as fast as before
+- FIX: "Foreach Value in List" now also accepts an attribute name ending in *, so hosts carrying their groups in several attributes — one per team, each a comma separated list — are read as one list instead of yielding nothing
+
+### Checkmk
+- FIX: Checkmk downtimes with a duration are no longer set again on every run, and the Duration field reads host attributes like every other field of a downtime
+- FIX: The folder of a Checkmk DCD creation rule now renders its Jinja variables (a host attribute or a column of the pasted list), and one connection Checkmk refuses no longer keeps the others of the same export from being created
+
+### Checkmk - Setup Rules
+- FEAT: The Checkmk rule export calculates its rules about three times faster, so a big inventory spends far less time in "Loop over Hosts and collect distinct rules"
+- FEAT: Every Checkmk Setup Rule has a debug page, reached by its bug icon in the rule list: for a rule built from a pasted list it shows every row with the number of rules it produced and the Checkmk rules the export would send, without contacting Checkmk; for a rule built per host it opens the host debug page with that rule preselected
+
+### Checkmk - User Generation
+- FEAT: Checkmk users can be generated from host attributes — one user per LDAP group the hosts carry, named after the group and given the mail address that group has in the directory; a new rule under Checkmk says which attributes hold the group names, and existing users created by hand are never overwritten
+- FEAT: The Checkmk user generation can rewrite a group name before it is looked up, for hosts that carry it in a different shape than the directory uses — a prefix dropped, a domain cut off; a value the rewrite empties is skipped instead of creating a user from whatever the search filter alone finds
+- FEAT: The fields of a generated Checkmk user can name the group both ways: {{name}} as it was searched in the directory and {{original_name}} as the host carried it before the rewrite
+- FEAT: Checkmk roles and contact groups of a generated user are Jinja too, so a group can say which ones it deserves — an entry that renders to nothing is dropped and one that renders to several names becomes all of them
+- FEAT: New page "Preview Generated Users" under Checkmk shows what the generation rules would make of the hosts you have right now — which groups were found, what the directory returned for them and which Checkmk user each one becomes, without writing anything
+- FEAT: The Checkmk user generation can be debugged from the command line: `--debug` shows which subtree, filter and attribute the group lookup used and which groups the directory did not return, and `--search-filter` tries another group filter out without anybody editing the rules first
+
+### Event Driven Ansible
+- FEAT: New module Event Driven Ansible: rules decide which hosts send which event to an Event Driven Ansible event stream or webhook, and the cronjob "EDA: Send Events" sends them, for example to start the TLS or bakery registration of a Checkmk agent that the Checkmk inventory reports as not registered; the same event is sent again only after a configurable number of hours, and every event sent is listed in the Event History
+- FEAT: Event Driven Ansible shows under Repeated Events which hosts keep getting the same event without effect: every event counts its sends while the host still matches the rule, it counts as repeating from a threshold set on the account (default 3 sends) and as resolved as soon as the host no longer matches; the REST endpoint `/api/v1/syncer/eda` returns the counters and the repeating events for monitoring with Checkmk
+
+### Ansible
+- FEAT: The Checkmk agent and server playbooks take the new variable `cmk_agent_host_name` as the host name they report to Checkmk; it defaults to the inventory name, so a host can be known in Checkmk by its short name while Ansible connects to its FQDN, or the other way round
+- FIX: The shipped Checkmk agent and server playbooks work with an automation secret that contains special characters such as €, ö, spaces, quotes, $ or backslashes, and no longer show the secret in the Ansible output
+
+### LDAP
+- FEAT: Every field of an LDAP account now explains in the form what it configures

{cmdbsyncer-4.3.4 → cmdbsyncer-4.4.0}/application/config.py

@@ -365,10 +365,22 @@ class BaseConfig():
     CMK_BULK_DELETE_OPERATIONS = 50
 
     CMK_DONT_DELETE_TAGS = True
+    # Allow Checkmk to update hosts and rules which use a changed tag group.
+    # WARNING: Checkmk repairs a removed tag by deleting the condition from
+    # every rule which uses it. The rule stays, but without that condition it
+    # matches more hosts than before. Combined with CMK_DONT_DELETE_TAGS = False
+    # every value which disappears from the source can silently widen a rule.
+    # A renamed tag is uncritical, there the condition gets the new id.
+    CMK_TAG_REPAIR = False
 
     CMK_BULK_UPDATE_HOSTS = True
     CMK_BULK_UPDATE_OPERATIONS = 50
 
+    # Retry the hosts of a failed bulk request one by one, so that one broken
+    # host does not block its whole batch. Costs one request per host of a
+    # failed batch, therefore off by default.
+    CMK_BULK_FALLBACK_SINGLE = False
+
     CMK_LOWERCASE_FOLDERNAMES = True
     CMK_LOWERCASE_LABEL_VALUES = False
 

{cmdbsyncer-4.3.4 → cmdbsyncer-4.4.0}/application/docu_links.py

@@ -12,6 +12,7 @@ docu_links = {
     'accounts' : 'https://docs.cmdbsyncer.de/basics/accounts/',
     'cmk_inventory_attributes': 'https://docs.cmdbsyncer.de/checkmk/inventorize/',
     'cmk_groups': 'https://docs.cmdbsyncer.de/checkmk/groups_management/',
+    'cmk_user_generation': 'https://docs.cmdbsyncer.de/checkmk/user_generation/',
     'cmk_setup_rules': 'https://docs.cmdbsyncer.de/checkmk/rules_management/',
     'cmk_hosttags': 'https://docs.cmdbsyncer.de/checkmk/create_hosttags/',
     'cmk_password_store': 'https://docs.cmdbsyncer.de/checkmk/password_store/',

{cmdbsyncer-4.3.4 → cmdbsyncer-4.4.0}/application/helpers/get_account.py

@@ -20,7 +20,18 @@ SECRET_ACCOUNT_FIELDS = ('password', 'password_crypted')
 
 SECRET_PLACEHOLDER = '********'
 
-_mask_secrets = ContextVar('mask_account_secrets', default=False)
+_mask_secrets = ContextVar('mask_account_secrets', default=None)
+
+
+class SecretMasking:  # pylint: disable=too-few-public-methods
+    """
+    State of one `mask_account_secrets` block. `used` turns True once a
+    secret was replaced by the placeholder, so the caller knows its
+    results hold placeholders instead of real values.
+    """
+
+    def __init__(self):
+        self.used = False
 
 
 @contextmanager
@@ -34,10 +45,14 @@ def mask_account_secrets():
     `checkmk`) could add a rule whose outcome is the macro, open the
     debug page and read the password of *any* account — bypassing the
     `account` role that guards the account views.
+
+    Yields a `SecretMasking`: whatever was computed inside the block and
+    cached for later runs carries the placeholder when its `used` is set.
     """
-    token = _mask_secrets.set(True)
+    masking = SecretMasking()
+    token = _mask_secrets.set(masking)
     try:
-        yield
+        yield masking
     finally:
         _mask_secrets.reset(token)
 
@@ -71,8 +86,25 @@ def clear_account_cache(*_args, **_kwargs):
     _account_cache.clear()
 
 
+def clear_host_caches(*_args, **_kwargs):
+    """
+    Drop the per host outcome caches. Wired to Account save/delete.
+
+    Rule outcomes are cached with every {{ACCOUNT:...}} macro already
+    resolved, so the exports reading them (e.g. the Ansible inventory)
+    would keep serving what the account held when the cache was built,
+    or an empty value when it did not exist yet. Saving a rule drops
+    the caches for the same reason.
+    """
+    # Imported here: the host model renders Jinja, which imports this module.
+    from application.models.host import Host  # pylint: disable=import-outside-toplevel
+    Host.objects(cache__ne={}).update(set__cache={})
+
+
 signals.post_save.connect(clear_account_cache, sender=Account)
 signals.post_delete.connect(clear_account_cache, sender=Account)
+signals.post_save.connect(clear_host_caches, sender=Account)
+signals.post_delete.connect(clear_host_caches, sender=Account)
 
 
 def _resolve_password(account):
@@ -164,7 +196,9 @@ def get_account_variable(macro):
         inner = macro.strip().removeprefix('{{').removesuffix('}}')
         _, account, var = (part.strip() for part in inner.split(':'))
         value = get_account_by_name(account)[var]
-        if var in SECRET_ACCOUNT_FIELDS and _mask_secrets.get():
+        masking = _mask_secrets.get()
+        if var in SECRET_ACCOUNT_FIELDS and masking is not None:
+            masking.used = True
             return SECRET_PLACEHOLDER
         return value
     except (ValueError, KeyError, AccountNotFoundError) as exc: