icinga stuff

28 files changed, 697 insertions, 73 deletions

diff --git a/files/usr/local/etc/icinga2/conf.d/app.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/app.conf.icinga_server
new file mode 100644
index 0000000..3e4be0d
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/app.conf.icinga_server
@@ -0,0 +1 @@
+object IcingaApplication "app" { }
diff --git a/files/usr/local/etc/icinga2/conf.d/commands.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/commands.conf.icinga_server
new file mode 100644
index 0000000..dd78f14
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/commands.conf.icinga_server
@@ -0,0 +1,40 @@
+object NotificationCommand "mail-host-notification" {
+  command = [ ConfigDir + "/scripts/mail-host-notification.sh" ]
+
+  env = {
+    NOTIFICATIONTYPE = "$notification.type$"
+    HOSTDISPLAYNAME = "$host.display_name$"
+    HOSTNAME = "$host.name$"
+    HOSTADDRESS = "$address$"
+    HOSTSTATE = "$host.state$"
+    LONGDATETIME = "$icinga.long_date_time$"
+    HOSTOUTPUT = "$host.output$"
+    NOTIFICATIONAUTHORNAME = "$notification.author$"
+    NOTIFICATIONCOMMENT = "$notification.comment$"
+    HOSTDISPLAYNAME = "$host.display_name$"
+    USEREMAIL = "$user.email$"
+    HOSTNOTES = "$host.notes$"
+  }
+}
+
+object NotificationCommand "mail-service-notification" {
+  command = [ ConfigDir + "/scripts/mail-service-notification.sh" ]
+
+  env = {
+    NOTIFICATIONTYPE = "$notification.type$"
+    SERVICENAME = "$service.name$"
+    HOSTNAME = "$host.name$"
+    HOSTDISPLAYNAME = "$host.display_name$"
+    HOSTADDRESS = "$address$"
+    SERVICESTATE = "$service.state$"
+    LONGDATETIME = "$icinga.long_date_time$"
+    SERVICEOUTPUT = "$service.output$"
+    NOTIFICATIONAUTHORNAME = "$notification.author$"
+    NOTIFICATIONCOMMENT = "$notification.comment$"
+    HOSTDISPLAYNAME = "$host.display_name$"
+    SERVICEDISPLAYNAME = "$service.display_name$"
+    USEREMAIL = "$user.email$"
+    HOSTNOTES = "$host.notes$"
+    SERVICENOTES = "$service.notes$"
+  }
+}
diff --git a/files/usr/local/etc/icinga2/conf.d/downtimes.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/downtimes.conf.icinga_server
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/downtimes.conf.icinga_server
diff --git a/files/usr/local/etc/icinga2/conf.d/groups.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/groups.conf.icinga_server
new file mode 100644
index 0000000..f6f13b8
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/groups.conf.icinga_server
@@ -0,0 +1,119 @@
+object HostGroup "hypervisors" {
+  display_name = "Hypervisors"
+  assign where regex("^alcatraz[0-9]+", host.name)
+}
+
+object HostGroup "idm-servers" {
+  display_name = "IDM Servers"
+  assign where regex("^idm[0-9]+", host.name)
+}
+
+object HostGroup "pkg-repositories" {
+  display_name = "Pkg Repositories"
+  assign where regex("^pkg[0-9]+", host.name)
+}
+
+object HostGroup "smtp-servers" {
+  display_name = "SMTP Servers"
+  assign where regex("^smtp[0-9]+", host.name)
+}
+
+object HostGroup "imap-servers" {
+  display_name = "IMAP Servers"
+  assign where regex("^imap[0-9]+", host.name)
+}
+
+object HostGroup "radius-servers" {
+  display_name = "RADIUS Servers"
+  assign where regex("^radius[0-9]+", host.name)
+}
+
+object HostGroup "desktops" {
+  display_name = "Desktops"
+  assign where regex("^desktop[0-9]+", host.name)
+}
+
+object HostGroup "laptops" {
+  display_name = "Laptops"
+  assign where regex("^laptop[0-9]+", host.name)
+}
+
+object HostGroup "postgresql-servers" {
+  display_name = "PostgreSQL Servers"
+  assign where regex("^postgres[0-9]+", host.name)
+}
+
+object HostGroup "dav-servers" {
+  display_name = "DAV Servers"
+  assign where regex("^dav[0-9]+", host.name)
+}
+
+object HostGroup "bitwarden-servers" {
+  display_name = "Bitwarden Servers"
+  assign where regex("^bitwarden[0-9]+", host.name)
+}
+
+object HostGroup "ttrss-servers" {
+  display_name = "TT-RSS Servers"
+  assign where regex("^ttrss[0-9]+", host.name)
+}
+
+object HostGroup "znc-servers" {
+  display_name = "ZNC Servers"
+  assign where regex("^znc[0-9]+", host.name)
+}
+
+object HostGroup "cups-servers" {
+  display_name = "CUPS Servers"
+  assign where regex("^cups[0-9]+", host.name)
+}
+
+object HostGroup "unifi-controllers" {
+  display_name = "UniFi Controllers"
+  assign where regex("^unifi[0-9]+", host.name)
+}
+
+object HostGroup "invidious-servers" {
+  display_name = "Invidious Servers"
+  assign where regex("^invidious[0-9]+", host.name)
+}
+
+object HostGroup "git-servers" {
+  display_name = "Git Servers"
+  assign where regex("^git[0-9]+", host.name)
+}
+
+object HostGroup "xmpp-servers" {
+  display_name = "XMPP Servers"
+  assign where regex("^xmpp[0-9]+", host.name)
+}
+
+object HostGroup "web-servers" {
+  display_name = "Web Servers"
+  assign where regex("^(www|web)[0-9]+", host.name)
+}
+
+object HostGroup "nameservers" {
+  display_name = "Nameservers"
+  assign where regex("^ns[0-9]+", host.name)
+}
+
+object HostGroup "asterisk-servers" {
+  display_name = "Asterisk Servers"
+  assign where regex("^pbx[0-9]+", host.name)
+}
+
+object HostGroup "nfs-servers" {
+  display_name = "NFS Servers"
+  assign where regex("^nfs[0-9]+", host.name)
+}
+
+object HostGroup "turn-servers" {
+  display_name = "TURN Servers"
+  assign where regex("^turn[0-9]+", host.name)
+}
+
+object HostGroup "icinga-servers" {
+  display_name = "Icinga Servers"
+  assign where regex("^icinga[0-9]+", host.name)
+}
diff --git a/files/usr/local/etc/icinga2/conf.d/hosts.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/hosts.conf.icinga_server
new file mode 100644
index 0000000..dbc2a54
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/hosts.conf.icinga_server
@@ -0,0 +1,3 @@
+/*
+ * Add custom hosts here.
+ */
diff --git a/files/usr/local/etc/icinga2/conf.d/notifications.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/notifications.conf.icinga_server
new file mode 100644
index 0000000..effff9e
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/notifications.conf.icinga_server
@@ -0,0 +1,23 @@
+apply Notification "mail-icingaadmin" to Host {
+  import "mail-host-notification"
+  user_groups = host.vars.notification.mail.groups
+  users = host.vars.notification.mail.users
+
+  //interval = 2h
+
+  //vars.notification_logtosyslog = true
+
+  assign where host.vars.notification.mail
+}
+
+apply Notification "mail-icingaadmin" to Service {
+  import "mail-service-notification"
+  user_groups = host.vars.notification.mail.groups
+  users = host.vars.notification.mail.users
+
+  //interval = 2h
+
+  //vars.notification_logtosyslog = true
+
+  assign where host.vars.notification.mail
+}
diff --git a/files/usr/local/etc/icinga2/conf.d/services.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/services.conf.icinga_server
new file mode 100644
index 0000000..5b00864
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/services.conf.icinga_server
@@ -0,0 +1,165 @@
+apply Service "ssh" {
+  import "generic-service"
+  check_command = "ssh"
+  assign where host.vars.os in ["FreeBSD","Linux"]
+}
+
+apply Service "icinga" {
+  import "generic-service"
+  check_command = "icinga"
+  assign where host.name == NodeName
+}
+
+apply Service "dns" {
+  import "generic-service"
+  check_command = "dns"
+  vars.dns_lookup = "$address$"
+  vars.dns_server = "$address$"
+  vars.dns_wtime = ResponseTimeWarn
+  vars.dns_ctime = ResponseTimeCrit
+  assign where "idm-servers" in host.groups
+}
+
+apply Service "ldap" {
+  import "generic-service"
+  check_command = "ldap"
+  vars.ldap_port = 389
+  vars.ldap_warning = ResponseTimeWarn
+  vars.ldap_critical = ResponseTimeCrit
+  vars.ldap_v2 = false
+  vars.ldap_v3 = true
+  vars.ldap_starttls = true
+  vars.ldap_bind = IcingaDN
+  vars.ldap_pass = IcingaPassword
+  vars.ldap_base = HostsBaseDn
+  vars.ldap_attr = "(cn=" + NodeName + ")"
+  assign where "idm-servers" in host.groups
+}
+
+apply Service "ldaps" {
+  import "generic-service"
+  check_command = "ldap"
+  vars.ldap_port = 636
+  vars.ldap_warning = ResponseTimeWarn
+  vars.ldap_critical = ResponseTimeCrit
+  vars.ldap_v2 = false
+  vars.ldap_v3 = true
+  vars.ldap_ssl = true
+  vars.ldap_bind = IcingaDN
+  vars.ldap_pass = IcingaPassword
+  vars.ldap_base = HostsBaseDn
+  vars.ldap_attr = "(cn=" + NodeName + ")"
+  assign where "idm-servers" in host.groups
+}
+
+apply Service "imap" {
+  import "generic-service"
+  check_command = "imap"
+  vars.imap_port = 993
+  vars.imap_ssl = true
+  vars.imap_certificate_age = CertDaysWarn
+  vars.imap_warning = ResponseTimeWarn
+  vars.imap_critical = ResponseTimeCrit
+  assign where "imap-servers" in host.groups
+}
+
+apply Service "smtp" {
+  import "generic-service"
+  check_command = "smtp"
+  vars.smtp_port = 25
+  vars.smtp_certificate_age = CertDaysWarn
+  vars.smtp_starttls = true
+  vars.smtp_warning = ResponseTimeWarn
+  vars.smtp_critical = ResponseTimeCrit
+  assign where "smtp-servers" in host.groups
+}
+
+apply Service "submission" {
+  import "generic-service"
+  check_command = "smtp"
+  vars.smtp_port = 587
+  vars.smtp_certificate_age = CertDaysWarn
+  vars.smtp_starttls = true
+  vars.smtp_warning = ResponseTimeWarn
+  vars.smtp_critical = ResponseTimeCrit
+  assign where "smtp-servers" in host.groups
+}
+
+apply Service "postgres" {
+  import "generic-service"
+  check_command = "pgsql"
+  vars.pgsql_warning = ResponseTimeWarn
+  vars.pgsql_critical = ResponseTimeCrit
+  vars.pgsql_username = IcingaUsername
+  vars.pgsql_password = IcingaPassword
+  assign where "postgresql-servers" in host.groups
+}
+
+// Expect HTTP 200
+apply Service "http" {
+  import "generic-service"
+  check_command = "http"
+  vars.http_vhost = "$address$"
+  vars.http_expect = "HTTP/1.1 200 OK"
+  vars.http_ssl = false
+  vars.http_warn_time = ResponseTimeWarn
+  vars.http_critical_time = ResponseTimeCrit
+  assign where ("cups-servers"      in host.groups
+             || "pkg-repositories"  in host.groups)
+}
+
+// Expect HTTP 301
+apply Service "http" {
+  import "generic-service"
+  check_command = "http"
+  vars.http_vhost = "$address$"
+  vars.http_expect = "HTTP/1.1 301 Moved Permanently"
+  vars.http_ssl = false
+  vars.http_warn_time = ResponseTimeWarn
+  vars.http_critical_time = ResponseTimeCrit
+  assign where ("dav-servers"       in host.groups
+             || "smtp-servers"      in host.groups
+             || "ttrss-servers"     in host.groups
+             || "invidious-servers" in host.groups
+             || "nfs-servers"       in host.groups
+             || "pkg-servers"       in host.groups
+             || "unifi-controllers" in host.groups
+             || "web-servers"       in host.groups
+             || "xmpp-servers"      in host.groups
+             || "znc-servers"       in host.groups)
+}
+
+// Expect HTTPS 401
+apply Service "https" {
+  import "generic-service"
+  check_command = "http"
+  vars.http_vhost = "$address$"
+  vars.http_expect = "HTTP/1.1 401 Unauthorized"
+  vars.http_ssl = true
+  vars.http_certificate = CertDaysWarn + "," + CertDaysCrit
+  vars.http_warn_time = ResponseTimeWarn
+  vars.http_critical_time = ResponseTimeCrit
+  assign where ("dav-servers"   in host.groups
+             || "cups-servers"  in host.groups
+             || "smtp-servers"  in host.groups
+             || "ttrss-servers" in host.groups)
+}
+
+// Expect HTTPS 200
+apply Service "https" {
+  import "generic-service"
+  check_command = "http"
+  vars.http_vhost = "$address$"
+  vars.http_expect = "HTTP/1.1 200 OK"
+  vars.http_ssl = true
+  vars.http_certificate = CertDaysWarn + "," + CertDaysCrit
+  vars.http_warn_time = ResponseTimeWarn
+  vars.http_critical_time = ResponseTimeCrit
+  assign where ("invidious-servers" in host.groups
+             || "nfs-servers"       in host.groups
+             || "pkg-servers"       in host.groups
+             || "unifi-controllers" in host.groups
+             || "web-servers"       in host.groups
+             || "xmpp-servers"      in host.groups
+             || "znc-servers"       in host.groups)
+}
diff --git a/files/usr/local/etc/icinga2/conf.d/templates.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/templates.conf.icinga_server
new file mode 100644
index 0000000..1aae5ac
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/templates.conf.icinga_server
@@ -0,0 +1,50 @@
+template Host "generic-host" default {
+  max_check_attempts = 3
+  check_interval = 1m
+  retry_interval = 30s
+  check_command = "hostalive"
+}
+
+template Service "generic-service" default {
+  max_check_attempts = 5
+  check_interval = 1m
+  retry_interval = 30s
+}
+
+template User "generic-user" default {
+
+}
+
+template Notification "mail-host-notification" {
+  command = "mail-host-notification"
+
+  states = [ Up, Down ]
+  types = [ Problem, Acknowledgement, Recovery, Custom,
+            FlappingStart, FlappingEnd,
+            DowntimeStart, DowntimeEnd, DowntimeRemoved ]
+
+  vars += {
+    // notification_icingaweb2url = "https://www.example.com/icingaweb2"
+    // notification_from = "Icinga 2 Host Monitoring <icinga@example.com>"
+    notification_logtosyslog = false
+  }
+
+  period = "24x7"
+}
+
+template Notification "mail-service-notification" {
+  command = "mail-service-notification"
+
+  states = [ OK, Warning, Critical, Unknown ]
+  types = [ Problem, Acknowledgement, Recovery, Custom,
+            FlappingStart, FlappingEnd,
+            DowntimeStart, DowntimeEnd, DowntimeRemoved ]
+
+  vars += {
+    // notification_icingaweb2url = "https://www.example.com/icingaweb2"
+    // notification_from = "Icinga 2 Service Monitoring <icinga@example.com>"
+    notification_logtosyslog = false
+  }
+
+  period = "24x7"
+}
diff --git a/files/usr/local/etc/icinga2/conf.d/timeperiods.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/timeperiods.conf.icinga_server
new file mode 100644
index 0000000..64cd925
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/timeperiods.conf.icinga_server
@@ -0,0 +1,18 @@
+object TimePeriod "24x7" {
+  display_name = "24x7"
+  ranges = {
+    "monday"    = "00:00-24:00"
+    "tuesday"   = "00:00-24:00"
+    "wednesday" = "00:00-24:00"
+    "thursday"  = "00:00-24:00"
+    "friday"    = "00:00-24:00"
+    "saturday"  = "00:00-24:00"
+    "sunday"    = "00:00-24:00"
+  }
+}
+
+object TimePeriod "never" {
+  display_name = "Never"
+  ranges = { }
+}
+
diff --git a/files/usr/local/etc/icinga2/conf.d/users.conf.icinga_server b/files/usr/local/etc/icinga2/conf.d/users.conf.icinga_server
new file mode 100644
index 0000000..1ddaf55
--- /dev/null
+++ b/files/usr/local/etc/icinga2/conf.d/users.conf.icinga_server
@@ -0,0 +1,12 @@
+object User "icingaadmin" {
+  import "generic-user"
+
+  display_name = "Icinga 2 Admin"
+  groups = [ "icingaadmins" ]
+
+  email = "icinga@localhost"
+}
+
+object UserGroup "icingaadmins" {
+  display_name = "Icinga 2 Admin Group"
+}
diff --git a/files/usr/local/etc/icinga2/constants.conf.icinga_server b/files/usr/local/etc/icinga2/constants.conf.icinga_server
new file mode 100644
index 0000000..592da99
--- /dev/null
+++ b/files/usr/local/etc/icinga2/constants.conf.icinga_server
@@ -0,0 +1,14 @@
+const PluginDir = "/usr/local/libexec/nagios"
+const ManubulonPluginDir = "/usr/local/libexec/nagios"
+const PluginContribDir = "/usr/local/libexec/nagios"
+const NodeName = "${BOXCONF_HOSTNAME}"
+const ZoneName = NodeName
+const TicketSalt = "${icinga_ticket_salt}"
+const CertDaysWarn = 30
+const CertDaysCrit = 20
+const ResponseTimeWarn = 0.5
+const ResponseTimeCrit = 1
+const HostsBaseDn = "${hosts_basedn}"
+const IcingaUsername = "${icinga_username}"
+const IcingaPassword = "${icinga_password}"
+const IcingaDN = "${icinga_dn}"
diff --git a/files/usr/local/etc/icinga2/icinga2.conf.icinga_server b/files/usr/local/etc/icinga2/icinga2.conf.icinga_server
new file mode 100644
index 0000000..c97f5fc
--- /dev/null
+++ b/files/usr/local/etc/icinga2/icinga2.conf.icinga_server
@@ -0,0 +1,9 @@
+include "constants.conf"
+include "api-users.conf"
+include "zones.conf"
+include <itl>
+include <plugins>
+include <plugins-contrib>
+include <manubulon>
+include "features-enabled/*.conf"
+include_recursive "conf.d"
diff --git a/files/usr/local/etc/icinga2/zones.conf.icinga_server b/files/usr/local/etc/icinga2/zones.conf.icinga_server
new file mode 100644
index 0000000..59b1fdb
--- /dev/null
+++ b/files/usr/local/etc/icinga2/zones.conf.icinga_server
@@ -0,0 +1,7 @@
+object Endpoint NodeName {
+  host = NodeName
+}
+
+object Zone ZoneName {
+  endpoints = [ NodeName ]
+}
diff --git a/files/usr/local/etc/icingaweb2/modules/icingadb/commandtransports.ini.icinga_server b/files/usr/local/etc/icingaweb2/modules/icingadb/commandtransports.ini.icinga_server
index 990e08a..cf6dea7 100644
--- a/files/usr/local/etc/icingaweb2/modules/icingadb/commandtransports.ini.icinga_server
+++ b/files/usr/local/etc/icingaweb2/modules/icingadb/commandtransports.ini.icinga_server
@@ -1,6 +1,7 @@
 [icinga2]
 skip_validation = "0"
 transport = "api"
+host = "127.0.0.1"
 port = "${icinga_port}"
 username = "${icingaweb_api_username}"
-password = ${icingaweb_api_password}"
+password = "${icingaweb_api_password}"
diff --git a/files/usr/local/etc/icingaweb2/roles.ini.icinga_server b/files/usr/local/etc/icingaweb2/roles.ini.icinga_server
index 6e20e8a..2511267 100644
--- a/files/usr/local/etc/icingaweb2/roles.ini.icinga_server
+++ b/files/usr/local/etc/icingaweb2/roles.ini.icinga_server
@@ -5,6 +5,7 @@ groups = "$(join ',' $icingaweb_admin_groups)"
 EOF
 fi)
 permissions = "*"
+icingadb/denylist/variables = "*priv*,*auth*,*key*,*pass*,*token*"
 
 [Users]
 groups = "${icingaweb_access_role}"
diff --git a/files/usr/local/etc/poudriere.d/idm-pkglist.pkg_repository b/files/usr/local/etc/poudriere.d/idm-pkglist.pkg_repository
index 9504faa..71400a4 100644
--- a/files/usr/local/etc/poudriere.d/idm-pkglist.pkg_repository
+++ b/files/usr/local/etc/poudriere.d/idm-pkglist.pkg_repository
@@ -4,6 +4,7 @@ dns/powerdns
 dns/unbound
 editors/vim@console
 lang/python
+net-mgmt/monitoring-plugins
 net/nss-pam-ldapd-sasl
 net/openldap26-client
 net/openldap26-server
diff --git a/files/usr/local/etc/poudriere.d/make.conf.pkg_repository b/files/usr/local/etc/poudriere.d/make.conf.pkg_repository
index 7e78bbc..1d3a308 100644
--- a/files/usr/local/etc/poudriere.d/make.conf.pkg_repository
+++ b/files/usr/local/etc/poudriere.d/make.conf.pkg_repository
@@ -55,6 +55,8 @@ multimedia_vlc_SET=FLAC MPEG2 X264 X265 VPX DCA FAAD AOM
 multimedia_webcamd_UNSET=DVB INPUT RADIO
 net-im_dino_UNSET=RTP
 net-im_py-matrix-synapse_SET=PGSQL URLPREVIEW LDAP
+net-mgmt_monitoring-plugins_SET=LDAP SSH_PORTABLE PGSQL RADIUS DNS_BINDTOOLS
+net-mgmt_monitoring-plugins_UNSET=DNS_BASE
 net_asterisk18_SET=NEWG711 G729 NCURSES
 net_asterisk18_UNSET=DAHDI FREETDS RADIUS NEWT
 net_freeradius3_SET=LDAP MITKRB_PORT
diff --git a/files/usr/local/etc/poudriere.d/pkglist.pkg_repository b/files/usr/local/etc/poudriere.d/pkglist.pkg_repository
index 2b9587d..1f11a33 100644
--- a/files/usr/local/etc/poudriere.d/pkglist.pkg_repository
+++ b/files/usr/local/etc/poudriere.d/pkglist.pkg_repository
@@ -80,6 +80,7 @@ net-mgmt/icinga2
 net-mgmt/icingadb
 net-mgmt/icingaweb2
 net-mgmt/icingaweb2-module-icingadb
+net-mgmt/monitoring-plugins
 net-mgmt/unifi8
 net/asterisk18
 net/freeradius3
diff --git a/files/usr/local/etc/rc.d/myicinga2.icinga_server b/files/usr/local/etc/rc.d/myicinga2.icinga_server
new file mode 100755
index 0000000..be10192
--- /dev/null
+++ b/files/usr/local/etc/rc.d/myicinga2.icinga_server
@@ -0,0 +1,113 @@
+#!/bin/sh
+
+# PROVIDE: icinga2
+# REQUIRE: LOGIN
+# KEYWORD: shutdown
+
+# Unfortunately, we must duplicate the icinga rc script here in order
+# to provide a mechanism to pass flags to the icinga2 executable.
+
+. /etc/rc.subr
+
+# Add /usr/local/bin to path, so that the notification scripts
+# can work (#!/usr/bin/env bash)
+export PATH=$PATH:/usr/local/bin:/usr/local/sbin
+
+name="icinga2"
+desc="Icinga 2 monitoring (core)"
+rcvar=myicinga2_enable
+
+load_rc_config "${name}"
+
+: ${myicinga2_enable:="NO"}
+: ${icinga2_configfile="/usr/local/etc/${name}/${name}.conf"}
+: ${icinga2_user:="icinga"}
+: ${icinga2_group:="icinga"}
+: ${icinga2_webgroup:="www"}
+: ${icinga2_flags:=""}
+
+
+command="/usr/local/sbin/${name}"
+procname="/usr/local/lib/icinga2/sbin/icinga2"
+extra_commands="reload checkconfig configtest"
+
+icinga2_cachedir="/var/cache/${name}"
+icinga2_libdir="/var/lib/${name}"
+icinga2_logdir="/var/log/icinga2"
+icinga2_rundir="/var/run/${name}"
+icinga2_spooldir="/var/spool/${name}"
+
+pidfile="${icinga2_rundir}/${name}.pid"
+icinga2_logfile="${icinga2_logdir}/${name}.log"
+icinga2_errorlogfile="${icinga2_logdir}/error.log"
+
+start_cmd="start_cmd"
+start_precmd="start_precmd"
+restart_precmd="icinga2_checkconfig"
+reload_precmd="reload_precmd"
+checkconfig_cmd="icinga2_checkconfig verbose"
+configtest_cmd="${checkconfig_cmd}"
+sig_reload=HUP
+
+required_files="${icinga2_configfile}"
+command_args="daemon -d -e ${icinga2_errorlogfile} -c ${icinga2_configfile} ${icinga2_flags}"
+
+icinga2_checkconfig() {
+  echo -n "Performing sanity check of icinga2 configuration: "
+
+  if [ "$1" != "verbose" ]; then
+    quietredir="2>&1 >/dev/null"
+  fi
+
+  ${command} daemon -c ${icinga2_configfile} -C
+
+  if [ $? -ne 0 ]; then
+    echo "FAILED"
+    return 1
+  else
+    echo "OK"
+  fi
+}
+
+reload_precmd() {
+  if ! icinga2_checkconfig; then
+    return 1
+  fi
+}
+
+start_precmd() {
+  # Create necessary directories / change ownership
+  # While this is also done through pkg-plist, /var might be on a ramdisk,
+  # so make sure all needed files and directories are created before starting
+  # Icinga.
+  for d in "${icinga2_logdir}" "${icinga2_logdir}/compat" \
+           "${icinga2_logdir}/compat/archives" "${icinga2_libdir}" \
+           "${icinga2_spooldir}" "${icinga2_spooldir}/tmp" \
+           "${icinga2_rundir}" "${icinga2_cachedir}"; do
+      if [ ! -d "${d}" ]; then
+        install -d -o ${icinga2_user} -g ${icinga2_group} "${d}"
+      fi
+  done
+
+  install -d -o ${icinga2_user} -g ${icinga2_webgroup} -m 2750 "${icinga2_rundir}/cmd"
+
+  chown -R ${icinga2_user}:${icinga2_group} "${icinga2_libdir}"
+  chown -R ${icinga2_user}:${icinga2_group} "${icinga2_spooldir}"
+  chown -R ${icinga2_user}:${icinga2_group} "${icinga2_cachedir}"
+  chown -R ${icinga2_user}:${icinga2_webgroup} "${icinga2_rundir}/cmd"
+
+
+  if ! icinga2_checkconfig; then
+    return 1
+  fi
+
+  if [ ! -f "${icinga2_logfile}" ]; then
+    install -o "${icinga2_user}" -g "${icinga2_group}" -m 644 /dev/null "${icinga2_logfile}"
+  fi
+}
+
+start_cmd() {
+  ${command} ${command_args}
+}
+
+run_rc_command "$1"
diff --git a/files/usr/share/skel/dot.shrc.freebsd b/files/usr/share/skel/dot.shrc.freebsd
index bc8e8da..a5147c7 100644
--- a/files/usr/share/skel/dot.shrc.freebsd
+++ b/files/usr/share/skel/dot.shrc.freebsd
@@ -4,6 +4,12 @@ green=$'\e[0;32m'
 PS1="\[${green}\]\u@\h\[${reset}\]:\[${blue}\]\W\[${green}\]\$\[${reset}\] "
 unset reset blue green
 
+export CLICOLOR=1
+export PAGER=less
+export LESS='-iMRS -x2'
+export EDITOR=vim
+export LSCOLORS=DxfxgxgxcxxbxbaCacADAd
+
 alias ls='ls -FHh'
 alias ll='ls -l'
 alias la='ls -la'
diff --git a/hostclasses b/hostclasses
index 92c1d38..5115b03 100644
--- a/hostclasses
+++ b/hostclasses
@@ -24,5 +24,4 @@ authoritative_nameserver ^ns[0-9]
 asterisk_server          ^pbx[0-9]
 nfs_server               ^nfs[0-9]
 turn_server              ^turn[0-9]
-syncthing_server         ^syncthing[0-9]
 icinga_server            ^icinga[0-9]
diff --git a/lib/60-postgres b/lib/60-postgres
index af37c27..6f418ea 100644
--- a/lib/60-postgres
+++ b/lib/60-postgres
@@ -17,8 +17,8 @@ EOF
 }
 
 postgres_create_database(){
-  # $1 = postgres_host, $2 = dbname, $3 = owner
+  # $1 = postgres_host, $2 = dbname, $3 = owner $4 = encoding, $5 = locale
   cat <<EOF | postgres_run -h "${1}" -d postgres
-SELECT 'CREATE DATABASE "${2}" OWNER "${3:-postgres}"' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${2}')\\gexec
+SELECT 'CREATE DATABASE "${2}" ENCODING "${4:-UTF8}" LOCALE "${5:-en_US.UTF-8}" OWNER "${3:-postgres}" TEMPLATE "template0"' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${2}')\\gexec
 EOF
 }
diff --git a/scripts/hostclass/desktop b/scripts/hostclass/desktop
index ac8bdda..bddce05 100644
--- a/scripts/hostclass/desktop
+++ b/scripts/hostclass/desktop
@@ -168,66 +168,6 @@ esac
 # acceleration after resuming from sleep.
 set_sysctl kern.vt.suspendswitch="${vt_suspendswitch:-1}"
 
-# Fix xterm-256color termcap
-# https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280679
-cat <<'EOF' | tic -o /usr/local/share/site-terminfo -
-xterm-256color|xterm with 256 colors,
-        am, bce, ccc, km, mc5i, mir, msgr, npc, xenl,
-        colors#0x100, cols#80, it#8, lines#24, pairs#0x10000,
-        acsc=``aaffggiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~,
-        bel=^G, blink=\E[5m, bold=\E[1m, cbt=\E[Z, civis=\E[?25l,
-        clear=\E[H\E[2J, cnorm=\E[?12l\E[?25h, cr=\r,
-        csr=\E[%i%p1%d;%p2%dr, cub=\E[%p1%dD, cub1=^H,
-        cud=\E[%p1%dB, cud1=\n, cuf=\E[%p1%dC, cuf1=\E[C,
-        cup=\E[%i%p1%d;%p2%dH, cuu=\E[%p1%dA, cuu1=\E[A,
-        cvvis=\E[?12;25h, dch=\E[%p1%dP, dch1=\E[P, dim=\E[2m,
-        dl=\E[%p1%dM, dl1=\E[M, ech=\E[%p1%dX, ed=\E[J, el=\E[K,
-        el1=\E[1K, flash=\E[?5h$<100/>\E[?5l, home=\E[H,
-        hpa=\E[%i%p1%dG, ht=^I, hts=\EH, ich=\E[%p1%d@,
-        il=\E[%p1%dL, il1=\E[L, ind=\n, indn=\E[%p1%dS,
-        initc=\E]4;%p1%d;rgb:%p2%{255}%*%{1000}%/%2.2X/%p3%{255}%*%{1000}%/%2.2X/%p4%{255}%*%{1000}%/%2.2X\E\\,
-        invis=\E[8m, is2=\E[!p\E[?3;4l\E[4l\E>, kDC=\E[3;2~,
-        kEND=\E[1;2F, kHOM=\E[1;2H, kIC=\E[2;2~, kLFT=\E[1;2D,
-        kNXT=\E[6;2~, kPRV=\E[5;2~, kRIT=\E[1;2C, ka1=\EOw,
-        ka3=\EOy, kb2=\EOu, kbs=^?, kc1=\EOq, kc3=\EOs, kcbt=\E[Z,
-        kcub1=\EOD, kcud1=\EOB, kcuf1=\EOC, kcuu1=\EOA,
-        kdch1=\E[3~, kend=\EOF, kent=\EOM, kf1=\EOP, kf10=\E[21~,
-        kf11=\E[23~, kf12=\E[24~, kf13=\E[1;2P, kf14=\E[1;2Q,
-        kf15=\E[1;2R, kf16=\E[1;2S, kf17=\E[15;2~, kf18=\E[17;2~,
-        kf19=\E[18;2~, kf2=\EOQ, kf20=\E[19;2~, kf21=\E[20;2~,
-        kf22=\E[21;2~, kf23=\E[23;2~, kf24=\E[24;2~,
-        kf25=\E[1;5P, kf26=\E[1;5Q, kf27=\E[1;5R, kf28=\E[1;5S,
-        kf29=\E[15;5~, kf3=\EOR, kf30=\E[17;5~, kf31=\E[18;5~,
-        kf32=\E[19;5~, kf33=\E[20;5~, kf34=\E[21;5~,
-        kf35=\E[23;5~, kf36=\E[24;5~, kf37=\E[1;6P, kf38=\E[1;6Q,
-        kf39=\E[1;6R, kf4=\EOS, kf40=\E[1;6S, kf41=\E[15;6~,
-        kf42=\E[17;6~, kf43=\E[18;6~, kf44=\E[19;6~,
-        kf45=\E[20;6~, kf46=\E[21;6~, kf47=\E[23;6~,
-        kf48=\E[24;6~, kf49=\E[1;3P, kf5=\E[15~, kf50=\E[1;3Q,
-        kf51=\E[1;3R, kf52=\E[1;3S, kf53=\E[15;3~, kf54=\E[17;3~,
-        kf55=\E[18;3~, kf56=\E[19;3~, kf57=\E[20;3~,
-        kf58=\E[21;3~, kf59=\E[23;3~, kf6=\E[17~, kf60=\E[24;3~,
-        kf61=\E[1;4P, kf62=\E[1;4Q, kf63=\E[1;4R, kf7=\E[18~,
-        kf8=\E[19~, kf9=\E[20~, khome=\EOH, kich1=\E[2~,
-        kind=\E[1;2B, kmous=\E[<, knp=\E[6~, kpp=\E[5~,
-        kri=\E[1;2A, mc0=\E[i, mc4=\E[4i, mc5=\E[5i, meml=\El,
-        memu=\Em, mgc=\E[?69l, nel=\EE, oc=\E]104\007,
-        op=\E[39;49m, rc=\E8, rep=%p1%c\E[%p2%{1}%-%db,
-        rev=\E[7m, ri=\EM, rin=\E[%p1%dT, ritm=\E[23m, rmacs=\E(B,
-        rmam=\E[?7l, rmcup=\E[?1049l\E[23;0;0t, rmir=\E[4l,
-        rmkx=\E[?1l\E>, rmm=\E[?1034l, rmso=\E[27m, rmul=\E[24m,
-        rs1=\Ec\E]104\007, rs2=\E[!p\E[?3;4l\E[4l\E>, sc=\E7,
-        setab=\E[%?%p1%{8}%<%t4%p1%d%e%p1%{16}%<%t10%p1%{8}%-%d%e48;5;%p1%d%;m,
-        setaf=\E[%?%p1%{8}%<%t3%p1%d%e%p1%{16}%<%t9%p1%{8}%-%d%e38;5;%p1%d%;m,
-        sgr=%?%p9%t\E(0%e\E(B%;\E[0%?%p6%t;1%;%?%p5%t;2%;%?%p2%t;4%;%?%p1%p3%|%t;7%;%?%p4%t;5%;%?%p7%t;8%;m,
-        sgr0=\E(B\E[m, sitm=\E[3m, smacs=\E(0, smam=\E[?7h,
-        smcup=\E[?1049h\E[22;0;0t,
-        smglr=\E[?69h\E[%i%p1%d;%p2%ds, smir=\E[4h,
-        smkx=\E[?1h\E=, smm=\E[?1034h, smso=\E[7m, smul=\E[4m,
-        tbc=\E[3g, u6=\E[%i%d;%dR, u7=\E[6n,
-        u8=\E[?%[;0123456789]c, u9=\E[c, vpa=\E[%i%p1%dd,
-EOF
-
 # Start login manager.
 case $desktop_type in
   kde)
diff --git a/scripts/hostclass/icinga_server b/scripts/hostclass/icinga_server
index ccd1d46..75ef7b8 100644
--- a/scripts/hostclass/icinga_server
+++ b/scripts/hostclass/icinga_server
@@ -1,9 +1,10 @@
 #!/bin/sh
 
-: ${icinga_username:='s-icinga'}
+: ${icinga_threads:="$nproc"}
 : ${icinga_dbname:='icinga'}
 : ${icinga_dbhost:="$postgres_host"}
 : ${icinga_password:='changeme'}
+: ${icinga_ticket_salt:='changeme'}
 : ${icingaweb_api_password:='changeme'}
 : ${icingaweb_dbhost:="$postgres_host"}
 : ${icingaweb_dbname:='icingaweb'}
@@ -118,10 +119,10 @@ install_directory -m 0700 -o "$icinga_local_user" -g "$icinga_local_user" \
   "$icinga_ca_dir"
 [ -f "${icinga_ca_dir}/ca.crt" ] \
   || icinga2 pki new-ca
-[ -f "${icinga_cert_dir}/${fqdn}.csr" ] \
-  || icinga2 pki new-cert --cn "$fqdn" --key "${icinga_cert_dir}/${fqdn}.key" --csr "${icinga_cert_dir}/${fqdn}.csr"
-[ -f "${icinga_cert_dir}/${fqdn}.crt" ] \
-  || icinga2 pki sign-csr --csr "${icinga_cert_dir}/${fqdn}.csr" --cert "${icinga_cert_dir}/${fqdn}.crt"
+[ -f "${icinga_cert_dir}/${BOXCONF_HOSTNAME}.csr" ] \
+  || icinga2 pki new-cert --cn "$BOXCONF_HOSTNAME" --key "${icinga_cert_dir}/${BOXCONF_HOSTNAME}.key" --csr "${icinga_cert_dir}/${BOXCONF_HOSTNAME}.csr"
+[ -f "${icinga_cert_dir}/${BOXCONF_HOSTNAME}.crt" ] \
+  || icinga2 pki sign-csr --csr "${icinga_cert_dir}/${BOXCONF_HOSTNAME}.csr" --cert "${icinga_cert_dir}/${BOXCONF_HOSTNAME}.crt"
 ln -snfv "${icinga_ca_dir}/ca.crt" "${icinga_cert_dir}/ca.crt"
 
 # Enable icinga modules.
@@ -132,7 +133,21 @@ done
 # Generate icinga configuration.
 install_template -m 0640 -g "$icinga_local_user" \
   "${icinga_conf_dir}/api-users.conf" \
-  "${icinga_conf_dir}/features-available/icingadb.conf"
+  "${icinga_conf_dir}/constants.conf" \
+  "${icinga_conf_dir}/icinga2.conf" \
+  "${icinga_conf_dir}/zones.conf" \
+  "${icinga_conf_dir}/features-available/icingadb.conf" \
+  "${icinga_conf_dir}/conf.d/users.conf" \
+  "${icinga_conf_dir}/conf.d/hosts.conf"
+install_file -m 0640 -g "$icinga_local_user" \
+  "${icinga_conf_dir}/conf.d/app.conf" \
+  "${icinga_conf_dir}/conf.d/commands.conf" \
+  "${icinga_conf_dir}/conf.d/downtimes.conf" \
+  "${icinga_conf_dir}/conf.d/groups.conf" \
+  "${icinga_conf_dir}/conf.d/notifications.conf" \
+  "${icinga_conf_dir}/conf.d/services.conf" \
+  "${icinga_conf_dir}/conf.d/templates.conf" \
+  "${icinga_conf_dir}/conf.d/timeperiods.conf"
 
 # Create icingaweb postgres user and database.
 postgres_create_database "$icingaweb_dbhost" "$icingaweb_dbname" "$icinga_username"
@@ -143,6 +158,7 @@ if ! icingaweb_psql -c 'SELECT 1 FROM icingaweb_schema'; then
 fi
 
 # Generate icingaweb configuration.
+find "$icinga_conf_dir" -name '*.sample' -delete
 install_directory -m 2770 -g "$nginx_user" \
   "$icingaweb_conf_dir" \
   "${icingaweb_conf_dir}/enabledModules" \
@@ -183,18 +199,31 @@ install_template -m 0644 \
 install_certificate     nginx "$icingaweb_https_cert"
 install_certificate_key nginx "$icingaweb_https_key"
 
+# Icinga spawns a number of threads based on the core count of the machine. On machines
+# with a large number of CPU cores, this can be undesirable (especially if run from a jail
+# with cpuset()).
+#
+# The thread count can be overriden with the -DConcurrency=N argument to icinga2.
+# Unfortunately, icinga2 rc script from ports does not have a way to override the
+# daemon arguments. So we have to copy over a custom one ("myicinga2").
+#
+# https://icinga.com/docs/icinga-2/latest/doc/15-troubleshooting/#try-reducing-concurrency-threads
+install_file -m 0555 /usr/local/etc/rc.d/myicinga2
+
 # Enable and start daemons.
 sysrc -v \
   nginx_enable=YES \
   php_fpm_enable=YES \
   redis_enable=YES \
   icingadb_enable=YES \
-  icinga2_enable=YES
+  myicinga2_enable=YES \
+  icinga2_flags="-DConfiguration.Concurrency=${icinga_threads}"
 service nginx restart
 service php_fpm restart
+
 service redis restart
-service icingadb restart > /dev/null 2>&1 < /dev/null || die 'failed to start icingadb'
-service icinga2 restart
+service icingadb restart > /dev/null 2>&1
+service myicinga2 restart
 
 # Create access role.
 ldap_add "cn=${icingaweb_access_role},${roles_basedn}" <<EOF
diff --git a/scripts/hostclass/postgresql_server b/scripts/hostclass/postgresql_server
index cbd9c17..b3e8804 100644
--- a/scripts/hostclass/postgresql_server
+++ b/scripts/hostclass/postgresql_server
@@ -104,3 +104,8 @@ END
 
 # Load citext extension (required by icingadb)
 postgres_psql -c 'create extension if not exists citext;'
+
+# Create icinga user.
+postgres_psql <<EOF
+SELECT 'CREATE ROLE "${icinga_username}" WITH LOGIN' WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${icinga_username}')\\gexec
+EOF
diff --git a/scripts/os/freebsd/20-termcap b/scripts/os/freebsd/20-termcap
new file mode 100644
index 0000000..ea5a1b5
--- /dev/null
+++ b/scripts/os/freebsd/20-termcap
@@ -0,0 +1,61 @@
+#!/bin/sh
+
+# Fix xterm-256color termcap
+# https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280679
+cat <<'EOF' | tic -o /usr/local/share/site-terminfo -
+xterm-256color|xterm with 256 colors,
+        am, bce, ccc, km, mc5i, mir, msgr, npc, xenl,
+        colors#0x100, cols#80, it#8, lines#24, pairs#0x10000,
+        acsc=``aaffggiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz{{||}}~~,
+        bel=^G, blink=\E[5m, bold=\E[1m, cbt=\E[Z, civis=\E[?25l,
+        clear=\E[H\E[2J, cnorm=\E[?12l\E[?25h, cr=\r,
+        csr=\E[%i%p1%d;%p2%dr, cub=\E[%p1%dD, cub1=^H,
+        cud=\E[%p1%dB, cud1=\n, cuf=\E[%p1%dC, cuf1=\E[C,
+        cup=\E[%i%p1%d;%p2%dH, cuu=\E[%p1%dA, cuu1=\E[A,
+        cvvis=\E[?12;25h, dch=\E[%p1%dP, dch1=\E[P, dim=\E[2m,
+        dl=\E[%p1%dM, dl1=\E[M, ech=\E[%p1%dX, ed=\E[J, el=\E[K,
+        el1=\E[1K, flash=\E[?5h$<100/>\E[?5l, home=\E[H,
+        hpa=\E[%i%p1%dG, ht=^I, hts=\EH, ich=\E[%p1%d@,
+        il=\E[%p1%dL, il1=\E[L, ind=\n, indn=\E[%p1%dS,
+        initc=\E]4;%p1%d;rgb:%p2%{255}%*%{1000}%/%2.2X/%p3%{255}%*%{1000}%/%2.2X/%p4%{255}%*%{1000}%/%2.2X\E\\,
+        invis=\E[8m, is2=\E[!p\E[?3;4l\E[4l\E>, kDC=\E[3;2~,
+        kEND=\E[1;2F, kHOM=\E[1;2H, kIC=\E[2;2~, kLFT=\E[1;2D,
+        kNXT=\E[6;2~, kPRV=\E[5;2~, kRIT=\E[1;2C, ka1=\EOw,
+        ka3=\EOy, kb2=\EOu, kbs=^?, kc1=\EOq, kc3=\EOs, kcbt=\E[Z,
+        kcub1=\EOD, kcud1=\EOB, kcuf1=\EOC, kcuu1=\EOA,
+        kdch1=\E[3~, kend=\EOF, kent=\EOM, kf1=\EOP, kf10=\E[21~,
+        kf11=\E[23~, kf12=\E[24~, kf13=\E[1;2P, kf14=\E[1;2Q,
+        kf15=\E[1;2R, kf16=\E[1;2S, kf17=\E[15;2~, kf18=\E[17;2~,
+        kf19=\E[18;2~, kf2=\EOQ, kf20=\E[19;2~, kf21=\E[20;2~,
+        kf22=\E[21;2~, kf23=\E[23;2~, kf24=\E[24;2~,
+        kf25=\E[1;5P, kf26=\E[1;5Q, kf27=\E[1;5R, kf28=\E[1;5S,
+        kf29=\E[15;5~, kf3=\EOR, kf30=\E[17;5~, kf31=\E[18;5~,
+        kf32=\E[19;5~, kf33=\E[20;5~, kf34=\E[21;5~,
+        kf35=\E[23;5~, kf36=\E[24;5~, kf37=\E[1;6P, kf38=\E[1;6Q,
+        kf39=\E[1;6R, kf4=\EOS, kf40=\E[1;6S, kf41=\E[15;6~,
+        kf42=\E[17;6~, kf43=\E[18;6~, kf44=\E[19;6~,
+        kf45=\E[20;6~, kf46=\E[21;6~, kf47=\E[23;6~,
+        kf48=\E[24;6~, kf49=\E[1;3P, kf5=\E[15~, kf50=\E[1;3Q,
+        kf51=\E[1;3R, kf52=\E[1;3S, kf53=\E[15;3~, kf54=\E[17;3~,
+        kf55=\E[18;3~, kf56=\E[19;3~, kf57=\E[20;3~,
+        kf58=\E[21;3~, kf59=\E[23;3~, kf6=\E[17~, kf60=\E[24;3~,
+        kf61=\E[1;4P, kf62=\E[1;4Q, kf63=\E[1;4R, kf7=\E[18~,
+        kf8=\E[19~, kf9=\E[20~, khome=\EOH, kich1=\E[2~,
+        kind=\E[1;2B, kmous=\E[<, knp=\E[6~, kpp=\E[5~,
+        kri=\E[1;2A, mc0=\E[i, mc4=\E[4i, mc5=\E[5i, meml=\El,
+        memu=\Em, mgc=\E[?69l, nel=\EE, oc=\E]104\007,
+        op=\E[39;49m, rc=\E8, rep=%p1%c\E[%p2%{1}%-%db,
+        rev=\E[7m, ri=\EM, rin=\E[%p1%dT, ritm=\E[23m, rmacs=\E(B,
+        rmam=\E[?7l, rmcup=\E[?1049l\E[23;0;0t, rmir=\E[4l,
+        rmkx=\E[?1l\E>, rmm=\E[?1034l, rmso=\E[27m, rmul=\E[24m,
+        rs1=\Ec\E]104\007, rs2=\E[!p\E[?3;4l\E[4l\E>, sc=\E7,
+        setab=\E[%?%p1%{8}%<%t4%p1%d%e%p1%{16}%<%t10%p1%{8}%-%d%e48;5;%p1%d%;m,
+        setaf=\E[%?%p1%{8}%<%t3%p1%d%e%p1%{16}%<%t9%p1%{8}%-%d%e38;5;%p1%d%;m,
+        sgr=%?%p9%t\E(0%e\E(B%;\E[0%?%p6%t;1%;%?%p5%t;2%;%?%p2%t;4%;%?%p1%p3%|%t;7%;%?%p4%t;5%;%?%p7%t;8%;m,
+        sgr0=\E(B\E[m, sitm=\E[3m, smacs=\E(0, smam=\E[?7h,
+        smcup=\E[?1049h\E[22;0;0t,
+        smglr=\E[?69h\E[%i%p1%d;%p2%ds, smir=\E[4h,
+        smkx=\E[?1h\E=, smm=\E[?1034h, smso=\E[7m, smul=\E[4m,
+        tbc=\E[3g, u6=\E[%i%d;%dR, u7=\E[6n,
+        u8=\E[?%[;0123456789]c, u9=\E[c, vpa=\E[%i%p1%dd,
+EOF
diff --git a/scripts/os/freebsd/42-icinga b/scripts/os/freebsd/42-icinga
new file mode 100644
index 0000000..872c1c6
--- /dev/null
+++ b/scripts/os/freebsd/42-icinga
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+pkg install -y monitoring-plugins
diff --git a/vars/common b/vars/common
index 8e9fab0..0dc1a6b 100644
--- a/vars/common
+++ b/vars/common
@@ -45,6 +45,7 @@ host_keytab_groupname=hostkeytab
 host_keytab_gid=788
 lmtp_port=25
 quota_status_port=10993
+icinga_username='s-icinga'
 krb5_ticket_lifetime=24h
 krb5_renew_lifetime=7d
 nslcd_min_uid=1000