Skip to content

Version v3.4.0

Choose a tag to compare

View all tags
@deexno deexno released this 12 May 14:24
· 12 commits to main since this release
v3.4.0
322ad10

Changes since last release

Architecture

  • Introduced split architecture:
    • Minimal Checkmk notification adapter inside the Checkmk site.
    • Main Telegram application runs outside Checkmk under /opt/checkmk-telegram-plus.
    • Dedicated Python virtual environment under /opt/checkmk-telegram-plus/venv.
    • Runtime config/state/logs moved to /etc, /var/lib, /var/log and /run.
  • Removed the need to install large third-party Python dependencies into the Checkmk Python environment.
  • Added local Unix socket based communication between Checkmk and the external app.
  • Added a slim Checkmk bridge service running as the Checkmk site user for Livestatus, cmk --check, graph rendering and selected OMD/Checkmk actions.

Installer and migration

  • Reworked installer for new split architecture.
  • Existing installations are detected and migrated automatically.
  • Existing configs are backed up before modification.
  • Legacy site-local app files are moved into legacy/backup locations instead of being deleted.
  • Installer creates and updates:
    • external app directory
    • Python venv
    • config directory
    • state directory
    • log directory
    • runtime socket directory
    • systemd services
  • Installer now reviews existing config interactively.
  • Existing values are preserved when pressing Enter.
  • Secrets are not printed in clear text.
  • Required values like Telegram token and bot password are validated during install/update.
  • Optional Checkmk Web graph settings can be configured during installation.
  • Installer repairs permissions for notification fallback queues.

Systemd services

  • Added external app service:
    • checkmk-telegram-plus-<site>.service
  • Added Checkmk bridge service:
    • checkmk-telegram-plus-bridge-<site>.service
  • Services use safer permissions and dedicated users.
  • Runtime directory /run/checkmk-telegram-plus uses group-based access and setgid permissions.
  • Fixed service start issues caused by unprivileged chown in ExecStartPre.

Notifications

  • Added minimal stdlib-only Checkmk notification adapter.
  • Adapter collects bounded NOTIFY_* environment variables.
  • Adapter sends notifications to the external app over a Unix domain socket.
  • Added fallback queue if the external app/socket is temporarily unavailable.
  • Fixed fallback queue permission issue:
    • Checkmk site user can write fallback notifications.
    • External app can drain fallback notifications.
    • Fallback directory uses 2770.
    • Fallback queue file uses 660.
  • Prevented notification loss during service restarts or temporary app outages.

Telegram bot behavior

  • Existing Telegram commands and workflows are preserved.
  • Existing menus, buttons, authentication and admin functions remain compatible.
  • Checkmk operations are routed through the bridge instead of direct Checkmk imports in the external app.
  • Admin-sensitive functions remain protected by existing admin user checks.
  • Improved error reporting for Checkmk bridge calls.

Checkmk bridge

  • Added typed allowlist bridge operations instead of exposing arbitrary shell or Livestatus access.
  • Bridge supports:
    • host groups
    • hosts
    • services
    • host status
    • service details
    • service problems
    • host problems
    • cmk --check
    • selected OMD actions
    • acknowledgements
    • graph rendering
  • Increased bridge client timeout for slow cmk --check runs.
  • Removed direct Checkmk-internal imports from the external app.

Graph rendering

  • Added version-tolerant graph rendering flow:
    • legacy internal Checkmk renderer if available
    • ajax_graph_images.py notification graph endpoint
    • graph_image.py fallback endpoint
  • Added support for Checkmk versions where render_cmk_graphs no longer exists.
  • Added Checkmk Web graph export config:
    • base_url
    • automation_user
    • automation_secret
    • graph_count
    • allow_legacy_url_auth
  • Uses HTTP auth headers instead of URL credentials by default.
  • Added optional legacy URL auth for older Checkmk installations.
  • Added loopback HTTPS handling:
    • local HTTP is recommended
    • loopback HTTPS certificate mismatch can fall back safely
    • relaxed TLS fallback is restricted to loopback hosts only
  • Documented required Checkmk role permissions for graph export:
    • host/service visibility via contact groups or See all hosts and services
    • Query metric backend from custom graph editor
  • Clarified that graph collection permissions alone are not sufficient.

Dependency fixes

  • Pinned httpx<0.28 to keep compatibility with the current OpenAI dependency.
  • External dependencies are installed only into the external venv.
  • Checkmk Python environment is no longer polluted by Telegram/OpenAI/Web dependencies.

Security hardening

  • Checkmk notification adapter uses only Python stdlib.
  • No shell execution in the notification adapter.
  • No untrusted shell commands with notification data.
  • Unix sockets are local only.
  • Socket communication uses timeouts.
  • Fallback files are created with controlled permissions.
  • Secrets are not printed during installer config review.
  • Graph export avoids putting credentials into URLs by default.
  • Checkmk bridge exposes typed operations only, not arbitrary command execution.

Documentation

  • Updated README for split architecture.
  • Added architecture documentation.
  • Documented new install paths and service layout.
  • Documented Checkmk Web graph export setup.
  • Documented required automation user permissions.
  • Documented fallback queue permissions and upgrade behavior.
  • Updated troubleshooting guidance for token/config handling.

Tests

  • Added/updated tests for:
    • Checkmk notification payload parsing
    • notification socket handoff
    • fallback queue draining
    • static security checks
    • external dependency isolation
    • bridge timeout behavior
    • graph fallback support
    • installer config review behavior
    • fallback permission handling

Upgrade notes

  • Existing configs are backed up automatically.
  • Existing users can upgrade by rerunning the installer.
  • After upgrade, restart the services.
  • If Checkmk notification permissions still use old process group memberships, restart the Checkmk site: 
    omd restart <site>
Assets 3
Loading