* ci: lock spelling dependencies and disable checkout credentials
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: install spelling dependencies from wheels only
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: quote the spelling install command and add target branch
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Cacti automatically uses the Net-SNMP binaries where php-snmp cannot be
used (SNMPv3 with advanced ciphers, IPv6, bulkwalk, hex output), so users
no longer need to uninstall php-snmp. Reword the SNMP Version 3 note in
Devices.md, soften the optional snmp module note in Requirements.md, and
drop the php-snmp caveat from the SNMP Timeout field in
How-to-Graph-Your-Network.md.
Co-authored-by: TheWitness <copilot@users.noreply.github.com>
* docs(auth): document LDAP OTP/MFA single-bind behavior and configuration
Adds a One-Time Passwords (OTP / MFA) note to the LDAP authentication page
explaining that Cacti binds the user's password only once, that the DN
lookup never uses the user's password, and that OTP/MFA deployments should
use Specific Searching with a service account and a single server.
* docs(auth): recommend resilient DNS load balancer for LDAP OTP; qualify single-bind for failover; clarify No Searching
* docs: comprehensive audit, Spine poller overhaul, and technical refactor
- Overhaul Spine documentation (Spine.md) with complete end-to-end guide: architecture, prerequisites for modern distros (EL8/9 CRB, Ubuntu 22/24, Debian 11/12, FreeBSD), SUID root permissions, secure spine.conf setup (0640), Web UI configuration (Paths, Poller type, Data Collectors tuning), MySQL max_connections sizing, and troubleshooting.
- Fix broken links and anchors (Hardening, SNMP data queries, Hook API references).
- Fix broken image reference in Sites.md (add-site.JPG -> add-site.png).
- Fix syntax errors in documentation PHP code blocks, including invalid parenthesization, missing SQL execute quotes, and malformed comments in FAQ.
- Fix DevOps installation commands: use config.php.dist, correct systemctl service names for MySQL/MariaDB/PHP-FPM, remove nonexistent php-json, add missing composer install, and correct Debian/Ubuntu systemd environment path.
- Correct grammatical errors, repeated words, and typos across all markdown documents.
- Remove obsolete unreferenced duplicate installation guides.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: correct reviewed examples and guidance
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: correct guidance that disagrees with the Cacti source
Verified each claim against include/global_arrays.php, lib/auth.php,
lib/functions.php, host_templates.php and the Spine config parser. The
notable ones: api_plugin_safe_exec() does not exist on either branch,
Spine reads DB_Pass rather than DB_Password, and the CDEF special data
source table was missing five entries and renamed four others.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: wrap Spine prose and fence the connection sizing formula
The formula's bare asterisks rendered as emphasis, dropping the multiplication signs.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* chore: refresh copyright year in scripts and issue templates
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix harmful FAQ password reset and removed PHP/MySQL features
Refs #213
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(faq): fix password-reset procedure
The prior text pointed at cli/change_password.php, which does not exist in
Cacti, and warned that an SQL MD5 update locks the account. Neither is true:
compat_password_verify() has an MD5 fallback and re-hashes to bcrypt on the
next login, so the SQL reset works. Restore the working SQL method.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: prefer SHA2 for emergency password resets
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: force password change after admin reset
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: use the mariadb client in the password reset example
- Note that the mysql client takes the same arguments.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: add hardware sizing section and remove stale MySQL variables
Refs #215
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: correct the MariaDB version notes on InnoDB settings
innodb_buffer_pool_instances is gone from MariaDB 10.6, which is the stated minimum.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: note the MySQL 8.4 innodb_io_capacity default
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* add architecture decision records
* docs: keep Development Standards description with its list item
Item 8 was inserted between item 7's link and its description paragraph, which
re-parents that paragraph onto Architecture Decisions. Move item 8 below the
Development Standards description.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: describe the Architecture Decisions index entry
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: add Hardening-Cacti-Installation guide
* docs: add Hardening-Cacti-Installation to Cacti Installation nav
* docs: cross-reference hardening guide from Standards-Security
* docs(hardening): correct harmful PHP/permission/AppArmor guidance
The disable_functions list blocked exec/shell_exec/proc_open/popen/system,
which the web tier uses for RRDtool, fping and spikekill, so graphs stopped
rendering; restrict it to passthru and pcntl_exec. The recursive chmod 755
left config.php DB credentials world-readable; lock it to 640 root:www-data.
Cite the real package-import advisory (GHSA-7cmj-g5qc-pj88, CVE-2024-25641),
add execute rules for helper binaries to the AppArmor profile, and stop
forcing the spine daemon into httpd_t.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(hardening): fix .htaccess DirectoryMatch guidance and footer order
DirectoryMatch is invalid in .htaccess context; scope that example to
vhost config and add an .htaccess-compatible FilesMatch alternative.
Also move Standards-Security.md's See Also section above the copyright
footer instead of after it, and add the missing footer to the new
hardening guide.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: update SSL config with ECDSA keys, TLS 1.2+, Let's Encrypt
Refs #220
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(ssl): fix RHEL certbot install and note Debian cert paths
certbot ships only in EPEL on RHEL/Rocky/AlmaLinux, so the dnf install fails
on a stock host without epel-release first. The self-signed commands use the
RHEL /etc/pki paths while the Apache block references Debian /etc/ssl paths;
add a note so Debian/Ubuntu users write the cert where Apache expects it.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix typos and remove stale 0.8.6h content
Refs #219
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: restore firm GPL2.0+ contribution acknowledgment
The prior edit softened the licensing statement into hedged wording. Restore
the original clear acknowledgment that Weblate contributions are GPL2.0+.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: recommend InnoDB over MEMORY engine for Boost tables
Refs #106
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(boost): correct default engine for boost tables
poller_output_boost ships as InnoDB, not MEMORY. The prior wording claimed
Cacti installs MEMORY tables by default and pointed readers to conversion
steps that convert to MEMORY, contradicting the InnoDB recommendation.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix broken SQL syntax, wrong Spine build deps, wrong cron user
Refs #211
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: align remote poller password example and drop em dash
The config.php example still set $rdatabase_password to 'cacti' while the SQL
and spine.conf examples used 'strongpassword', contradicting the guide's own
advice against the literal 'cacti'. Replace the em dash in Spine.md with a period.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
* docs: fix SELinux policy guidance and add CentOS EOL notices
Refs #209
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: scope the AppArmor section to actually-confined Apache
Ubuntu and Debian enable AppArmor but ship no Apache profile by default, so
Apache runs unconfined and the reload commands error out on a stock system.
Gate the section on an Apache profile being present before applying overrides.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
* docs: update stale PHP/MySQL/MariaDB version requirements
- Requirements.md: PHP 5.4 -> 8.1 (matches 1.2.31+ requirement note)
- Requirements.md: MySQL 5.6 -> 5.7, MariaDB 5.5 -> 10.2 (current minimums)
- Requirements.md: MySQL section header updated to >= 5.7 / 10.2
- Requirements.md, Install-Under-CentOS_LAMP.md,
Install-Under-CentOS_LEMP.md, Installing-Under-Windows.md:
comment out innodb_file_format and innodb_large_prefix (removed
in MySQL 8.0 / MariaDB 10.3+)
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: upgrade http:// links to https:// and fix dead wiki URLs
- Upgrade http:// to https:// in 8 files:
General-Installing-Instructions.md, Graph-Templates.md,
How-To-SSH-Tunnels.md, Plugin-Development.md,
Standards-Code-Formatting.md, Templates.md,
Upgrading-Cacti-Under-Windows.md
- Replace two dead docs.cacti.net wiki links:
How-To-SSH-Tunnels.md: old wiki SNMP guide -> Net-SNMP man page
Plugin-Syslog.md: dead plugin:syslog.config -> plugin_syslog repo
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix technically inaccurate MySQL configuration recommendations
- innodb_additional_mem_pool_size: removed in MySQL 5.7.4 / MariaDB 10.0;
replaced with removal notice in Requirements.md and comments in
Install-Under-CentOS_LAMP.md and Install-Under-CentOS_LEMP.md
- max_heap_table_size: clarify ">= 5" means ">= 5% of system RAM"
- innodb_buffer_pool_size: clarify ">= 25" means ">= 25% of system RAM"
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: add missing required PHP extensions to Requirements.md
Add dom, mysqlnd, pcntl, Phar, and sqlite3 — all declared as required
in composer.json but absent from the module list. pcntl is Linux-only
(process control for the poller).
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix 36 spelling errors across 19 documentation files
Corrections detected by codespell:
- somone->someone, Walkthough->Walkthrough, GUAGE->GAUGE
- asociate->associate, messege->message, therefor->therefore
- get's->gets, Proxys->Proxies, paralelisation->parallelization
- parms->params (6 instances in script data query examples)
- finialise->finalise, buildin->built-in, everytime->every time
- Unistall->Uninstall, resiliant->resilient, build-in->built-in
- requriments->requirements (2 instances), explanitory->explanatory (3 instances)
- fro->for, invole->involve, reulting->resulting
- stauts->status, tge->the
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: add codespell spelling check workflow for documentation
Adds GitHub Actions workflow that runs codespell==2.4.1 on all Markdown
files on every push/PR to main. Also adds .codespell.cfg to skip binary
and generated files (JSON, shell scripts, HTML, images).
Update .gitignore to allow .github directory (was blocked by .git* glob).
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: improve voice, consistency, and note formatting across 10 files
- Convert passive/impersonal constructions to active voice
- Standardize NOTE -> Note in blockquotes for consistency
- Reformat inline IMPORTANT/Note callouts as blockquotes
- Fix awkward phrasing in LXC container notes
- Consolidate fragmented note bullets into single blockquote
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix technical accuracy and correct typos across 10 files
- Requirements.md: clarify Composer is for source/develop installs only;
RRDtool minimum updated to 1.5+ (1.8+ for 1.3.x); php-snmp section
rewritten to describe selective fallback behavior; SELinux/AppArmor
advice reworded to recommend policy exceptions over blanket disable
- Spine.md: fix PHP Script Server range (10 -> 15); fix 'senstivive'
and 'Davices' typos
- Trees.md: fix broken table rows split across lines; 'Sporting' -> 'Sorting'
- Data-Sources.md: restructure storage table to standard 3-column layout;
fix '19b' unit typo -> '19kb'
- How-To-SNMP-Custom-Script.md: convert bold/backtick commands to proper
fenced code blocks; fix 'intex' and 'BNSMPD' typos
- Plugins.md: fix 'onfiguration' typo; fix YouTube thumbnail http -> https;
fix 'Tuturial' typo
- Standards-Security.md: fix 'invalidate' -> 'invalid'
- template_apache_config.md: fix 'apcache2' -> 'apache2'
- device-template-specific-proxmox.md: replace service file edit with
drop-in approach; remove ProtectSystem=off/ProtectHome=off; add note
on minimal required systemd overrides
- resource/xml/query_interface_traffic.php: http -> https URL
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: rename CentOS install guides to Enterprise Linux; fix grammar, logic, and security flaws
- Rename Install-Under-CentOS_LAMP.md → Install-Under-Enterprise-Linux-LAMP.md
- Rename Install-Under-CentOS_LEMP.md → Install-Under-Enterprise-Linux-LEMP.md
- Update README.md ToC links to match new filenames and correct labels
LAMP fixes:
- Title updated to reflect RHEL/Rocky Linux/AlmaLinux coverage
- Fix step numbering: "2.Install" / "3.Enable" missing space after number
- Spine build deps: restructure for EL7/EL8/EL9+ separately; EL8 was
missing package install after repo enable; EL9+ uses 'crb' not 'powertools'
- SELinux URL: fix quadruple-slash typo; switch to English wiki URL
LEMP fixes:
- Title: "CentOS 7" → "Enterprise Linux (RHEL / Rocky Linux / AlmaLinux)"
- TLS: remove TLSv1 and TLSv1.1 (RFC 8996 prohibited, fails OpenSSL 3.x);
set ssl_protocols TLSv1.2 TLSv1.3
- Ciphers: remove DH+3DES (Sweet32 / CVE-2016-2183)
- HTTP redirect: uncomment return 301 (comment claiming nginx lacks support
for 'return' has been wrong since nginx 0.8 / 2009)
- PHP location block: fix 'alias' → 'root' (alias breaks $document_root in
fastcgi_param SCRIPT_FILENAME); add missing semicolon after index directive
- Cron: poller path was /var/www/html/cacti but install target throughout
this guide is /usr/share/nginx/html/cacti — align them
- DB: split GRANT...IDENTIFIED BY into CREATE USER + GRANT (IDENTIFIED BY
on GRANT removed in MySQL 8.0 / MariaDB 10.5.2)
- Fix comment typo: "Compression increases performance0" → remove trailing 0
- SELinux URL: fix quadruple-slash typo
README.md:
- Update section 3.1 and 3.2 links to new filenames
- Correct labels from "CentOS 7" to "Enterprise Linux"
- Fix "Reports Admistrative Interface" → "Administrative"
- Fix "requriments" (×2) → "requirements"
* docs: remove Install-Under-CentOS_LAMP.md (superseded by Install-Under-Enterprise-Linux-LAMP.md)
* docs: remove Install-Under-CentOS_LEMP.md (superseded by Install-Under-Enterprise-Linux-LEMP.md)
* docs: update README ToC links and fix typos
- Update 3.1 and 3.2 links from CentOS to Enterprise Linux filenames
- Correct labels: "CentOS 7" → "Enterprise Linux (RHEL/Rocky/AlmaLinux)"
- Fix "Reports Admistrative" → "Reports Administrative"
- Fix "requriments" (×2) → "requirements"
* docs: fix grammar, logic, and technical errors in remaining install/upgrade guides
Installing-Under-Windows.md:
- Replace php_mysql.dll with php_pdo_mysql.dll (php_mysql removed in PHP 7.0)
- Remove IIS ISAPI steps referencing php8isapi.dll (ISAPI dropped in PHP 8.0);
replace with FastCGI instructions via php-cgi.exe
- Remove NO_AUTO_CREATE_USER from sql_mode (removed MySQL 8.0, breaks startup)
- sort_buffer_size = 200M → 32M with caveat (per-session; 200M causes OOM under load)
- Fix step numbering gaps: main list 5→8, IIS 3→5, Finishing 5→8
- "you will have to user 8.3 notation" → "use"
- "c:cygwin" → "c:\cygwin" (missing backslash)
- "it's subfolders" → "its subfolders"
- "A anm example" → "An example"
- "verify/udate" → "verify/update"
Installing-Under-Ubuntu-Debian.md:
- Cron user: apache → www-data (apache user does not exist on Ubuntu/Debian)
- CREATE DATABASE: use utf8mb4 directly; remove redundant ALTER DATABASE
- php8.1-mbstring listed twice in apt-get install; deduplicated
- "may received" → "may receive"
- Note php8.1 is EOL; recommend checking current supported release
Upgrading-Cacti-Under-Windows.md:
- Fix all steps numbered 1. → proper sequential numbering (1–10)
- Remove hardcoded MySQL 5.7 path; use generic %MYSQL_HOME% note
Upgrading-Cacti-Under-FreeBSD.md:
- mysqldump: remove contradictory -l / --lock-tables=false flags;
replace with --single-transaction (correct for InnoDB, no locking)
How-To-SSH-Tunnels.md:
- Add prominent note: SSH -L is TCP-only; standard SNMP uses UDP; this
guide requires TCP transport configured on snmpd and does not work for
most network devices
- Fix unclosed code fence after ssh-keygen output block
- Replace rc.local persistence with systemd unit (rc.local is deprecated
and disabled by default on systemd distros: Ubuntu 16.04+, Debian 9+)
- ssh-keygen: recommend ed25519 over RSA
* docs: correct PHP 8.1 EOL date, Net-SNMP link, and grammar
PHP 8.1 security support ended 31 December 2025, not November 2024. Point the
snmpd.conf link at www.net-snmp.org (the sourceforge.io mirror is bot-blocked).
Fix 'There a two ways extending' to 'There are two ways to extend'.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: fix spelling workflow trigger to target develop, not main
The repo's default branch is develop; main hasn't moved since 2023.
The workflow's push/pull_request filters targeted main, so it never
ran on any PR opened against develop.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
dependabot[bot]