* add architecture decision records
* docs: keep Development Standards description with its list item
Item 8 was inserted between item 7's link and its description paragraph, which
re-parents that paragraph onto Architecture Decisions. Move item 8 below the
Development Standards description.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: describe the Architecture Decisions index entry
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: add Hardening-Cacti-Installation guide
* docs: add Hardening-Cacti-Installation to Cacti Installation nav
* docs: cross-reference hardening guide from Standards-Security
* docs(hardening): correct harmful PHP/permission/AppArmor guidance
The disable_functions list blocked exec/shell_exec/proc_open/popen/system,
which the web tier uses for RRDtool, fping and spikekill, so graphs stopped
rendering; restrict it to passthru and pcntl_exec. The recursive chmod 755
left config.php DB credentials world-readable; lock it to 640 root:www-data.
Cite the real package-import advisory (GHSA-7cmj-g5qc-pj88, CVE-2024-25641),
add execute rules for helper binaries to the AppArmor profile, and stop
forcing the spine daemon into httpd_t.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(hardening): fix .htaccess DirectoryMatch guidance and footer order
DirectoryMatch is invalid in .htaccess context; scope that example to
vhost config and add an .htaccess-compatible FilesMatch alternative.
Also move Standards-Security.md's See Also section above the copyright
footer instead of after it, and add the missing footer to the new
hardening guide.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix SELinux policy guidance and add CentOS EOL notices
Refs #209
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: scope the AppArmor section to actually-confined Apache
Ubuntu and Debian enable AppArmor but ship no Apache profile by default, so
Apache runs unconfined and the reload commands error out on a stock system.
Gate the section on an Apache profile being present before applying overrides.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: netniV <netniv@hotmail.com>
* docs: update stale PHP/MySQL/MariaDB version requirements
- Requirements.md: PHP 5.4 -> 8.1 (matches 1.2.31+ requirement note)
- Requirements.md: MySQL 5.6 -> 5.7, MariaDB 5.5 -> 10.2 (current minimums)
- Requirements.md: MySQL section header updated to >= 5.7 / 10.2
- Requirements.md, Install-Under-CentOS_LAMP.md,
Install-Under-CentOS_LEMP.md, Installing-Under-Windows.md:
comment out innodb_file_format and innodb_large_prefix (removed
in MySQL 8.0 / MariaDB 10.3+)
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: upgrade http:// links to https:// and fix dead wiki URLs
- Upgrade http:// to https:// in 8 files:
General-Installing-Instructions.md, Graph-Templates.md,
How-To-SSH-Tunnels.md, Plugin-Development.md,
Standards-Code-Formatting.md, Templates.md,
Upgrading-Cacti-Under-Windows.md
- Replace two dead docs.cacti.net wiki links:
How-To-SSH-Tunnels.md: old wiki SNMP guide -> Net-SNMP man page
Plugin-Syslog.md: dead plugin:syslog.config -> plugin_syslog repo
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix technically inaccurate MySQL configuration recommendations
- innodb_additional_mem_pool_size: removed in MySQL 5.7.4 / MariaDB 10.0;
replaced with removal notice in Requirements.md and comments in
Install-Under-CentOS_LAMP.md and Install-Under-CentOS_LEMP.md
- max_heap_table_size: clarify ">= 5" means ">= 5% of system RAM"
- innodb_buffer_pool_size: clarify ">= 25" means ">= 25% of system RAM"
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: add missing required PHP extensions to Requirements.md
Add dom, mysqlnd, pcntl, Phar, and sqlite3 — all declared as required
in composer.json but absent from the module list. pcntl is Linux-only
(process control for the poller).
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix 36 spelling errors across 19 documentation files
Corrections detected by codespell:
- somone->someone, Walkthough->Walkthrough, GUAGE->GAUGE
- asociate->associate, messege->message, therefor->therefore
- get's->gets, Proxys->Proxies, paralelisation->parallelization
- parms->params (6 instances in script data query examples)
- finialise->finalise, buildin->built-in, everytime->every time
- Unistall->Uninstall, resiliant->resilient, build-in->built-in
- requriments->requirements (2 instances), explanitory->explanatory (3 instances)
- fro->for, invole->involve, reulting->resulting
- stauts->status, tge->the
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: add codespell spelling check workflow for documentation
Adds GitHub Actions workflow that runs codespell==2.4.1 on all Markdown
files on every push/PR to main. Also adds .codespell.cfg to skip binary
and generated files (JSON, shell scripts, HTML, images).
Update .gitignore to allow .github directory (was blocked by .git* glob).
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: improve voice, consistency, and note formatting across 10 files
- Convert passive/impersonal constructions to active voice
- Standardize NOTE -> Note in blockquotes for consistency
- Reformat inline IMPORTANT/Note callouts as blockquotes
- Fix awkward phrasing in LXC container notes
- Consolidate fragmented note bullets into single blockquote
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: fix technical accuracy and correct typos across 10 files
- Requirements.md: clarify Composer is for source/develop installs only;
RRDtool minimum updated to 1.5+ (1.8+ for 1.3.x); php-snmp section
rewritten to describe selective fallback behavior; SELinux/AppArmor
advice reworded to recommend policy exceptions over blanket disable
- Spine.md: fix PHP Script Server range (10 -> 15); fix 'senstivive'
and 'Davices' typos
- Trees.md: fix broken table rows split across lines; 'Sporting' -> 'Sorting'
- Data-Sources.md: restructure storage table to standard 3-column layout;
fix '19b' unit typo -> '19kb'
- How-To-SNMP-Custom-Script.md: convert bold/backtick commands to proper
fenced code blocks; fix 'intex' and 'BNSMPD' typos
- Plugins.md: fix 'onfiguration' typo; fix YouTube thumbnail http -> https;
fix 'Tuturial' typo
- Standards-Security.md: fix 'invalidate' -> 'invalid'
- template_apache_config.md: fix 'apcache2' -> 'apache2'
- device-template-specific-proxmox.md: replace service file edit with
drop-in approach; remove ProtectSystem=off/ProtectHome=off; add note
on minimal required systemd overrides
- resource/xml/query_interface_traffic.php: http -> https URL
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: rename CentOS install guides to Enterprise Linux; fix grammar, logic, and security flaws
- Rename Install-Under-CentOS_LAMP.md → Install-Under-Enterprise-Linux-LAMP.md
- Rename Install-Under-CentOS_LEMP.md → Install-Under-Enterprise-Linux-LEMP.md
- Update README.md ToC links to match new filenames and correct labels
LAMP fixes:
- Title updated to reflect RHEL/Rocky Linux/AlmaLinux coverage
- Fix step numbering: "2.Install" / "3.Enable" missing space after number
- Spine build deps: restructure for EL7/EL8/EL9+ separately; EL8 was
missing package install after repo enable; EL9+ uses 'crb' not 'powertools'
- SELinux URL: fix quadruple-slash typo; switch to English wiki URL
LEMP fixes:
- Title: "CentOS 7" → "Enterprise Linux (RHEL / Rocky Linux / AlmaLinux)"
- TLS: remove TLSv1 and TLSv1.1 (RFC 8996 prohibited, fails OpenSSL 3.x);
set ssl_protocols TLSv1.2 TLSv1.3
- Ciphers: remove DH+3DES (Sweet32 / CVE-2016-2183)
- HTTP redirect: uncomment return 301 (comment claiming nginx lacks support
for 'return' has been wrong since nginx 0.8 / 2009)
- PHP location block: fix 'alias' → 'root' (alias breaks $document_root in
fastcgi_param SCRIPT_FILENAME); add missing semicolon after index directive
- Cron: poller path was /var/www/html/cacti but install target throughout
this guide is /usr/share/nginx/html/cacti — align them
- DB: split GRANT...IDENTIFIED BY into CREATE USER + GRANT (IDENTIFIED BY
on GRANT removed in MySQL 8.0 / MariaDB 10.5.2)
- Fix comment typo: "Compression increases performance0" → remove trailing 0
- SELinux URL: fix quadruple-slash typo
README.md:
- Update section 3.1 and 3.2 links to new filenames
- Correct labels from "CentOS 7" to "Enterprise Linux"
- Fix "Reports Admistrative Interface" → "Administrative"
- Fix "requriments" (×2) → "requirements"
* docs: remove Install-Under-CentOS_LAMP.md (superseded by Install-Under-Enterprise-Linux-LAMP.md)
* docs: remove Install-Under-CentOS_LEMP.md (superseded by Install-Under-Enterprise-Linux-LEMP.md)
* docs: update README ToC links and fix typos
- Update 3.1 and 3.2 links from CentOS to Enterprise Linux filenames
- Correct labels: "CentOS 7" → "Enterprise Linux (RHEL/Rocky/AlmaLinux)"
- Fix "Reports Admistrative" → "Reports Administrative"
- Fix "requriments" (×2) → "requirements"
* docs: fix grammar, logic, and technical errors in remaining install/upgrade guides
Installing-Under-Windows.md:
- Replace php_mysql.dll with php_pdo_mysql.dll (php_mysql removed in PHP 7.0)
- Remove IIS ISAPI steps referencing php8isapi.dll (ISAPI dropped in PHP 8.0);
replace with FastCGI instructions via php-cgi.exe
- Remove NO_AUTO_CREATE_USER from sql_mode (removed MySQL 8.0, breaks startup)
- sort_buffer_size = 200M → 32M with caveat (per-session; 200M causes OOM under load)
- Fix step numbering gaps: main list 5→8, IIS 3→5, Finishing 5→8
- "you will have to user 8.3 notation" → "use"
- "c:cygwin" → "c:\cygwin" (missing backslash)
- "it's subfolders" → "its subfolders"
- "A anm example" → "An example"
- "verify/udate" → "verify/update"
Installing-Under-Ubuntu-Debian.md:
- Cron user: apache → www-data (apache user does not exist on Ubuntu/Debian)
- CREATE DATABASE: use utf8mb4 directly; remove redundant ALTER DATABASE
- php8.1-mbstring listed twice in apt-get install; deduplicated
- "may received" → "may receive"
- Note php8.1 is EOL; recommend checking current supported release
Upgrading-Cacti-Under-Windows.md:
- Fix all steps numbered 1. → proper sequential numbering (1–10)
- Remove hardcoded MySQL 5.7 path; use generic %MYSQL_HOME% note
Upgrading-Cacti-Under-FreeBSD.md:
- mysqldump: remove contradictory -l / --lock-tables=false flags;
replace with --single-transaction (correct for InnoDB, no locking)
How-To-SSH-Tunnels.md:
- Add prominent note: SSH -L is TCP-only; standard SNMP uses UDP; this
guide requires TCP transport configured on snmpd and does not work for
most network devices
- Fix unclosed code fence after ssh-keygen output block
- Replace rc.local persistence with systemd unit (rc.local is deprecated
and disabled by default on systemd distros: Ubuntu 16.04+, Debian 9+)
- ssh-keygen: recommend ed25519 over RSA
* docs: correct PHP 8.1 EOL date, Net-SNMP link, and grammar
PHP 8.1 security support ended 31 December 2025, not November 2024. Point the
snmpd.conf link at www.net-snmp.org (the sourceforge.io mirror is bot-blocked).
Fix 'There a two ways extending' to 'There are two ways to extend'.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: fix spelling workflow trigger to target develop, not main
The repo's default branch is develop; main hasn't moved since 2023.
The workflow's push/pull_request filters targeted main, so it never
ran on any PR opened against develop.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Thomas Vincent