ipahealthcheckconf(5)

💖 ipahealthcheckconf — the ipa-healthcheck config file, bestie edition 💖

okay so you found ipahealthcheckconf(5), the manual page for the config file of ipa-healthcheck. she's not complicated, she's just got ✨rules✨, and honestly? once you get her vibe she's the easiest girl in the whole FreeIPA friend group. let's go 🫶

---

🌸 NAME 🌸

ipahealthcheck.conf — the ipa-healthcheck configuration file. that's it. that's the whole name. iconic.

---

✨ SYNOPSIS ✨

/etc/ipahealthcheck/ipahealthcheck.conf

one file. one path. no drama. 💅

---

🦋 DESCRIPTION 🦋

so ipahealthcheck.conf is literally the file you use to set your defaults when you run ipa-healthcheck. that's the whole job. you put your defaults here so you don't have to type them every single time, and honestly? that's main character energy. 👑

---

🎀 SYNTAX 🎀

okay bestie, here's where it gets real. the rules, in order:

• the configuration option names are not case sensitive. the values may be case sensitive though, depending on the option, so don't get cute with them. 🙈
• blank lines are ignored. she simply doesn't see them.
• lines starting with # are comments, and they're ignored too. leave notes for your future self, it's self care. 💜
• a valid line is an option name, an equals sign, and a value. spaces around the equals sign are ignored. an option ends at the end of the line. periodt.
• values should not be quoted — the quotes will not be stripped. so don't do it. i'm serious. 😭

# Wrong - don't include quotes
verbose = "True"

# Right - Properly formatted options
verbose = True
verbose=True

see how pretty the right one is? yeah. be the right one. ✨

• options must appear in the section named [default]. there are no other sections defined or used currently. that's the whole list of sections. one section. queen behavior.
• you can define options that aren't used. but be careful of misspellings, because they will not be rejected. she'll just quietly ignore you and you'll be confused later. 💀

---

🚫 EXCLUDES 🚫

sometimes you just need to suppress a result, and that's valid. the classic example: a customer certificate that's throwing a warning because IPA doesn't know it. totally normal, lowkey annoying.

here's the tea on how excluding actually works, because the differences are important:

• excluding a result key does not stop it from running — it just gets filtered out of the reported results.
• excluding by source or check will prevent it from running at all.
• services will not be excluded, because other checks may rely on them (ipahealthcheck.meta.services). they're too important to ghost, sorry. 🫶

each excludes type may be listed multiple times. invalid sources, checks and/or keys will not be flagged — no error, no warning, nothing. and these config options are only processed when they show up in the EXCLUDES section; anywhere else they're just ignored.

also, please, annotate the reason you're excluding something so the reason doesn't get lost forever. future you says thank you. 🌸

you can suppress or exclude results in three ways:

• source, e.g. ipahealthcheck.ipa.certs
• check, e.g. IPADNSSystemRecordsCheck
• report key, e.g. 20210910141457 (certmonger tracking id)

---

👑 OPTIONS 👑

here's what actually matters in each section, bestie. buckle up, it's a short list, we love her for that.

[default]

• cert_expiration_days — how many days left before a certificate expires you want to start getting a warning. the default is 28.
• timeout — how long, in seconds, each check gets to run before it's considered an error. the default is 10.

[excludes]

• source — filter results based on the check source.
• check — filter results based on the check name.
• key — filter results based on the result key in the healthcheck output.

---

💅 the command-line options situation 💅

all command-line options may be included in the configuration file. dashes must be converted to underscores for the config file, e.g. --output-type becomes output_type. all options are allowed, including the ones that make zero sense in a config file, like --list-sources. let the buyer beware. 😌

so why would you even do this? automation, bestie. it means you don't have to tweak your automation script every time. example: if you want the default output type to be human for the systemd timer's automated runs, setting output_type=human in the config file does exactly that. slay.

⚠️ when loading configuration, the first option wins. so if an option is in the config file, it cannot be overridden by the command line unless you specify a different configuration file (see --config).

there may be conflicting exceptions, and this is where it gets spicy. for example, if all=True is set in the config file and the command line contains --failures-only, then only failures will be displayed — because of the way the option evaluation is done. not a bug, just how she is. 🔥

options that don't make sense for the config file include --list-sources and --input-file.

---

📁 FILES 📁

• /etc/ipahealthcheck/ipahealthcheck.conf — configuration file

---

🌈 EXAMPLES 🌈

7 days left before a certificate expires to start displaying a warning:

[default]
cert_expiration_days=7

Exclude all certificate checks:

[excludes]
source=ipahealthcheck.ipa.certs

Don't warn about a custom certificate being tracked by certmonger:

[excludes]
key=20210910141452

---

💜 SEE ALSO 💜

• ipa-healthcheck(8)

---

and that's the whole page, bestie. go forth and configure responsibly. this one came to you from FreeIPA, dated Apr 5 2019 — yes she's a classic, yes she still eats. mwah. 💋✨