Merge remote-tracking branch 'origin/develop' into pr-214

# Conflicts:
#	Installing-Under-Windows.md

Author: somethingwithproof

.codespell.cfg

@@ -0,0 +1,6 @@
+[codespell]
+# Skip binary files and images (some image filenames contain historical typos
+# that cannot be renamed without breaking existing markdown links)
+skip = *.png,*.jpg,*.jpeg,*.gif,*.svg,*.pdf,*.ico,*.zip,*.json,*.sh,*.html
+# Known false positives or intentional abbreviations
+ignore-words-list = parms,nd,ba,te

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: develop
+    schedule: {interval: weekly, day: friday}
+    open-pull-requests-limit: 5
+    cooldown: {default-days: 7}
+    groups:
+      github-actions: {patterns: ["*"]}
+    labels: [dependencies, github-actions]
+    commit-message: {prefix: ci, include: scope}

.github/workflows/spelling.yml

@@ -0,0 +1,23 @@
+name: Spelling
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+    branches: [develop]
+
+permissions:
+  contents: read
+
+jobs:
+  codespell:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Install codespell
+        run: pip install codespell==2.4.1
+
+      - name: Run codespell
+        run: codespell --config .codespell.cfg

.gitignore

@@ -11,5 +11,7 @@ manual/*
 # Ignore any CertBot files
 .well-known
 .well-known/*
-# Ignore any Git/GitHub files
-.git*
+# Ignore Git internals but allow .github directory for CI workflows
+.git*
+!.github
+!.github/**

Boost.md

@@ -31,12 +31,23 @@ on demand by the Cacti Administrator. They include:
 
 ## Prerequisites
 
+> **Recommendation**: For most installations, especially those using the
+> **multiprocessing update** feature introduced in Cacti 1.2.17, or any
+> deployment with multiple Data Collectors, use **InnoDB** for all Boost tables.
+> The MEMORY engine can cause race conditions between concurrent processes
+> competing for memory table locks, which leads to polling backlogs and data
+> loss on busy systems. InnoDB with SSD or NVMe storage performs comparably and
+> avoids these failure modes. MEMORY tables are also incompatible with MariaDB
+> Galera and MySQL replication.
+
 In its initial design the Boost process leveraged MySQL Memory Tables to
-increase overall performance, and to reduce writing data to disk. This is still
-a valid case however, with improvements in InnoDB performance over the years
-combined with Flash storage, the need for using MySQL Memory Tables has
-diminished. In some cases, for example when using MariaDB Galera, or MySQL
-Master/Slave replication, it can not be used.
+increase overall performance, and to reduce writing data to disk. With
+improvements in InnoDB performance over the years combined with Flash storage,
+the need for MySQL Memory Tables has diminished. The sections below document
+MEMORY table sizing for sites that have an explicit reason to use it, but InnoDB
+is the recommended engine. The main boost data table (`poller_output_boost`)
+already ships as InnoDB; the `ALTER TABLE` examples below convert tables to
+MEMORY only if you have a specific reason to use that engine.
 
 If you do wish to use Memory you have to pay close attention to the amount of
 data that will be cached in your design. You should periodically check that you
@@ -178,10 +189,14 @@ Then, save the file, and restart MySQL. Once this is done, you are ready to
 
 ## Flushing the Boost Cache
 
-If you are planning on system maintenance if you are using MEMORY storage in
-MySQL or MariaDB, you should flush your Boost Cache before your system is taken
-offline for maintenance. To do this, you simply login to the Cacti system as
-root, and flush the Cache using the commands below
+> **Warning**: MEMORY tables are cleared on every MySQL/MariaDB restart. If you
+> are using MEMORY storage, always flush the Boost Cache before taking the
+> database offline. Failure to do so will result in loss of all buffered poller
+> data since the last flush.
+
+If you are planning on system maintenance and are using MEMORY storage in
+MySQL or MariaDB, flush your Boost Cache before the system is taken offline.
+Login to the Cacti system as root and run the following:
 
 ```console
 cd /var/www/html/cacti

Cacti-SSL-Configuration.md

@@ -1,47 +1,149 @@
-# Configuring and enabling SSL for Cacti with a self-signed certificate
+# Configuring SSL for Cacti
 
-Enabling SSL for Cacti is done at the web server level. An example HTTPS
-configuration for Apache is as follows:
+Enabling HTTPS for Cacti is done at the web server level. This page covers
+self-signed certificates for internal use and Let's Encrypt for public-facing
+servers.
 
-```bash
-yum install -y mod_ssl
-openssl genrsa -out ca.key 4096
-openssl req -new -key ca.key -out ca.csr
-openssl x509 -req -days 700 -in ca.csr -signkey ca.key -out ca.crt
-cp ca.crt /etc/pki/tls/certs
-cp ca.key /etc/pki/tls/private/ca.key
-cp ca.csr /etc/pki/tls/private/ca.csr
+> **Note**: If using multiple Data Collectors, all must have HTTPS enabled for
+> the remote polling feature to work correctly.
+
+## Self-Signed Certificate (Internal Use)
+
+Self-signed certificates are suitable for internal networks where you control
+the clients. Use ECDSA (secp384r1) for best performance, or RSA 4096 if your
+environment requires RSA.
+
+### ECDSA (recommended)
+
+```shell
+# RHEL/Rocky/AlmaLinux
+dnf install -y mod_ssl
+
+# Generate a 384-bit EC private key and self-signed certificate (valid 3 years)
+openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:P-384 \
+    -keyout /etc/pki/tls/private/cacti.key \
+    -out /etc/pki/tls/certs/cacti.crt \
+    -days 1095 \
+    -subj "/CN=cacti.example.com" \
+    -addext "subjectAltName=DNS:cacti.example.com"
+
+chmod 600 /etc/pki/tls/private/cacti.key
 ```
 
-> **Note on key size**: A 4096-bit RSA key is used above. NIST SP 800-57
-> recommends a minimum of 3072 bits for RSA keys through 2030. 2048-bit keys
-> are below that threshold and should not be used for new certificates.
+### RSA (alternative)
 
-Then we need to update the Apache SSL configuration file:
+```shell
+# 4096-bit RSA — use when EC is not supported by your TLS client pool
+openssl req -x509 -nodes -newkey rsa:4096 \
+    -keyout /etc/pki/tls/private/cacti.key \
+    -out /etc/pki/tls/certs/cacti.crt \
+    -days 1095 \
+    -subj "/CN=cacti.example.com" \
+    -addext "subjectAltName=DNS:cacti.example.com"
 
-```ini
-vi +/SSLCertificateFile /etc/httpd/conf.d/ssl.conf
-SSLCertificateFile /etc/pki/tls/certs/ca.crt
-SSLCertificateKeyFile /etc/pki/tls/private/ca.key
+chmod 600 /etc/pki/tls/private/cacti.key
 ```
 
-Restart the httpd service:
+> **Debian/Ubuntu paths**: the commands above use the RHEL layout
+> (`/etc/pki/tls/...`). On Debian/Ubuntu, write the key and certificate to
+> `/etc/ssl/private/cacti.key` and `/etc/ssl/certs/cacti.crt` instead, to match
+> the Apache `SSLCertificateKeyFile`/`SSLCertificateFile` paths shown below.
+
+> **Key size**: RSA 2048-bit is below NIST SP 800-131A Rev 2 guidance for
+> long-term use. Use 4096-bit RSA or an ECDSA key.
+
+## Apache Configuration
 
-```bash
-systemctl restart httpd
+Update `/etc/httpd/conf.d/ssl.conf` (RHEL/Rocky/AlmaLinux) or
+`/etc/apache2/sites-available/cacti-ssl.conf` (Debian/Ubuntu):
+
+```apache
+<VirtualHost *:443>
+    ServerName cacti.example.com
+    DocumentRoot /var/www/html/cacti
+
+    SSLEngine on
+    # RHEL/Rocky/AlmaLinux cert paths:
+    #   SSLCertificateFile    /etc/pki/tls/certs/cacti.crt
+    #   SSLCertificateKeyFile /etc/pki/tls/private/cacti.key
+    # Debian/Ubuntu cert paths:
+    SSLCertificateFile    /etc/ssl/certs/cacti.crt
+    SSLCertificateKeyFile /etc/ssl/private/cacti.key
+
+    # Require TLS 1.2 or 1.3; TLS 1.0 and 1.1 are prohibited (RFC 8996)
+    SSLProtocol           -all +TLSv1.2 +TLSv1.3
+
+    # TLS 1.2 cipher suites -- no RC4, 3DES, or export ciphers
+    SSLCipherSuite        ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:\
+ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:\
+ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
+    SSLHonorCipherOrder   on
+
+    # TLS 1.3 cipher suites (SSLCipherSuite does not apply to TLS 1.3)
+    SSLOpenSSLConfCmd     Ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+</VirtualHost>
+
+# Optional: redirect HTTP to HTTPS (uncomment to enable)
+#<VirtualHost *:80>
+#    ServerName cacti.example.com
+#    Redirect permanent / https://cacti.example.com/
+#</VirtualHost>
 ```
 
-After configuring the web server to accept HTTPS, you can enable HTTPS in the
-GUI.
+Restart Apache after editing:
 
-> **Note for public-facing servers**: Instead of a self-signed certificate,
-> use a certificate from a trusted CA. [Certbot](https://certbot.eff.org/)
-> from Let's Encrypt provides free, automatically-renewed certificates and
-> is the recommended approach for any internet-accessible Cacti instance.
+```shell
+apachectl configtest
+systemctl restart httpd        # RHEL/Rocky/AlmaLinux
+systemctl restart apache2      # Debian/Ubuntu
+```
 
----
+## Let's Encrypt (Public-Facing Servers)
 
-**Note**: if using multiple pollers, all must have HTTPS enabled for the remote polling feature to work properly.
+For servers reachable from the internet, use Let's Encrypt for a
+browser-trusted certificate at no cost.
+
+### RHEL/Rocky/AlmaLinux
+
+```shell
+# certbot ships in EPEL on RHEL/Rocky/AlmaLinux, not in BaseOS/AppStream
+dnf install -y epel-release
+dnf install -y certbot python3-certbot-apache
+certbot --apache -d cacti.example.com
+```
+
+### Debian/Ubuntu
+
+```shell
+apt-get install -y certbot python3-certbot-apache
+certbot --apache -d cacti.example.com
+```
+
+Certbot configures Apache and sets up automatic renewal. Verify auto-renewal
+works:
+
+```shell
+certbot renew --dry-run
+```
+
+## Verifying the Configuration
+
+After restarting Apache, confirm TLS is working and that weak protocols are
+disabled:
+
+```shell
+# Check the certificate and protocol support
+openssl s_client -connect cacti.example.com:443 -tls1_2 < /dev/null
+openssl s_client -connect cacti.example.com:443 -tls1   < /dev/null  # should fail
+```
+
+For a comprehensive scan, use [SSL Labs](https://www.ssllabs.com/ssltest/) on
+public servers or `testssl.sh` on internal hosts:
+
+```shell
+# testssl.sh (download from https://testssl.sh/)
+./testssl.sh cacti.example.com
+```
 
 ---
 

Data-Collectors.md

@@ -13,7 +13,7 @@ of **Data Collectors** they are:
   firewall or security policies.  The **Remote Data Collectors** are
   also referred to as **Remote Pollers**.
 
-Due to the design of the Cacti **Remote Data Collector**, somone at the
+Due to the design of the Cacti **Remote Data Collector**, someone at the
 remote site, can actually login to that **Data Collector** and interact
 with it as if their **Data Collector** was the **Main Data Collector**.
 Additionally, if for some reason the **Main Data Collector** becomes

Data-Input-Methods.md

@@ -169,7 +169,7 @@ be executed as the user the data gatherer runs as. Sometimes a script may work
 correctly when executed as root, but fails due to permissions problems when
 executed as a less privileged user.
 
-## Walkthough
+## Walkthrough
 
 You can find a detailed example of how to create a complete Graph from
 simple command output in the following example

Data-Source-Templates.md

@@ -30,7 +30,7 @@ see
 
 ## GAUGE
 
-GUAGE is for things like temperatures or number of people in a room or the value
+GAUGE is for things like temperatures or number of people in a room or the value
 of a RedHat share.
 
 ## COUNTER
@@ -116,7 +116,7 @@ documentation page.
 ![Data-Source-Templates](images/datasource-template.png)
 
 What is also an important setting is the internal data source name. This will be
-used to asociate the Data source with the Graph template. so be sure to name is
+used to associate the Data source with the Graph template. so be sure to name is
 something that is recognizable.
 
 ![Data-Source-Templates](images/datasource-template2.png)

Data-Sources.md

@@ -28,7 +28,7 @@ to management then clicking on devices.
 
 You can also see the total amount of data sources by checking the poller stats
 on the system. Click the log tab and filter by stats and lookout for the below
-messege
+message
 
 ```console
 2019/05/24 17:21:11 - SYSTEM STATS: Time:9.5913 Method:spine Processes:2 Threads:2 Hosts:14 HostsPerProcess:7 DataSources:162 RRDsProcessed:117
@@ -45,14 +45,20 @@ devices. e.g. 1 minute or 5 Minute polls
 Here is the approximate amount of storage you can expect to consume per data
 source
 
-| Polling time | Retention | File size | Polling time | Retention | File size |
-| -----------: | --------- | --------: | -----------: | --------- | --------: |
-|    30 second | Daily     |      48kb |    30 second | Weekly    |      43kb |
-|    30 second | Monthly   |      46kb |    30 second | Yearly    |     140kb |
-|     1 minute | Daily     |      93kb |     1 minute | Weekly    |      45kb |
-|     1 minute | Monthly   |      47kb |     1 minute | Yearly    |     140kb |
-|     5 minute | Daily     |       19b |     5 minute | Weekly    |      22kb |
-|     5 minute | Monthly   |      25kb |     5 minute | Yearly    |      26kb |
+| Polling time | Retention | File size |
+| -----------: | --------- | --------: |
+|    30 second | Daily     |      48kb |
+|    30 second | Weekly    |      43kb |
+|    30 second | Monthly   |      46kb |
+|    30 second | Yearly    |     140kb |
+|     1 minute | Daily     |      93kb |
+|     1 minute | Weekly    |      45kb |
+|     1 minute | Monthly   |      47kb |
+|     1 minute | Yearly    |     140kb |
+|     5 minute | Daily     |      19kb |
+|     5 minute | Weekly    |      22kb |
+|     5 minute | Monthly   |      25kb |
+|     5 minute | Yearly    |      26kb |
 
 ### Viewing all Data sources by device