[FEATURE] Avoid Package Being Downloaded from the Checkmk Server Directly

[Naolador]

Describe the festure
If a client is behind a filewall, it can't reach the Checkmk server directly. Hence, the checkmk.general.agent won't be able to continue with the TLS registration.

Component Name
checkmk.general.agent

Ansible Version

$ ansible --version
ansible [core 2.19.7]
  config file = /home/iss/nwang001/ansible.cfg
  configured module search path = ['/staff/iss/nwang001/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/iss/nwang001/pyenvs/Ansible-cli_v7/lib64/python3.11/site-packages/ansible
  ansible collection location = /staff/iss/nwang001/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/iss/nwang001/pyenvs/Ansible-cli_v7/bin/ansible
  python version = 3.11.13 (main, Aug 21 2025, 00:00:00) [GCC 11.5.0 20240719 (Red Hat 11.5.0-11)] (/home/iss/nwang001/pyenvs/Ansible-cli_v7/bin/python3.11)
  jinja version = 3.1.6
  pyyaml version = 6.0.3 (with libyaml v0.2.5)

Collection Version

$ ansible-galaxy collection list
checkmk.general                          7.2.1

Environment
RHEL9
Checkmk 2.3

Screenshots
n/a

Additional context
I have to install the Checkmk package before invoke the checkmk.general.agent role. But this role tries to download the rpm even if the client has already been installed.

[robin-checkmk]

Hi @Naolador and thanks for raising this! Skimming through the request, I have some thoughts and need to check a few things. In the meantime, can you please formulate your expectation for the role or the specific use case, you want to use it for? I want to make sure we are building a proper feature and do not focus on a specific error, overlooking the bigger picture. Thanks!

[Naolador]

Hi @robin-checkmk

Thanks for your reply. I'll explain my situation more.

We have a few servers running in the DMZ, which can only be managed via the jump hosts, and we used to use the proxy way for client registrations.

Recently, we found the checkmk.general.agent role worked pretty well for on-prem servers, so we wanted to implement the same for the DMZ servers. However, this role forces the client to download the Checkmk package from the Checkmk server. This does not apply to our environment, because the only way to download packages is via our Satellite capsule servers in the DMZs.

I read the codes of Linux.yaml and Linux-files.yaml a bit, and found the only way I could bypass the download and installation was by skipping the download-package, and install-package tags. But it's not ideal.

[Naolador]

Hi @robin-checkmk may I humbly ask if it is possible to add this feature?

[robin-checkmk]

Hi @Naolador. As we are working on this project in our free time, I cannot promise any timeline. We'll be working on it, when there is time. But that that is all I can say.
Of course anyone can start building this and raise a PR, which would happily review and collaborate on.

Update: I just realised, I never got back to you. Apologies for that. But my feedback above is still valid.

[Naolador]

Thanks @robin-checkmk I will see if I can do any help.