From: Daniel F. Dickinson Date: Fri, 17 Jul 2026 01:01:36 +0000 (-0400) Subject: zabbix: bring proxy to parity with server and agentd X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=355665cfb5246a4a0e437bc367cb8c0cf7d20688;p=openwrt-packages.git zabbix: bring proxy to parity with server and agentd * Add config file patch for proxy * Add initscript for proxy * Update Makefile and support files to bring proxy to parity with agentd and server. Signed-off-by: Daniel F. Dickinson --- diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile index d4bedaf40..eb951ef7b 100644 --- a/admin/zabbix/Makefile +++ b/admin/zabbix/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=zabbix PKG_VERSION:=7.0.28 -PKG_RELEASE:=2 +PKG_RELEASE:=3 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \ @@ -455,7 +455,7 @@ define Build/Configure $(call Build/Configure/Default) endef -# We use spaces for continued lines so that is if continuation does not parse +# We use spaces for continued lines so that if continuation does not parse # properly we will get a hard error instead of subtle failure. define Build/Compile $(call Build/Compile/Default) @@ -526,23 +526,31 @@ endef define Package/zabbix-proxy/conffiles /etc/zabbix_proxy.conf /etc/zabbix_proxy.conf.d/ +/etc/config/zabbix_proxy +endef + +define Package/zabbix-proxy/postinst +#!/bin/sh +[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_proxy) && rm -f /etc/uci-defaults/90_zabbix_proxy +exit 0 endef define Package/zabbix-proxy/install $(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d $(call Package/zabbix/install/sbin,$(1),proxy) $(call Package/zabbix/install/etc,$(1),proxy) + $(call Package/zabbix/install/init.d,$(1),proxy) + $(INSTALL_DIR) $(1)/etc/config + $(INSTALL_CONF) ./files/zabbix_proxy.config $(1)/etc/config/zabbix_proxy + $(INSTALL_DIR) $(1)/etc/uci-defaults + $(INSTALL_BIN) ./files/zabbix_proxy.defaults $(1)/etc/uci-defaults/90_zabbix_proxy endef -define Package/zabbix-proxy-basic-sqlite/conffiles -/etc/zabbix_proxy.conf -/etc/zabbix_proxy.conf.d/ -endef +Package/zabbix-proxy-basic-sqlite/conffiles=$(call Package/zabbix-proxy/conffiles) +Package/zabbix-proxy-basic-sqlite/postinst=$(call Package/zabbix-proxy/postinst) define Package/zabbix-proxy-basic-sqlite/install - $(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d - $(call Package/zabbix/install/sbin,$(1),proxy) - $(call Package/zabbix/install/etc,$(1),proxy) + $(call Package/zabbix-proxy/install,$(1)) endef define Package/zabbix-server/conffiles diff --git a/admin/zabbix/files/zabbix_proxy.config b/admin/zabbix/files/zabbix_proxy.config new file mode 100644 index 000000000..8464b0098 --- /dev/null +++ b/admin/zabbix/files/zabbix_proxy.config @@ -0,0 +1,4 @@ + +config zabbix_proxy 'general' + option enabled 0 + # option never_root 1 diff --git a/admin/zabbix/files/zabbix_proxy.defaults b/admin/zabbix/files/zabbix_proxy.defaults new file mode 100644 index 000000000..346814c3f --- /dev/null +++ b/admin/zabbix/files/zabbix_proxy.defaults @@ -0,0 +1,3 @@ +#!/bin/sh + +chown zabbix-proxy:zabbix-proxy /etc/zabbix_proxy.conf diff --git a/admin/zabbix/files/zabbix_proxy.init b/admin/zabbix/files/zabbix_proxy.init new file mode 100755 index 000000000..9939f8056 --- /dev/null +++ b/admin/zabbix/files/zabbix_proxy.init @@ -0,0 +1,50 @@ +#!/bin/sh /etc/rc.common +# Copyright (C) 2008-2025 OpenWrt.org + +# shellcheck shell=busybox + +# shellcheck disable=SC2034 +START=59 + +# shellcheck disable=SC2034 +USE_PROCD=1 + +NAME=zabbix_proxy +PROG=/usr/sbin/${NAME} +CONFIG=/etc/${NAME}.conf +UCI_CONFIG=/etc/config/${NAME} +USER=zabbix-proxy + +start_service() { + local enabled never_root + + if [ ! -f "${CONFIG}" ]; then + logger "Configuration file not found: '${CONFIG}'" + return 1 + fi + + # Get enabled config option + config_load "$NAME" + config_get_bool enabled general enabled 0 + config_get_bool never_root general never_root 1 + + # shellcheck disable=SC2154 + if [ "$enabled" -eq 0 ]; then + logger "service not enabled in $UCI_CONFIG" + return 1 + fi + + mkdir -p "/var/run/$USER" + chown $USER:$USER "/var/run/$USER" + + procd_open_instance + procd_set_param command ${PROG} -c ${CONFIG} -f + if [ "$never_root" -eq 1 ]; then + procd_set_param user ${USER} + fi + procd_set_param file ${CONFIG} + procd_set_param respawn + procd_set_param stdout 1 + procd_set_param stderr 1 + procd_close_instance +} diff --git a/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch new file mode 100644 index 000000000..cd1abd201 --- /dev/null +++ b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch @@ -0,0 +1,98 @@ +From c03db1c64e218fb2ef469ddb9705eff9f9d493e1 Mon Sep 17 00:00:00 2001 +From: "Daniel F. Dickinson" +Date: Thu, 16 Jul 2026 18:58:26 -0400 +Subject: zabbix_proxy: tweak config file for OpenWrt + +Created 2026-07-16. + +1. Use passive proxy mode by default (in keeping with agentd defaults). +2. Use system hostname as system hostname not 'Zabbix proxy'. +3. Log to syslog, not a file. +4. Update PidFile path so correct permissions can be set for access by + Zabbix proxy running without privileges. +5. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin). +6. Configure fping as the ipv6 fping as well. +7. If started as root, drop privileges to zabbix-proxy user (instead of + zabbix user shared with agent and server, or root) per upstream + recommendation: + https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation. +8. Include configurations under /etc/zabbix_proxy.conf.d/. +9. Require configurations under /etc/zabbix_proxy.conf.d/ end in .conf + (other files are ignored for configuration purposes). +--- + conf/zabbix_proxy.conf | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/conf/zabbix_proxy.conf ++++ b/conf/zabbix_proxy.conf +@@ -11,6 +11,7 @@ + # Mandatory: no + # Default: + # ProxyMode=0 ++ProxyMode=1 + + ### Option: Server + # If ProxyMode is set to active mode: +@@ -39,7 +40,7 @@ Server=127.0.0.1 + # Default: + # Hostname= + +-Hostname=Zabbix proxy ++# Hostname=Zabbix proxy + + ### Option: HostnameItem + # Item used for generating Hostname if it is undefined. +@@ -73,6 +74,7 @@ Hostname=Zabbix proxy + # Mandatory: no + # Default: + # LogType=file ++LogType=system + + ### Option: LogFile + # Log file name for LogType 'file' parameter. +@@ -81,7 +83,7 @@ Hostname=Zabbix proxy + # Default: + # LogFile= + +-LogFile=/tmp/zabbix_proxy.log ++# LogFile=/tmp/zabbix_proxy.log + + ### Option: LogFileSize + # Maximum size of log file in MB. +@@ -130,6 +132,7 @@ LogFile=/tmp/zabbix_proxy.log + # Mandatory: no + # Default: + # PidFile=/tmp/zabbix_proxy.pid ++PidFile=/var/run/zabbix-proxy/zabbix_proxy.pid + + ### Option: SocketDir + # IPC socket directory. +@@ -613,6 +616,7 @@ Timeout=4 + # Mandatory: no + # Default: + # FpingLocation=/usr/sbin/fping ++FpingLocation=/usr/bin/fping + + ### Option: Fping6Location + # Location of fping6. +@@ -622,6 +626,7 @@ Timeout=4 + # Mandatory: no + # Default: + # Fping6Location=/usr/sbin/fping6 ++Fping6Location= + + ### Option: SSHKeyLocation + # Location of public and private keys for SSH checks and actions. +@@ -667,6 +672,7 @@ LogSlowQueries=3000 + # Mandatory: no + # Default: + # User=zabbix ++User=zabbix-proxy + + ### Option: SSLCertLocation + # Location of SSL client certificates. +@@ -1051,3 +1057,4 @@ StatsAllowedIP=127.0.0.1 + # Include=/usr/local/etc/zabbix_proxy.general.conf + # Include=/usr/local/etc/zabbix_proxy.conf.d/ + # Include=/usr/local/etc/zabbix_proxy.conf.d/*.conf ++Include=/etc/zabbix_proxy.conf.d/*.conf