Snarp/zabbix
1
0
Fork 0
Code Issues Pull requests Actions 2 Packages Projects Releases Wiki Activity

Prepare to remove supervisord

Browse source
This commit is contained in:
Alexey Pustovalov 2026-04-14 03:03:21 +09:00
parent b8fed86d78
commit 19aae3d4a3
89 changed files with 1503 additions and 4648 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/server-common.inc Normal file
View file

@ -0,0 +1,59 @@
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "^/(ping|status)$">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<DirectoryMatch "^/usr/share/zabbix/(conf|app|include|local|locale|vendor)(/|$)">
Require all denied
<Files "*.php">
Require all denied
</Files>
</DirectoryMatch>
<Directory "/usr/share/zabbix/data">
<Files "top_passwords.txt">
Require all denied
</Files>
</Directory>
<Location "/robots.txt">
Require all granted
</Location>
<LocationMatch "/\.">
Require all denied
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch "\.php$">
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
ExpiresActive On
ExpiresByType image/x-icon "access plus 1 year"
ExpiresByType text/css "access plus 14 days"
ExpiresByType application/javascript "access plus 14 days"
ExpiresByType text/javascript "access plus 14 days"
ExpiresByType image/png "access plus 14 days"
ExpiresByType image/jpeg "access plus 14 days"
ExpiresByType image/gif "access plus 14 days"
ExpiresByType text/plain "access plus 14 days"
ExpiresByType application/xml "access plus 14 days"
ExpiresByType image/svg+xml "access plus 14 days"
ExpiresByType font/woff "access plus 30 days"
ExpiresByType font/woff2 "access plus 30 days"
ExpiresByType font/ttf "access plus 30 days"
ExpiresByType font/otf "access plus 30 days"
<FilesMatch "\.(ico|js|css|png|jpg|jpeg|gif|xml|txt|svg|woff|woff2|ttf|otf)$">
Header append Cache-Control "public"
</FilesMatch>
</Directory>

73
Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache.conf
View file

@ -1,76 +1,5 @@
Listen 8080
<VirtualHost *:8080>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/httpd/conf.d/server-common.inc
</VirtualHost>

99
Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache_ssl.conf
View file

@ -1,7 +1,7 @@
LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
Listen 8443
Listen 8443 https
SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
@ -9,100 +9,21 @@ SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512
AddType application/x-x509-ca-cert .crt
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
<VirtualHost *:8443>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
# Enable/Disable SSL for this virtual host.
SSLEngine on
# intermediate configuration
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLCertificateFile /etc/ssl/apache2/ssl.crt
SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
# SSLCACertificatePath /etc/ssl/apache2/chain/
# enable HTTP/2, if available
Protocols h2 http/1.1
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
Header always set Strict-Transport-Security "max-age=63072000"
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/httpd/conf.d/server-common.inc
</VirtualHost>

27
Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

59
Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/server-common.inc Normal file
View file

@ -0,0 +1,59 @@
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "^/(ping|status)$">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<DirectoryMatch "^/usr/share/zabbix/(conf|app|include|local|locale|vendor)(/|$)">
Require all denied
<Files "*.php">
Require all denied
</Files>
</DirectoryMatch>
<Directory "/usr/share/zabbix/data">
<Files "top_passwords.txt">
Require all denied
</Files>
</Directory>
<Location "/robots.txt">
Require all granted
</Location>
<LocationMatch "/\.">
Require all denied
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch "\.php$">
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
ExpiresActive On
ExpiresByType image/x-icon "access plus 1 year"
ExpiresByType text/css "access plus 14 days"
ExpiresByType application/javascript "access plus 14 days"
ExpiresByType text/javascript "access plus 14 days"
ExpiresByType image/png "access plus 14 days"
ExpiresByType image/jpeg "access plus 14 days"
ExpiresByType image/gif "access plus 14 days"
ExpiresByType text/plain "access plus 14 days"
ExpiresByType application/xml "access plus 14 days"
ExpiresByType image/svg+xml "access plus 14 days"
ExpiresByType font/woff "access plus 30 days"
ExpiresByType font/woff2 "access plus 30 days"
ExpiresByType font/ttf "access plus 30 days"
ExpiresByType font/otf "access plus 30 days"
<FilesMatch "\.(ico|js|css|png|jpg|jpeg|gif|xml|txt|svg|woff|woff2|ttf|otf)$">
Header append Cache-Control "public"
</FilesMatch>
</Directory>

73
Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache.conf
View file

@ -1,76 +1,5 @@
Listen 8080
<VirtualHost *:8080>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/httpd/conf.d/server-common.inc
</VirtualHost>

99
Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache_ssl.conf
View file

@ -1,7 +1,7 @@
LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
Listen 8443
Listen 8443 https
SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
@ -9,100 +9,21 @@ SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512
AddType application/x-x509-ca-cert .crt
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
<VirtualHost *:8443>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
# Enable/Disable SSL for this virtual host.
SSLEngine on
# intermediate configuration
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLCertificateFile /etc/ssl/apache2/ssl.crt
SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
# SSLCACertificatePath /etc/ssl/apache2/chain/
# enable HTTP/2, if available
Protocols h2 http/1.1
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
Header always set Strict-Transport-Security "max-age=63072000"
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/httpd/conf.d/server-common.inc
</VirtualHost>

27
Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

59
Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/includes/server-common.inc Normal file
View file

@ -0,0 +1,59 @@
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "^/(ping|status)$">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<DirectoryMatch "^/usr/share/zabbix/(conf|app|include|local|locale|vendor)(/|$)">
Require all denied
<Files "*.php">
Require all denied
</Files>
</DirectoryMatch>
<Directory "/usr/share/zabbix/data">
<Files "top_passwords.txt">
Require all denied
</Files>
</Directory>
<Location "/robots.txt">
Require all granted
</Location>
<LocationMatch "/\.">
Require all denied
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch "\.php$">
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
ExpiresActive On
ExpiresByType image/x-icon "access plus 1 year"
ExpiresByType text/css "access plus 14 days"
ExpiresByType application/javascript "access plus 14 days"
ExpiresByType text/javascript "access plus 14 days"
ExpiresByType image/png "access plus 14 days"
ExpiresByType image/jpeg "access plus 14 days"
ExpiresByType image/gif "access plus 14 days"
ExpiresByType text/plain "access plus 14 days"
ExpiresByType application/xml "access plus 14 days"
ExpiresByType image/svg+xml "access plus 14 days"
ExpiresByType font/woff "access plus 30 days"
ExpiresByType font/woff2 "access plus 30 days"
ExpiresByType font/ttf "access plus 30 days"
ExpiresByType font/otf "access plus 30 days"
<FilesMatch "\.(ico|js|css|png|jpg|jpeg|gif|xml|txt|svg|woff|woff2|ttf|otf)$">
Header append Cache-Control "public"
</FilesMatch>
</Directory>

73
Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache.conf
View file

@ -1,76 +1,5 @@
Listen 8080
<VirtualHost *:8080>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/apache2/includes/server-common.inc
</VirtualHost>

99
Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_ssl.conf
View file

@ -1,7 +1,7 @@
LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
Listen 8443
Listen 8443 https
SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
@ -9,100 +9,21 @@ SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512
AddType application/x-x509-ca-cert .crt
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
<VirtualHost *:8443>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
# Enable/Disable SSL for this virtual host.
SSLEngine on
# intermediate configuration
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLCertificateFile /etc/ssl/apache2/ssl.crt
SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
# SSLCACertificatePath /etc/ssl/apache2/chain/
# enable HTTP/2, if available
Protocols h2 http/1.1
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
Header always set Strict-Transport-Security "max-age=63072000"
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/apache2/includes/server-common.inc
</VirtualHost>

27
Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

59
Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/server-common.inc Normal file
View file

@ -0,0 +1,59 @@
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "^/(ping|status)$">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<DirectoryMatch "^/usr/share/zabbix/(conf|app|include|local|locale|vendor)(/|$)">
Require all denied
<Files "*.php">
Require all denied
</Files>
</DirectoryMatch>
<Directory "/usr/share/zabbix/data">
<Files "top_passwords.txt">
Require all denied
</Files>
</Directory>
<Location "/robots.txt">
Require all granted
</Location>
<LocationMatch "/\.">
Require all denied
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch "\.php$">
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
ExpiresActive On
ExpiresByType image/x-icon "access plus 1 year"
ExpiresByType text/css "access plus 14 days"
ExpiresByType application/javascript "access plus 14 days"
ExpiresByType text/javascript "access plus 14 days"
ExpiresByType image/png "access plus 14 days"
ExpiresByType image/jpeg "access plus 14 days"
ExpiresByType image/gif "access plus 14 days"
ExpiresByType text/plain "access plus 14 days"
ExpiresByType application/xml "access plus 14 days"
ExpiresByType image/svg+xml "access plus 14 days"
ExpiresByType font/woff "access plus 30 days"
ExpiresByType font/woff2 "access plus 30 days"
ExpiresByType font/ttf "access plus 30 days"
ExpiresByType font/otf "access plus 30 days"
<FilesMatch "\.(ico|js|css|png|jpg|jpeg|gif|xml|txt|svg|woff|woff2|ttf|otf)$">
Header append Cache-Control "public"
</FilesMatch>
</Directory>

73
Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache.conf
View file

@ -1,76 +1,5 @@
Listen 8080
<VirtualHost *:8080>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/httpd/conf.d/server-common.inc
</VirtualHost>

99
Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache_ssl.conf
View file

@ -1,7 +1,7 @@
LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
Listen 8443
Listen 8443 https
SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
@ -9,100 +9,21 @@ SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512
AddType application/x-x509-ca-cert .crt
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
<VirtualHost *:8443>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
# Enable/Disable SSL for this virtual host.
SSLEngine on
# intermediate configuration
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLCertificateFile /etc/ssl/apache2/ssl.crt
SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
# SSLCACertificatePath /etc/ssl/apache2/chain/
# enable HTTP/2, if available
Protocols h2 http/1.1
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
Header always set Strict-Transport-Security "max-age=63072000"
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/httpd/conf.d/server-common.inc
</VirtualHost>

27
Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

59
Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/server-common.inc Normal file
View file

@ -0,0 +1,59 @@
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "^/(ping|status)$">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<DirectoryMatch "^/usr/share/zabbix/(conf|app|include|local|locale|vendor)(/|$)">
Require all denied
<Files "*.php">
Require all denied
</Files>
</DirectoryMatch>
<Directory "/usr/share/zabbix/data">
<Files "top_passwords.txt">
Require all denied
</Files>
</Directory>
<Location "/robots.txt">
Require all granted
</Location>
<LocationMatch "/\.">
Require all denied
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch "\.php$">
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
ExpiresActive On
ExpiresByType image/x-icon "access plus 1 year"
ExpiresByType text/css "access plus 14 days"
ExpiresByType application/javascript "access plus 14 days"
ExpiresByType text/javascript "access plus 14 days"
ExpiresByType image/png "access plus 14 days"
ExpiresByType image/jpeg "access plus 14 days"
ExpiresByType image/gif "access plus 14 days"
ExpiresByType text/plain "access plus 14 days"
ExpiresByType application/xml "access plus 14 days"
ExpiresByType image/svg+xml "access plus 14 days"
ExpiresByType font/woff "access plus 30 days"
ExpiresByType font/woff2 "access plus 30 days"
ExpiresByType font/ttf "access plus 30 days"
ExpiresByType font/otf "access plus 30 days"
<FilesMatch "\.(ico|js|css|png|jpg|jpeg|gif|xml|txt|svg|woff|woff2|ttf|otf)$">
Header append Cache-Control "public"
</FilesMatch>
</Directory>

73
Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache.conf
View file

@ -1,76 +1,5 @@
Listen 8080
<VirtualHost *:8080>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/httpd/conf.d/server-common.inc
</VirtualHost>

99
Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache_ssl.conf
View file

@ -1,7 +1,7 @@
LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
Listen 8443
Listen 8443 https
SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
@ -9,100 +9,21 @@ SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512
AddType application/x-x509-ca-cert .crt
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
<VirtualHost *:8443>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
# Enable/Disable SSL for this virtual host.
SSLEngine on
# intermediate configuration
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLCertificateFile /etc/ssl/apache2/ssl.crt
SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
# SSLCACertificatePath /etc/ssl/apache2/chain/
# enable HTTP/2, if available
Protocols h2 http/1.1
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
Header always set Strict-Transport-Security "max-age=63072000"
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/httpd/conf.d/server-common.inc
</VirtualHost>

27
Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

59
Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/includes/server-common.inc Normal file
View file

@ -0,0 +1,59 @@
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "^/(ping|status)$">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<DirectoryMatch "^/usr/share/zabbix/(conf|app|include|local|locale|vendor)(/|$)">
Require all denied
<Files "*.php">
Require all denied
</Files>
</DirectoryMatch>
<Directory "/usr/share/zabbix/data">
<Files "top_passwords.txt">
Require all denied
</Files>
</Directory>
<Location "/robots.txt">
Require all granted
</Location>
<LocationMatch "/\.">
Require all denied
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch "\.php$">
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
ExpiresActive On
ExpiresByType image/x-icon "access plus 1 year"
ExpiresByType text/css "access plus 14 days"
ExpiresByType application/javascript "access plus 14 days"
ExpiresByType text/javascript "access plus 14 days"
ExpiresByType image/png "access plus 14 days"
ExpiresByType image/jpeg "access plus 14 days"
ExpiresByType image/gif "access plus 14 days"
ExpiresByType text/plain "access plus 14 days"
ExpiresByType application/xml "access plus 14 days"
ExpiresByType image/svg+xml "access plus 14 days"
ExpiresByType font/woff "access plus 30 days"
ExpiresByType font/woff2 "access plus 30 days"
ExpiresByType font/ttf "access plus 30 days"
ExpiresByType font/otf "access plus 30 days"
<FilesMatch "\.(ico|js|css|png|jpg|jpeg|gif|xml|txt|svg|woff|woff2|ttf|otf)$">
Header append Cache-Control "public"
</FilesMatch>
</Directory>

73
Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache.conf
View file

@ -1,76 +1,5 @@
Listen 8080
<VirtualHost *:8080>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/apache2/includes/server-common.inc
</VirtualHost>

4
Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache_envvars
View file

@ -1,4 +0,0 @@
export APACHE_RUN_USER=$(id -n -u)
export APACHE_RUN_GROUP=www-data
export APACHE_PID_FILE=/tmp/apache2.pid
export APACHE_RUN_DIR=/tmp/apache2

99
Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache_ssl.conf
View file

@ -1,7 +1,7 @@
LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
Listen 8443
Listen 8443 https
SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
@ -9,100 +9,21 @@ SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512
AddType application/x-x509-ca-cert .crt
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
SSLSessionCacheTimeout 300
<VirtualHost *:8443>
RemoteIPInternalProxy ${WEB_REAL_IP_FROM}
RemoteIPHeader ${WEB_REAL_IP_HEADER}
# Enable/Disable SSL for this virtual host.
SSLEngine on
# intermediate configuration
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
SSLSessionTickets off
SSLCertificateFile /etc/ssl/apache2/ssl.crt
SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
# SSLCACertificatePath /etc/ssl/apache2/chain/
# enable HTTP/2, if available
Protocols h2 http/1.1
# HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
Header always set Strict-Transport-Security "max-age=63072000"
<LocationMatch "/(ping|status)">
Require all granted
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</LocationMatch>
<Directory "/usr/share/zabbix">
Options FollowSymLinks
AllowOverride None
Require all granted
<FilesMatch \.php$>
SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
</FilesMatch>
<filesMatch "\.(ico)$">
ExpiresActive On
ExpiresDefault "access plus 1 year"
Header append Cache-Control "public"
</filesMatch>
<filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
ExpiresActive On
ExpiresDefault "access plus 14 day"
Header append Cache-Control "public"
</filesMatch>
</Directory>
<Directory "/usr/share/zabbix/conf">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/app">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/include">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/local">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/locale">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
<Directory "/usr/share/zabbix/vendor">
Require all denied
<files *.php>
Require all denied
</files>
</Directory>
Include /etc/apache2/includes/server-common.inc
</VirtualHost>

27
Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

105
Dockerfiles/web-nginx-mysql/centos/conf/etc/nginx/includes/server-common.conf Normal file
View file

@ -0,0 +1,105 @@
server_name zabbix;
index {HTTP_INDEX_FILE};
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
access_log off;
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt|svg)$ {
expires 14d;
}
location ~* \.(woff|woff2|ttf|otf)$ {
access_log off;
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /data/top_passwords.txt {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}

17
Dockerfiles/web-nginx-mysql/centos/conf/etc/nginx/includes/server-ssl.conf Normal file
View file

@ -0,0 +1,17 @@
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

8
Dockerfiles/web-nginx-mysql/centos/conf/etc/nginx/nginx.conf
View file

@ -1,4 +1,5 @@
# user nginx;
include /etc/nginx/includes/user.conf;
worker_processes 5;
worker_rlimit_nofile 256000;
@ -11,7 +12,6 @@ events {
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
@ -20,7 +20,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log error;
client_body_temp_path /tmp/client_body 1 2;
@ -54,7 +54,7 @@ http {
sendfile on;
client_max_body_size 8m;
client_body_buffer_size 256k;
client_body_buffer_size 256k;
fastcgi_intercept_errors on;
tcp_nopush on;

101
Dockerfiles/web-nginx-mysql/centos/conf/etc/zabbix/nginx.conf
View file

@ -1,102 +1,7 @@
server {
listen 8080;
listen [::]:8080;
include /etc/nginx/includes/listen-ipv6.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
server_name zabbix;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-common.conf;
}

114
Dockerfiles/web-nginx-mysql/centos/conf/etc/zabbix/nginx_ssl.conf
View file

@ -1,112 +1,10 @@
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
listen 8443 ssl;
include /etc/nginx/includes/listen-ipv6-ssl.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
http2 on;
server_name zabbix;
server_name_in_redirect off;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log error;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-ssl.conf;
include /etc/nginx/includes/server-common.conf;
}

27
Dockerfiles/web-nginx-mysql/centos/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-nginx-mysql/centos/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

105
Dockerfiles/web-nginx-mysql/ol/conf/etc/nginx/includes/server-common.conf Normal file
View file

@ -0,0 +1,105 @@
server_name zabbix;
index {HTTP_INDEX_FILE};
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
access_log off;
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt|svg)$ {
expires 14d;
}
location ~* \.(woff|woff2|ttf|otf)$ {
access_log off;
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /data/top_passwords.txt {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}

17
Dockerfiles/web-nginx-mysql/ol/conf/etc/nginx/includes/server-ssl.conf Normal file
View file

@ -0,0 +1,17 @@
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

8
Dockerfiles/web-nginx-mysql/ol/conf/etc/nginx/nginx.conf
View file

@ -1,4 +1,5 @@
# user nginx;
include /etc/nginx/includes/user.conf;
worker_processes 5;
worker_rlimit_nofile 256000;
@ -11,7 +12,6 @@ events {
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
@ -20,7 +20,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log error;
client_body_temp_path /tmp/client_body 1 2;
@ -54,7 +54,7 @@ http {
sendfile on;
client_max_body_size 8m;
client_body_buffer_size 256k;
client_body_buffer_size 256k;
fastcgi_intercept_errors on;
tcp_nopush on;

101
Dockerfiles/web-nginx-mysql/ol/conf/etc/zabbix/nginx.conf
View file

@ -1,102 +1,7 @@
server {
listen 8080;
listen [::]:8080;
include /etc/nginx/includes/listen-ipv6.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
server_name zabbix;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-common.conf;
}

114
Dockerfiles/web-nginx-mysql/ol/conf/etc/zabbix/nginx_ssl.conf
View file

@ -1,112 +1,10 @@
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
listen 8443 ssl;
include /etc/nginx/includes/listen-ipv6-ssl.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
http2 on;
server_name zabbix;
server_name_in_redirect off;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log error;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-ssl.conf;
include /etc/nginx/includes/server-common.conf;
}

27
Dockerfiles/web-nginx-mysql/ol/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-nginx-mysql/ol/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

105
Dockerfiles/web-nginx-mysql/rhel/conf/etc/nginx/includes/server-common.conf Normal file
View file

@ -0,0 +1,105 @@
server_name zabbix;
index {HTTP_INDEX_FILE};
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
access_log off;
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt|svg)$ {
expires 14d;
}
location ~* \.(woff|woff2|ttf|otf)$ {
access_log off;
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /data/top_passwords.txt {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}

17
Dockerfiles/web-nginx-mysql/rhel/conf/etc/nginx/includes/server-ssl.conf Normal file
View file

@ -0,0 +1,17 @@
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

8
Dockerfiles/web-nginx-mysql/rhel/conf/etc/nginx/nginx.conf
View file

@ -1,4 +1,5 @@
# user nginx;
include /etc/nginx/includes/user.conf;
worker_processes 5;
worker_rlimit_nofile 256000;
@ -11,7 +12,6 @@ events {
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
@ -20,7 +20,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log error;
client_body_temp_path /tmp/client_body 1 2;
@ -54,7 +54,7 @@ http {
sendfile on;
client_max_body_size 8m;
client_body_buffer_size 256k;
client_body_buffer_size 256k;
fastcgi_intercept_errors on;
tcp_nopush on;

7
Dockerfiles/web-nginx-mysql/rhel/conf/etc/yum.repo.d/nginx.repo
View file

@ -1,7 +0,0 @@
[nginx-stable]
name=nginx stable repo
baseurl=https://nginx.org/packages/rhel/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

101
Dockerfiles/web-nginx-mysql/rhel/conf/etc/zabbix/nginx.conf
View file

@ -1,102 +1,7 @@
server {
listen 8080;
listen [::]:8080;
include /etc/nginx/includes/listen-ipv6.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
server_name zabbix;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-common.conf;
}

114
Dockerfiles/web-nginx-mysql/rhel/conf/etc/zabbix/nginx_ssl.conf
View file

@ -1,112 +1,10 @@
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
listen 8443 ssl;
include /etc/nginx/includes/listen-ipv6-ssl.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
http2 on;
server_name zabbix;
server_name_in_redirect off;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log error;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-ssl.conf;
include /etc/nginx/includes/server-common.conf;
}

27
Dockerfiles/web-nginx-mysql/rhel/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-nginx-mysql/rhel/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

105
Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/nginx/includes/server-common.conf Normal file
View file

@ -0,0 +1,105 @@
server_name zabbix;
index {HTTP_INDEX_FILE};
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
access_log off;
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt|svg)$ {
expires 14d;
}
location ~* \.(woff|woff2|ttf|otf)$ {
access_log off;
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /data/top_passwords.txt {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}

17
Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/nginx/includes/server-ssl.conf Normal file
View file

@ -0,0 +1,17 @@
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

10
Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/nginx/nginx.conf
View file

@ -1,4 +1,5 @@
# user www-data;
include /etc/nginx/includes/user.conf;
worker_processes 5;
worker_rlimit_nofile 256000;
@ -11,7 +12,6 @@ events {
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
@ -20,7 +20,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log error;
client_body_temp_path /tmp/client_body 1 2;
@ -49,12 +49,12 @@ http {
output_buffers 128 512k;
postpone_output 1460;
#aio on;
aio on;
directio 512;
sendfile on;
client_max_body_size 8m;
client_body_buffer_size 256k;
client_body_buffer_size 256k;
fastcgi_intercept_errors on;
tcp_nopush on;

101
Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/zabbix/nginx.conf
View file

@ -1,102 +1,7 @@
server {
listen 8080;
listen [::]:8080;
include /etc/nginx/includes/listen-ipv6.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
server_name zabbix;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-common.conf;
}

114
Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/zabbix/nginx_ssl.conf
View file

@ -1,112 +1,10 @@
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
listen 8443 ssl;
include /etc/nginx/includes/listen-ipv6-ssl.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
http2 on;
server_name zabbix;
server_name_in_redirect off;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log error;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-ssl.conf;
include /etc/nginx/includes/server-common.conf;
}

27
Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

2
Dockerfiles/web-nginx-pgsql/alpine/conf/etc/nginx/includes/server-common.conf
View file

@ -43,7 +43,7 @@ location ~* \.(woff|woff2|ttf|otf)$ {
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
location ~ ^/(app/|conf/|include/|local/|locale/|vendor/) {
deny all;
return 404;
}

105
Dockerfiles/web-nginx-pgsql/centos/conf/etc/nginx/includes/server-common.conf Normal file
View file

@ -0,0 +1,105 @@
server_name zabbix;
index {HTTP_INDEX_FILE};
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
access_log off;
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt|svg)$ {
expires 14d;
}
location ~* \.(woff|woff2|ttf|otf)$ {
access_log off;
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /data/top_passwords.txt {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}

17
Dockerfiles/web-nginx-pgsql/centos/conf/etc/nginx/includes/server-ssl.conf Normal file
View file

@ -0,0 +1,17 @@
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

8
Dockerfiles/web-nginx-pgsql/centos/conf/etc/nginx/nginx.conf
View file

@ -1,4 +1,5 @@
# user nginx;
include /etc/nginx/includes/user.conf;
worker_processes 5;
worker_rlimit_nofile 256000;
@ -11,7 +12,6 @@ events {
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
@ -20,7 +20,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log error;
client_body_temp_path /tmp/client_body 1 2;
@ -54,7 +54,7 @@ http {
sendfile on;
client_max_body_size 8m;
client_body_buffer_size 256k;
client_body_buffer_size 256k;
fastcgi_intercept_errors on;
tcp_nopush on;

101
Dockerfiles/web-nginx-pgsql/centos/conf/etc/zabbix/nginx.conf
View file

@ -1,102 +1,7 @@
server {
listen 8080;
listen [::]:8080;
include /etc/nginx/includes/listen-ipv6.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
server_name zabbix;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-common.conf;
}

114
Dockerfiles/web-nginx-pgsql/centos/conf/etc/zabbix/nginx_ssl.conf
View file

@ -1,112 +1,10 @@
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
listen 8443 ssl;
include /etc/nginx/includes/listen-ipv6-ssl.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
http2 on;
server_name zabbix;
server_name_in_redirect off;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log error;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-ssl.conf;
include /etc/nginx/includes/server-common.conf;
}

27
Dockerfiles/web-nginx-pgsql/centos/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-nginx-pgsql/centos/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

105
Dockerfiles/web-nginx-pgsql/ol/conf/etc/nginx/includes/server-common.conf Normal file
View file

@ -0,0 +1,105 @@
server_name zabbix;
index {HTTP_INDEX_FILE};
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
access_log off;
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt|svg)$ {
expires 14d;
}
location ~* \.(woff|woff2|ttf|otf)$ {
access_log off;
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /data/top_passwords.txt {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}

17
Dockerfiles/web-nginx-pgsql/ol/conf/etc/nginx/includes/server-ssl.conf Normal file
View file

@ -0,0 +1,17 @@
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

8
Dockerfiles/web-nginx-pgsql/ol/conf/etc/nginx/nginx.conf
View file

@ -1,4 +1,5 @@
# user nginx;
include /etc/nginx/includes/user.conf;
worker_processes 5;
worker_rlimit_nofile 256000;
@ -11,7 +12,6 @@ events {
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
@ -20,7 +20,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log error;
client_body_temp_path /tmp/client_body 1 2;
@ -54,7 +54,7 @@ http {
sendfile on;
client_max_body_size 8m;
client_body_buffer_size 256k;
client_body_buffer_size 256k;
fastcgi_intercept_errors on;
tcp_nopush on;

101
Dockerfiles/web-nginx-pgsql/ol/conf/etc/zabbix/nginx.conf
View file

@ -1,102 +1,7 @@
server {
listen 8080;
listen [::]:8080;
include /etc/nginx/includes/listen-ipv6.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
server_name zabbix;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-common.conf;
}

114
Dockerfiles/web-nginx-pgsql/ol/conf/etc/zabbix/nginx_ssl.conf
View file

@ -1,112 +1,10 @@
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
listen 8443 ssl;
include /etc/nginx/includes/listen-ipv6-ssl.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
http2 on;
server_name zabbix;
server_name_in_redirect off;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log error;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-ssl.conf;
include /etc/nginx/includes/server-common.conf;
}

27
Dockerfiles/web-nginx-pgsql/ol/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-nginx-pgsql/ol/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

105
Dockerfiles/web-nginx-pgsql/rhel/conf/etc/nginx/includes/server-common.conf Normal file
View file

@ -0,0 +1,105 @@
server_name zabbix;
index {HTTP_INDEX_FILE};
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
access_log off;
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt|svg)$ {
expires 14d;
}
location ~* \.(woff|woff2|ttf|otf)$ {
access_log off;
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /data/top_passwords.txt {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}

17
Dockerfiles/web-nginx-pgsql/rhel/conf/etc/nginx/includes/server-ssl.conf Normal file
View file

@ -0,0 +1,17 @@
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

8
Dockerfiles/web-nginx-pgsql/rhel/conf/etc/nginx/nginx.conf
View file

@ -1,4 +1,5 @@
# user nginx;
include /etc/nginx/includes/user.conf;
worker_processes 5;
worker_rlimit_nofile 256000;
@ -11,7 +12,6 @@ events {
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
@ -20,7 +20,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log error;
client_body_temp_path /tmp/client_body 1 2;
@ -54,7 +54,7 @@ http {
sendfile on;
client_max_body_size 8m;
client_body_buffer_size 256k;
client_body_buffer_size 256k;
fastcgi_intercept_errors on;
tcp_nopush on;

101
Dockerfiles/web-nginx-pgsql/rhel/conf/etc/zabbix/nginx.conf
View file

@ -1,102 +1,7 @@
server {
listen 8080;
listen [::]:8080;
include /etc/nginx/includes/listen-ipv6.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
server_name zabbix;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-common.conf;
}

114
Dockerfiles/web-nginx-pgsql/rhel/conf/etc/zabbix/nginx_ssl.conf
View file

@ -1,112 +1,10 @@
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
listen 8443 ssl;
include /etc/nginx/includes/listen-ipv6-ssl.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
http2 on;
server_name zabbix;
server_name_in_redirect off;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log error;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-ssl.conf;
include /etc/nginx/includes/server-common.conf;
}

27
Dockerfiles/web-nginx-pgsql/rhel/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-nginx-pgsql/rhel/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');

105
Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/nginx/includes/server-common.conf Normal file
View file

@ -0,0 +1,105 @@
server_name zabbix;
index {HTTP_INDEX_FILE};
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
access_log off;
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt|svg)$ {
expires 14d;
}
location ~* \.(woff|woff2|ttf|otf)$ {
access_log off;
expires 30d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /data/top_passwords.txt {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}

17
Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/nginx/includes/server-ssl.conf Normal file
View file

@ -0,0 +1,17 @@
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

10
Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/nginx/nginx.conf
View file

@ -1,4 +1,5 @@
# user www-data;
include /etc/nginx/includes/user.conf;
worker_processes 5;
worker_rlimit_nofile 256000;
@ -11,7 +12,6 @@ events {
use epoll;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
@ -20,7 +20,7 @@ http {
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
include /etc/nginx/includes/access-log.conf;
error_log /var/log/nginx/error.log error;
client_body_temp_path /tmp/client_body 1 2;
@ -49,12 +49,12 @@ http {
output_buffers 128 512k;
postpone_output 1460;
#aio on;
aio on;
directio 512;
sendfile on;
client_max_body_size 8m;
client_body_buffer_size 256k;
client_body_buffer_size 256k;
fastcgi_intercept_errors on;
tcp_nopush on;

101
Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/zabbix/nginx.conf
View file

@ -1,102 +1,7 @@
server {
listen 8080;
listen [::]:8080;
include /etc/nginx/includes/listen-ipv6.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
server_name zabbix;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log notice;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location = /nginx-status {
access_log off;
allow 127.0.0.1;
allow ::1;
deny all;
stub_status;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-common.conf;
}

114
Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/zabbix/nginx_ssl.conf
View file

@ -1,112 +1,10 @@
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
listen 8443 ssl;
include /etc/nginx/includes/listen-ipv6-ssl.conf;
{WEB_REAL_IP_FROM}
{WEB_REAL_IP_HEADER}
http2 on;
server_name zabbix;
server_name_in_redirect off;
index {HTTP_INDEX_FILE};
access_log /var/log/nginx/access.log main;
error_log /var/log/nginx/error.log error;
set $webroot '/usr/share/zabbix';
root $webroot;
large_client_header_buffers 8 8k;
client_max_body_size 10M;
ssl_certificate /etc/ssl/nginx/ssl.crt;
ssl_certificate_key /etc/ssl/nginx/ssl.key;
ssl_dhparam /etc/ssl/nginx/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;
ssl_session_tickets off;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
add_header Strict-Transport-Security "max-age=63072000" always;
add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";
location = /favicon.ico {
log_not_found off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# caching of files
location ~* \.ico$ {
expires 1y;
}
location ~* \.(js|css|png|jpg|jpeg|gif|xml|txt)$ {
expires 14d;
}
location ~ /(app\/|conf[^\.]|include\/|local\/|locale\/|vendor\/) {
deny all;
return 404;
}
location ~ ^/(status|ping)$ {
access_log off;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
include fastcgi_params;
}
location / {
try_files $uri $uri/ =404;
}
location ~ [^/]\.php(/|$) {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_pass unix:/tmp/php-fpm.sock;
fastcgi_index {HTTP_INDEX_FILE};
fastcgi_param DOCUMENT_ROOT $webroot;
fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $webroot$fastcgi_script_name;
fastcgi_param PATH_INFO $path_info;
include fastcgi_params;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_intercept_errors on;
fastcgi_ignore_client_abort off;
fastcgi_connect_timeout 60;
fastcgi_send_timeout 180;
fastcgi_read_timeout {FCGI_READ_TIMEOUT};
fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
}
include /etc/nginx/includes/real-ip.conf;
include /etc/nginx/includes/server-ssl.conf;
include /etc/nginx/includes/server-common.conf;
}

27
Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/zabbix/web/maintenance.inc.php
View file

@ -1,27 +0,0 @@
<?php
/*
** Copyright (C) 2001-2025 Zabbix SIA
**
** This program is free software: you can redistribute it and/or modify it under the terms of
** the GNU Affero General Public License as published by the Free Software Foundation, version 3.
**
** This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
** without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU Affero General Public License for more details.
**
** You should have received a copy of the GNU Affero General Public License along with this program.
** If not, see <https://www.gnu.org/licenses/>.
**/
// Maintenance mode.
if (getenv('ZBX_DENY_GUI_ACCESS') == 'true') {
define('ZBX_DENY_GUI_ACCESS', 1);
// Array of IP addresses, which are allowed to connect to frontend (optional).
$ip_range = str_replace("'","\"",getenv('ZBX_GUI_ACCESS_IP_RANGE'));
$ZBX_GUI_ACCESS_IP_RANGE = (json_decode($ip_range)) ? json_decode($ip_range, true) : array();
// Message shown on warning screen (optional).
$ZBX_GUI_ACCESS_MESSAGE = getenv('ZBX_GUI_WARNING_MSG');
}

115
Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/zabbix/web/zabbix.conf.php
View file

@ -1,115 +0,0 @@
<?php
// Zabbix GUI configuration file.
global $DB, $HISTORY;
$DB['TYPE'] = getenv('DB_SERVER_TYPE');
$DB['SERVER'] = getenv('DB_SERVER_HOST');
$DB['PORT'] = getenv('DB_SERVER_PORT');
$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
$DB['USER'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
// Schema name. Used for PostgreSQL.
$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
if (getenv('ZBX_SERVER_HOST')) {
$ZBX_SERVER = getenv('ZBX_SERVER_HOST');
$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
}
$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
// Used for TLS connection.
$DB['ENCRYPTION'] = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
$DB['KEY_FILE'] = getenv('ZBX_DB_KEY_FILE');
$DB['CERT_FILE'] = getenv('ZBX_DB_CERT_FILE');
$DB['CA_FILE'] = getenv('ZBX_DB_CA_FILE');
$DB['VERIFY_HOST'] = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
$DB['CIPHER_LIST'] = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
// Vault configuration. Used if database credentials are stored in Vault secrets manager.
$DB['VAULT'] = getenv('ZBX_VAULT');
$DB['VAULT_URL'] = getenv('ZBX_VAULTURL');
$DB['VAULT_PREFIX'] = getenv('ZBX_VAULTPREFIX');
$DB['VAULT_DB_PATH'] = getenv('ZBX_VAULTDBPATH');
$DB['VAULT_TOKEN'] = getenv('VAULT_TOKEN');
if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
$DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
}
elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
$DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
}
else {
$DB['VAULT_CERT_FILE'] = '';
}
if (file_exists('/etc/zabbix/web/certs/vault.key')) {
$DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
}
elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
$DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
}
else {
$DB['VAULT_KEY_FILE'] = '';
}
$DB['VAULT_CACHE'] = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
// This option is enabled by default for new Zabbix installations.
// For upgraded installations, please read database upgrade notes before enabling this option.
$DB['DOUBLE_IEEE754'] = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
// Elasticsearch url (can be string if same url is used for all types).
$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
$HISTORY['url'] = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
// Value types stored in Elasticsearch.
$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
// Used for SAML authentication.
if (file_exists('/etc/zabbix/web/certs/sp.key')) {
$SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
}
elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
$SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
}
else {
$SSO['SP_KEY'] = '';
}
if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
$SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
$SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
}
else {
$SSO['SP_CERT'] = '';
}
if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
$SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
}
elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
$SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
}
else {
$SSO['IDP_CERT'] = '';
}
$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');