Snarp/zabbix
1
0
Fork 0
Code Issues Pull requests Actions 2 Packages Projects Releases Wiki Activity

added option to get DB username and password from vault

Browse source
This commit is contained in:
zux 2026-03-11 23:38:11 +02:00
parent 1b4c813e09
commit 6bc64be7a0
35 changed files with 973 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Dockerfiles/web-apache-mysql/alpine/Dockerfile
View file

@ -37,6 +37,7 @@ RUN set -eux && \
INSTALL_PKGS="bash \
tzdata \
curl \
jq \
mariadb-client \
mariadb-connector-c \
apache2-proxy \

54
Dockerfiles/web-apache-mysql/alpine/docker-entrypoint.sh
View file

@ -128,6 +128,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -141,9 +174,28 @@ check_db_connect() {
echo "* DB_SERVER_ZBX_PASS: ${DB_SERVER_ZBX_PASS}"
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"
export MYSQL_PWD="${DB_SERVER_ZBX_PASS}"

1
Dockerfiles/web-apache-mysql/centos/Dockerfile
View file

@ -55,6 +55,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
glibc-locale-source \
shadow-utils \
gzip \
jq \
supervisor" && \
microdnf -y install \
--disablerepo "*" \

52
Dockerfiles/web-apache-mysql/centos/docker-entrypoint.sh
View file

@ -128,6 +128,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -144,6 +177,25 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"
export MYSQL_PWD="${DB_SERVER_ZBX_PASS}"

1
Dockerfiles/web-apache-mysql/ol/Dockerfile
View file

@ -55,6 +55,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-xml \
findutils \
glibc-locale-source \
jq \
supervisor" && \
microdnf -y install \
--disablerepo="*" \

52
Dockerfiles/web-apache-mysql/ol/docker-entrypoint.sh
View file

@ -128,6 +128,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -143,6 +176,25 @@ check_db_connect() {
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"

1
Dockerfiles/web-apache-mysql/ubuntu/Dockerfile
View file

@ -55,6 +55,7 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
php8.3-mbstring \
php8.3-mysql \
php8.3-xml \
jq \
supervisor" && \
apt-get -y update && \
DEBIAN_FRONTEND=noninteractive apt-get -y \

52
Dockerfiles/web-apache-mysql/ubuntu/docker-entrypoint.sh
View file

@ -128,6 +128,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -143,6 +176,25 @@ check_db_connect() {
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"

1
Dockerfiles/web-apache-pgsql/alpine/Dockerfile
View file

@ -56,6 +56,7 @@ RUN set -eux && \
php84-xmlwriter \
php84-openssl \
postgresql17-client \
jq \
supervisor" && \
apk add \
--no-cache \

56
Dockerfiles/web-apache-pgsql/alpine/docker-entrypoint.sh
View file

@ -109,6 +109,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -127,12 +160,31 @@ check_db_connect() {
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"
export PGOPTIONS

1
Dockerfiles/web-apache-pgsql/centos/Dockerfile
View file

@ -55,6 +55,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
glibc-locale-source \
shadow-utils \
gzip \
jq \
supervisor" && \
microdnf -y install \
--disablerepo "*" \

56
Dockerfiles/web-apache-pgsql/centos/docker-entrypoint.sh
View file

@ -109,6 +109,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -127,12 +160,31 @@ check_db_connect() {
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"
export PGOPTIONS

1
Dockerfiles/web-apache-pgsql/ol/Dockerfile
View file

@ -55,6 +55,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
postgresql \
findutils \
glibc-locale-source \
jq \
supervisor" && \
microdnf -y install \
--disablerepo="*" \

56
Dockerfiles/web-apache-pgsql/ol/docker-entrypoint.sh
View file

@ -109,6 +109,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -127,12 +160,31 @@ check_db_connect() {
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"
export PGOPTIONS

56
Dockerfiles/web-apache-pgsql/ubuntu/docker-entrypoint.sh
View file

@ -109,6 +109,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -127,12 +160,31 @@ check_db_connect() {
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"
export PGOPTIONS

1
Dockerfiles/web-nginx-mysql/alpine/Dockerfile
View file

@ -57,6 +57,7 @@ RUN set -eux && \
php84-xmlreader \
php84-xmlwriter \
php84-openssl \
jq \
supervisor" && \
apk add \
--no-cache \

52
Dockerfiles/web-nginx-mysql/alpine/docker-entrypoint.sh
View file

@ -134,6 +134,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -150,6 +183,25 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"
export MYSQL_PWD="${DB_SERVER_ZBX_PASS}"

1
Dockerfiles/web-nginx-mysql/centos/Dockerfile
View file

@ -53,6 +53,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
glibc-locale-source \
shadow-utils \
gzip \
jq \
supervisor" && \
microdnf -y install \
--disablerepo "*" \

52
Dockerfiles/web-nginx-mysql/centos/docker-entrypoint.sh
View file

@ -134,6 +134,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -149,6 +182,25 @@ check_db_connect() {
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"

1
Dockerfiles/web-nginx-mysql/ol/Dockerfile
View file

@ -53,6 +53,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-xml \
findutils \
glibc-locale-source \
jq \
supervisor" && \
microdnf -y install \
--disablerepo="*" \

52
Dockerfiles/web-nginx-mysql/ol/docker-entrypoint.sh
View file

@ -134,6 +134,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -150,6 +183,25 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"
export MYSQL_PWD="${DB_SERVER_ZBX_PASS}"

1
Dockerfiles/web-nginx-mysql/rhel/Dockerfile
View file

@ -73,6 +73,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-ldap \
php-mbstring \
php-mysqlnd \
jq \
php-xml" && \
curl --tlsv1.2 -sSf -L https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm -o /tmp/epel-release-latest-10.noarch.rpm && \
rpm -ivh /tmp/epel-release-latest-10.noarch.rpm && \

52
Dockerfiles/web-nginx-mysql/rhel/docker-entrypoint.sh
View file

@ -134,6 +134,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -150,6 +183,25 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"
export MYSQL_PWD="${DB_SERVER_ZBX_PASS}"

1
Dockerfiles/web-nginx-mysql/ubuntu/Dockerfile
View file

@ -54,6 +54,7 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
php8.3-mbstring \
php8.3-mysql \
php8.3-xml \
jq \
supervisor" && \
apt-get -y update && \
DEBIAN_FRONTEND=noninteractive apt-get -y \

52
Dockerfiles/web-nginx-mysql/ubuntu/docker-entrypoint.sh
View file

@ -134,6 +134,39 @@ db_tls_params() {
echo $result
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
echo "* DB_SERVER_HOST: ${DB_SERVER_HOST}"
@ -150,6 +183,25 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
ssl_opts="$(db_tls_params)"
export MYSQL_PWD="${DB_SERVER_ZBX_PASS}"

1
Dockerfiles/web-nginx-pgsql/alpine/Dockerfile
View file

@ -56,6 +56,7 @@ RUN set -eux && \
php84-xmlwriter \
php84-openssl \
postgresql17-client \
jq \
supervisor" && \
apk add \
--no-cache \

56
Dockerfiles/web-nginx-pgsql/alpine/docker-entrypoint.sh
View file

@ -115,6 +115,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -132,12 +165,33 @@ check_db_connect() {
echo "* DB_SERVER_ZBX_PASS: ${DB_SERVER_ZBX_PASS}"
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"

1
Dockerfiles/web-nginx-pgsql/centos/Dockerfile
View file

@ -53,6 +53,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
postgresql \
shadow-utils \
gzip \
jq \
supervisor" && \
microdnf -y install \
--disablerepo "*" \

55
Dockerfiles/web-nginx-pgsql/centos/docker-entrypoint.sh
View file

@ -115,6 +115,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -133,11 +166,31 @@ check_db_connect() {
fi
echo "********************"
WAIT_TIMEOUT=5
iif [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"

1
Dockerfiles/web-nginx-pgsql/ol/Dockerfile
View file

@ -53,6 +53,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-pgsql \
php-xml \
postgresql \
jq \
supervisor" && \
microdnf -y install \
--disablerepo="*" \

55
Dockerfiles/web-nginx-pgsql/ol/docker-entrypoint.sh
View file

@ -115,6 +115,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -133,11 +166,31 @@ check_db_connect() {
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"

1
Dockerfiles/web-nginx-pgsql/rhel/Dockerfile
View file

@ -74,6 +74,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-ldap \
php-mbstring \
php-pgsql \
jq \
php-xml" && \
curl --tlsv1.2 -sSf -L https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm -o /tmp/epel-release-latest-10.noarch.rpm && \
rpm -ivh /tmp/epel-release-latest-10.noarch.rpm && \

55
Dockerfiles/web-nginx-pgsql/rhel/docker-entrypoint.sh
View file

@ -115,6 +115,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -133,11 +166,31 @@ check_db_connect() {
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"

1
Dockerfiles/web-nginx-pgsql/ubuntu/Dockerfile
View file

@ -54,6 +54,7 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
php8.3-xml \
php8.3-pgsql \
postgresql-client-17 \
jq \
supervisor" && \
apt-get -y update && \
DEBIAN_FRONTEND=noninteractive apt-get -y \

55
Dockerfiles/web-nginx-pgsql/ubuntu/docker-entrypoint.sh
View file

@ -115,6 +115,39 @@ check_variables() {
fi
}
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
fi
}
check_db_connect() {
echo "********************"
if [ -n "${DB_SERVER_HOST}" ]; then
@ -133,11 +166,31 @@ check_db_connect() {
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi
WAIT_TIMEOUT=5
if [ "${POSTGRES_USE_IMPLICIT_SEARCH_PATH,,}" == "false" ] && [ -n "${DB_SERVER_SCHEMA}" ]; then
PGOPTIONS="--search_path=${DB_SERVER_SCHEMA}"