Snarp/zabbix
1
0
Fork 0
Code Issues Pull requests Actions 2 Packages Projects Releases Wiki Activity

fixed identation, shortened lines, better error handling

Browse source
This commit is contained in:
zux500 2026-03-25 16:45:19 +02:00
parent dd398c584b
commit 7b490f1af6
30 changed files with 820 additions and 658 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

89
Dockerfiles/web-apache-mysql/alpine/docker-entrypoint.sh
View file

@ -130,35 +130,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -174,26 +193,16 @@ check_db_connect() {
echo "* DB_SERVER_ZBX_PASS: ${DB_SERVER_ZBX_PASS}"
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

79
Dockerfiles/web-apache-mysql/centos/docker-entrypoint.sh
View file

@ -130,35 +130,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -177,23 +196,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

81
Dockerfiles/web-apache-mysql/ol/docker-entrypoint.sh
View file

@ -130,35 +130,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -176,24 +195,14 @@ check_db_connect() {
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

81
Dockerfiles/web-apache-mysql/ubuntu/docker-entrypoint.sh
View file

@ -130,35 +130,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -176,24 +195,14 @@ check_db_connect() {
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

2
Dockerfiles/web-apache-pgsql/alpine/Dockerfile
View file

@ -70,7 +70,7 @@ RUN set -eux && \
php84-xmlwriter \
php84-openssl \
postgresql17-client \
jq \
jq \
supervisor" && \
apk add \
--no-cache \

87
Dockerfiles/web-apache-pgsql/alpine/docker-entrypoint.sh
View file

@ -111,35 +111,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -162,23 +181,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then

79
Dockerfiles/web-apache-pgsql/centos/docker-entrypoint.sh
View file

@ -111,35 +111,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -162,23 +181,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then

79
Dockerfiles/web-apache-pgsql/ol/docker-entrypoint.sh
View file

@ -111,35 +111,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -162,23 +181,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then

1
Dockerfiles/web-apache-pgsql/ubuntu/Dockerfile
View file

@ -68,6 +68,7 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
php8.3-xml \
php8.3-pgsql \
postgresql-client-17 \
jq \
supervisor" && \
apt-get -y update && \
DEBIAN_FRONTEND=noninteractive apt-get -y \

81
Dockerfiles/web-apache-pgsql/ubuntu/docker-entrypoint.sh
View file

@ -111,35 +111,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -161,24 +180,14 @@ check_db_connect() {
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then

2
Dockerfiles/web-nginx-mysql/alpine/Dockerfile
View file

@ -70,7 +70,7 @@ RUN set -eux && \
php84-xmlreader \
php84-xmlwriter \
php84-openssl \
jq \
jq \
supervisor" && \
apk add \
--no-cache \

79
Dockerfiles/web-nginx-mysql/alpine/docker-entrypoint.sh
View file

@ -136,35 +136,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -183,23 +202,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

2
Dockerfiles/web-nginx-mysql/centos/Dockerfile
View file

@ -66,7 +66,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-xml \
shadow-utils \
gzip \
jq \
jq \
supervisor" && \
microdnf -y install \
--disablerepo="*" \

81
Dockerfiles/web-nginx-mysql/centos/docker-entrypoint.sh
View file

@ -136,35 +136,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -182,24 +201,14 @@ check_db_connect() {
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

2
Dockerfiles/web-nginx-mysql/ol/Dockerfile
View file

@ -66,7 +66,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-xml \
findutils \
glibc-locale-source \
jq \
jq \
supervisor" && \
microdnf -y install \
--disablerepo="*" \

79
Dockerfiles/web-nginx-mysql/ol/docker-entrypoint.sh
View file

@ -136,35 +136,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -183,23 +202,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

2
Dockerfiles/web-nginx-mysql/rhel/Dockerfile
View file

@ -85,7 +85,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-ldap \
php-mbstring \
php-mysqlnd \
jq \
jq \
php-xml" && \
curl --tlsv1.2 -sSf -L https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm -o /tmp/epel-release-latest-10.noarch.rpm && \
rpm -ivh /tmp/epel-release-latest-10.noarch.rpm && \

79
Dockerfiles/web-nginx-mysql/rhel/docker-entrypoint.sh
View file

@ -136,35 +136,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -183,23 +202,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

2
Dockerfiles/web-nginx-mysql/ubuntu/Dockerfile
View file

@ -68,7 +68,7 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
php8.3-mbstring \
php8.3-mysql \
php8.3-xml \
jq \
jq \
supervisor" && \
apt-get -y update && \
DEBIAN_FRONTEND=noninteractive apt-get -y \

79
Dockerfiles/web-nginx-mysql/ubuntu/docker-entrypoint.sh
View file

@ -136,35 +136,54 @@ db_tls_params() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -183,23 +202,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
ssl_opts="$(db_tls_params)"

2
Dockerfiles/web-nginx-pgsql/alpine/Dockerfile
View file

@ -69,7 +69,7 @@ RUN set -eux && \
php84-xmlwriter \
php84-openssl \
postgresql17-client \
jq \
jq \
supervisor" && \
apk add \
--no-cache \

84
Dockerfiles/web-nginx-pgsql/alpine/docker-entrypoint.sh
View file

@ -117,35 +117,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -165,29 +184,18 @@ check_db_connect() {
echo "* DB_SERVER_ZBX_PASS: ${DB_SERVER_ZBX_PASS}"
fi
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then
export PGPASSWORD="${DB_SERVER_ZBX_PASS}"
fi

2
Dockerfiles/web-nginx-pgsql/centos/Dockerfile
View file

@ -66,7 +66,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
postgresql18 \
shadow-utils \
gzip \
jq \
jq \
supervisor" && \
microdnf -y install \
--disablerepo="*" \

79
Dockerfiles/web-nginx-pgsql/centos/docker-entrypoint.sh
View file

@ -117,35 +117,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -168,23 +187,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
iif [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then

2
Dockerfiles/web-nginx-pgsql/ol/Dockerfile
View file

@ -64,7 +64,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-json \
php-xml \
postgresql \
jq \
jq \
findutils \
glibc-locale-source \
supervisor" && \

79
Dockerfiles/web-nginx-pgsql/ol/docker-entrypoint.sh
View file

@ -117,35 +117,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -168,23 +187,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then

2
Dockerfiles/web-nginx-pgsql/rhel/Dockerfile
View file

@ -86,7 +86,7 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
php-ldap \
php-mbstring \
php-pgsql \
jq \
jq \
php-xml" && \
curl --tlsv1.2 -sSf -L https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm -o /tmp/epel-release-latest-10.noarch.rpm && \
rpm -ivh /tmp/epel-release-latest-10.noarch.rpm && \

81
Dockerfiles/web-nginx-pgsql/rhel/docker-entrypoint.sh
View file

@ -117,35 +117,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -167,24 +186,14 @@ check_db_connect() {
echo "********************"
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then

2
Dockerfiles/web-nginx-pgsql/ubuntu/Dockerfile
View file

@ -68,7 +68,7 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
php8.3-xml \
php8.3-pgsql \
postgresql-client-17 \
jq \
jq \
supervisor" && \
apt-get -y update && \
DEBIAN_FRONTEND=noninteractive apt-get -y \

79
Dockerfiles/web-nginx-pgsql/ubuntu/docker-entrypoint.sh
View file

@ -117,35 +117,54 @@ check_variables() {
get_vault_secrets() {
WAIT_TIMEOUT=5
vault_url="${ZBX_VAULTURL}${ZBX_VAULTPREFIX}${ZBX_VAULTDBPATH}"
curl_opts=(-s -m 10 -k)
# For hashicorp
if [ ${ZBX_VAULT} == "HashiCorp" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "X-Vault-Token: $VAULT_TOKEN" -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
if [ -z "${ZBX_VAULTURL}" ] || [ -z "${ZBX_VAULTPREFIX}" ] || [ -z "${ZBX_VAULTDBPATH}" ]; then
echo "Missing variables! If ZBX_VAULT is used then ZBX_VAULTURL, ZBX_VAULTPREFIX and ZBX_VAULTDBPATH must be set"
exit 1
fi
if [ "${ZBX_VAULT}" == "HashiCorp" ]; then
while ! vaultdata="$(curl "${curl_opts[@]}" -H "X-Vault-Token: $VAULT_TOKEN" "$vault_url")"; do
echo "**** Vault is not available. Waiting ${WAIT_TIMEOUT} seconds... ****"
echo "CURL command: curl ${curl_opts[*]} -H \"X-Vault-Token: $VAULT_TOKEN\" \"$vault_url\""
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.errors // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.data.data.username')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.data.data.password')"
elif [ "${ZBX_VAULT}" == "CyberArk" ]; then
cyberark_opts=(-H "Content-type: application/json" --cert "$ZBX_VAULTCERTFILE")
# if key is defined use it
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
cyberark_opts+=(--key "$ZBX_VAULTKEYFILE")
fi
while ! vaultdata=$(curl "${curl_opts[@]}" "${cyberark_opts[@]}" "$vault_url") ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.data.data.username')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.data.data.password')
# For Cyperark
elif [ ${ZBX_VAULT} == "CyberArk" ]; then
# if key is defined use if
if [ -n "${ZBX_VAULTKEYFILE}" ]; then
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE --key $ZBX_VAULTKEYFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
# if key is not defined it should be in the cert so skip it
else
while ! vaultdata=$(curl -s -m 10 -k -H "Content-type: application/json" --cert $ZBX_VAULTCERTFILE -X GET $ZBX_VAULTURL$ZBX_VAULTPREFIX$ZBX_VAULTDBPATH) ; do
echo "**** Vault is not available. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
errors=$(printf '%s' "$vaultdata" | jq -r '.ErrorCode // empty')
if [ -n "${errors}" ]; then
echo "Error getting secrets from vault: $errors"
exit 1
fi
DB_SERVER_ZBX_USER=$(echo $vaultdata | jq -r '.UserName')
DB_SERVER_ZBX_PASS=$(echo $vaultdata | jq -r '.Content')
DB_SERVER_ZBX_USER="$(printf '%s' "$vaultdata" | jq -r '.UserName')"
DB_SERVER_ZBX_PASS="$(printf '%s' "$vaultdata" | jq -r '.Content')"
else
echo "ZBX_VAULT has wrong value. HashiCorp or CyberArk are supported!"
exit 1
fi
}
check_db_connect() {
@ -168,23 +187,13 @@ check_db_connect() {
WAIT_TIMEOUT=5
if [ -n "${ZBX_VAULTURL}" ]; then
if [ -n "${ZBX_VAULT}" ]; then
unset DB_SERVER_ZBX_USER
unset DB_SERVER_ZBX_PASS
while :; do
echo "*************** Connecting to vault... ***************************************"
get_vault_secrets
echo "*************** VAULT URL: $ZBX_VAULTURL"
if [ -n $DB_SERVER_ZBX_USER ] && [ $DB_SERVER_ZBX_USER != "null" ]; then
break
fi
echo "**** Failed to get DB credentials from vault. Waiting 5 seconds... ****"
sleep $WAIT_TIMEOUT
done
echo "*************** Connecting to vault... ***************************************"
echo "*************** VAULT URL: $ZBX_VAULTURL"
get_vault_secrets
fi
if [ -n "${DB_SERVER_ZBX_PASS}" ]; then