From 7babf3329610e4a330a1cc5756c4b5dbba1feea8 Mon Sep 17 00:00:00 2001
From: Alexey Pustovalov <alexey.pustovalov@zabbix.com>
Date: Thu, 4 Jun 2026 20:04:58 +0900
Subject: [PATCH] Redesign web config file

---
 templates/config/web/zabbix.conf.php | 181 +++++++++++++--------------
 1 file changed, 85 insertions(+), 96 deletions(-)

diff --git a/templates/config/web/zabbix.conf.php b/templates/config/web/zabbix.conf.php
index 8217bfa9..64517a40 100644
--- a/templates/config/web/zabbix.conf.php
+++ b/templates/config/web/zabbix.conf.php
@@ -1,115 +1,104 @@
 <?php
-// Zabbix GUI configuration file.
-global $DB, $HISTORY;
 
-$DB['TYPE']     = getenv('DB_SERVER_TYPE');
-$DB['SERVER']   = getenv('DB_SERVER_HOST');
-$DB['PORT']     = getenv('DB_SERVER_PORT');
-$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
-$DB['USER']     = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_USER') : '';
-$DB['PASSWORD'] = (! getenv('VAULT_TOKEN') || ! getenv('ZBX_VAULTURL')) ? getenv('DB_SERVER_PASS') : '';
+function env_string(string $name, string $default = ''): string {
+    $value = getenv($name);
 
-// Schema name. Used for PostgreSQL.
-$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
+    return ($value === false) ? $default : $value;
+}
+
+function env_bool(string $name, bool $default = false): bool {
+    $value = getenv($name);
+
+    if ($value === false || $value === '') {
+        return $default;
+    }
+
+    return filter_var($value, FILTER_VALIDATE_BOOLEAN);
+}
+
+function env_json(string $name, array $default = []): array {
+    $value = getenv($name);
+
+    if ($value === false || $value === '') {
+        return $default;
+    }
+
+    $decoded = json_decode(str_replace("'", '"', $value), true);
+
+    return is_array($decoded) ? $decoded : $default;
+}
+
+function resolve_file(string $default_path, string $env_name): string {
+    if (file_exists($default_path)) {
+        return $default_path;
+    }
+
+    $path = getenv($env_name);
+
+    return ($path && file_exists($path)) ? $path : '';
+}
+
+$DB['TYPE']     = env_string('DB_SERVER_TYPE');
+$DB['SERVER']   = env_string('DB_SERVER_HOST');
+$DB['PORT']     = env_string('DB_SERVER_PORT');
+$DB['DATABASE'] = env_string('DB_SERVER_DBNAME');
+$DB['SCHEMA']   = env_string('DB_SERVER_SCHEMA');
+
+if (!getenv('VAULT_TOKEN') || !getenv('ZBX_VAULTURL')) {
+    $DB['USER']     = env_string('DB_SERVER_USER');
+    $DB['PASSWORD'] = env_string('DB_SERVER_PASS');
+}
+else {
+    $DB['USER']     = '';
+    $DB['PASSWORD'] = '';
+}
 
 if (getenv('ZBX_SERVER_HOST')) {
-    $ZBX_SERVER      = getenv('ZBX_SERVER_HOST');
-    $ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
-}
-$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
-
-// Used for TLS connection.
-$DB['ENCRYPTION']               = getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
-$DB['KEY_FILE']                 = getenv('ZBX_DB_KEY_FILE');
-$DB['CERT_FILE']                = getenv('ZBX_DB_CERT_FILE');
-$DB['CA_FILE']                  = getenv('ZBX_DB_CA_FILE');
-$DB['VERIFY_HOST']              = getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
-$DB['CIPHER_LIST']              = getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
-
-// Vault configuration. Used if database credentials are stored in Vault secrets manager.
-$DB['VAULT']                    = getenv('ZBX_VAULT');
-$DB['VAULT_URL']                = getenv('ZBX_VAULTURL');
-$DB['VAULT_PREFIX']		= getenv('ZBX_VAULTPREFIX');
-$DB['VAULT_DB_PATH']            = getenv('ZBX_VAULTDBPATH');
-$DB['VAULT_TOKEN']              = getenv('VAULT_TOKEN');
-
-if (file_exists('/etc/zabbix/web/certs/vault.crt')) {
-   $DB['VAULT_CERT_FILE'] = '/etc/zabbix/web/certs/vault.crt';
-}
-elseif (file_exists(getenv('ZBX_VAULTCERTFILE'))) {
-   $DB['VAULT_CERT_FILE'] = getenv('ZBX_VAULTCERTFILE');
-}
-else {
-   $DB['VAULT_CERT_FILE'] = '';
+    $ZBX_SERVER      = env_string('ZBX_SERVER_HOST');
+    $ZBX_SERVER_PORT = env_string('ZBX_SERVER_PORT');
 }
 
-if (file_exists('/etc/zabbix/web/certs/vault.key')) {
-   $DB['VAULT_KEY_FILE'] = '/etc/zabbix/web/certs/vault.key';
-}
-elseif (file_exists(getenv('ZBX_VAULTKEYFILE'))) {
-   $DB['VAULT_KEY_FILE'] = getenv('ZBX_VAULTKEYFILE');
-}
-else {
-   $DB['VAULT_KEY_FILE'] = '';
-}
+$ZBX_SERVER_NAME = env_string('ZBX_SERVER_NAME');
 
-$DB['VAULT_CACHE']              = getenv('ZBX_VAULTCACHE') == 'true' ? true: false;
+$DB['ENCRYPTION']  = env_bool('ZBX_DB_ENCRYPTION');
+$DB['VERIFY_HOST'] = env_bool('ZBX_DB_VERIFY_HOST');
+$DB['KEY_FILE']    = env_string('ZBX_DB_KEY_FILE');
+$DB['CERT_FILE']   = env_string('ZBX_DB_CERT_FILE');
+$DB['CA_FILE']     = env_string('ZBX_DB_CA_FILE');
+$DB['CIPHER_LIST'] = env_string('ZBX_DB_CIPHER_LIST');
 
-// Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
-// This option is enabled by default for new Zabbix installations.
-// For upgraded installations, please read database upgrade notes before enabling this option.
-$DB['DOUBLE_IEEE754']           = getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
+$DB['VAULT']         = env_string('ZBX_VAULT');
+$DB['VAULT_URL']     = env_string('ZBX_VAULTURL');
+$DB['VAULT_PREFIX']  = env_string('ZBX_VAULTPREFIX');
+$DB['VAULT_DB_PATH'] = env_string('ZBX_VAULTDBPATH');
+$DB['VAULT_TOKEN']   = env_string('VAULT_TOKEN');
 
+$DB['VAULT_CERT_FILE'] = resolve_file('/etc/zabbix/web/certs/vault.crt', 'ZBX_VAULTCERTFILE');
+$DB['VAULT_KEY_FILE'] = resolve_file('/etc/zabbix/web/certs/vault.key', 'ZBX_VAULTKEYFILE');
 
-$IMAGE_FORMAT_DEFAULT  = IMAGE_FORMAT_PNG;
+$DB['VAULT_CACHE']    = env_bool('ZBX_VAULTCACHE');
 
-// Elasticsearch url (can be string if same url is used for all types).
-$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
-$HISTORY['url']   = (json_decode($history_url)) ? json_decode($history_url, true) : $history_url;
-// Value types stored in Elasticsearch.
-$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
+$DB['DOUBLE_IEEE754'] = env_bool('DB_DOUBLE_IEEE754');
 
-$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types, true) : array();
+$IMAGE_FORMAT_DEFAULT = IMAGE_FORMAT_PNG;
 
-// Used for SAML authentication.
-if (file_exists('/etc/zabbix/web/certs/sp.key')) {
-   $SSO['SP_KEY'] = '/etc/zabbix/web/certs/sp.key';
-}
-elseif (file_exists(getenv('ZBX_SSO_SP_KEY'))) {
-   $SSO['SP_KEY'] = getenv('ZBX_SSO_SP_KEY');
-}
-else {
-   $SSO['SP_KEY'] = '';
+$HISTORY['url'] = env_json('ZBX_HISTORYSTORAGEURL');
+if ($HISTORY['url'] === []) {
+    $HISTORY['url'] = env_string('ZBX_HISTORYSTORAGEURL');
 }
+$HISTORY['types'] = env_json('ZBX_HISTORYSTORAGETYPES');
 
-if (file_exists('/etc/zabbix/web/certs/sp.crt')) {
-   $SSO['SP_CERT'] = '/etc/zabbix/web/certs/sp.crt';
-}
-elseif (file_exists(getenv('ZBX_SSO_SP_CERT'))) {
-   $SSO['SP_CERT'] = getenv('ZBX_SSO_SP_CERT');
-}
-else {
-   $SSO['SP_CERT'] = '';
-}
+$SSO['SP_KEY'] = resolve_file('/etc/zabbix/web/certs/sp.key', 'ZBX_SSO_SP_KEY');
+$SSO['SP_CERT'] = resolve_file('/etc/zabbix/web/certs/sp.crt', 'ZBX_SSO_SP_CERT');
+$SSO['IDP_CERT'] = resolve_file('/etc/zabbix/web/certs/idp.crt', 'ZBX_SSO_IDP_CERT');
 
-if (file_exists('/etc/zabbix/web/certs/idp.crt')) {
-   $SSO['IDP_CERT'] = '/etc/zabbix/web/certs/idp.crt';
-}
-elseif (file_exists(getenv('ZBX_SSO_IDP_CERT'))) {
-   $SSO['IDP_CERT'] = getenv('ZBX_SSO_IDP_CERT');
-}
-else {
-   $SSO['IDP_CERT'] = '';
-}
+$SSO['SETTINGS'] = env_json('ZBX_SSO_SETTINGS');
 
-$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
-$SSO['SETTINGS'] = (json_decode($sso_settings)) ? json_decode($sso_settings, true) : array();
+$ALLOW_HTTP_AUTH = env_bool('ALLOW_HTTP_AUTH', true);
 
-$ALLOW_HTTP_AUTH = getenv('ZBX_ALLOW_HTTP_AUTH') == 'true' ? true: false;
-
-$ZBX_SERVER_TLS['ACTIVE'] = getenv('ZBX_SERVER_TLS_ACTIVE') == 'true' ? '1': '0';
-$ZBX_SERVER_TLS['CA_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CAFILE')) ? getenv('ZBX_SERVER_TLS_CAFILE') : '';
-$ZBX_SERVER_TLS['KEY_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_KEYFILE')) ? getenv('ZBX_SERVER_TLS_KEYFILE') : '';
-$ZBX_SERVER_TLS['CERT_FILE'] = file_exists(getenv('ZBX_SERVER_TLS_CERTFILE')) ? getenv('ZBX_SERVER_TLS_CERTFILE') : '';
-$ZBX_SERVER_TLS['CERTIFICATE_ISSUER']  = getenv('ZBX_SERVER_TLS_CERT_ISSUER');
-$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = getenv('ZBX_SERVER_TLS_CERT_SUBJECT');
+$ZBX_SERVER_TLS['ACTIVE'] = env_bool('ZBX_SERVER_TLS_ACTIVE');
+$ZBX_SERVER_TLS['CA_FILE'] = resolve_file('', 'ZBX_SERVER_TLS_CAFILE');
+$ZBX_SERVER_TLS['KEY_FILE'] = resolve_file('', 'ZBX_SERVER_TLS_KEYFILE');
+$ZBX_SERVER_TLS['CERT_FILE'] = resolve_file('', 'ZBX_SERVER_TLS_CERTFILE');
+$ZBX_SERVER_TLS['CERTIFICATE_ISSUER'] = env_string('ZBX_SERVER_TLS_CERT_ISSUER');
+$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = env_string('ZBX_SERVER_TLS_CERT_SUBJECT');