From 05daffc99ec1212da80c76838158d71a76bef727 Mon Sep 17 00:00:00 2001 From: Alexey Pustovalov Date: Mon, 13 Jan 2025 19:24:39 +0900 Subject: [PATCH] Migrate to PHP-FPM for all Web images --- .../agent/windows/docker-entrypoint.ps1 | 4 +- .../agent2/windows/docker-entrypoint.ps1 | 4 +- .../web-apache-mysql/alpine/Dockerfile | 58 +++--- .../alpine/conf/etc/apache2/conf.d/mime.conf | 8 + .../alpine/conf/etc/apache2/httpd.conf | 75 ++++++++ .../alpine/conf/etc/apache2/includes.conf | 3 + .../alpine/conf/etc/apache2/modules.conf | 24 +++ .../conf/etc/php83/conf.d/99-zabbix.ini | 10 -- .../alpine/conf/etc/php83/php-fpm.conf | 10 ++ .../conf/etc/php83/php-fpm.d/zabbix.conf | 36 ++++ .../supervisor/conf.d/supervisord_zabbix.conf | 30 ++++ .../conf/etc/supervisor/supervisord.conf | 35 ++++ .../alpine/conf/etc/zabbix/apache.conf | 32 +++- .../alpine/conf/etc/zabbix/apache_ssl.conf | 169 +++++++++-------- .../alpine/docker-entrypoint.sh | 101 ++++++----- .../web-apache-mysql/centos/Dockerfile | 54 +++--- .../conf/etc/httpd/conf.d/99-zabbix.conf | 3 - .../centos/conf/etc/httpd/conf.d/mime.conf | 9 + .../centos/conf/etc/httpd/conf/httpd.conf | 75 ++++++++ .../centos/conf/etc/httpd/includes.conf | 3 + .../centos/conf/etc/httpd/modules.conf | 24 +++ .../centos/conf/etc/zabbix/apache.conf | 21 ++- .../centos/conf/etc/zabbix/apache_ssl.conf | 170 ++++++++++-------- .../centos/docker-entrypoint.sh | 91 +++++----- Dockerfiles/web-apache-mysql/ol/Dockerfile | 42 +++-- .../ol/conf/etc/httpd/conf.d/99-zabbix.conf | 3 - .../ol/conf/etc/httpd/conf.d/mime.conf | 9 + .../ol/conf/etc/httpd/conf/httpd.conf | 75 ++++++++ .../ol/conf/etc/httpd/includes.conf | 3 + .../ol/conf/etc/httpd/modules.conf | 24 +++ .../ol/conf/etc/zabbix/apache.conf | 21 ++- .../ol/conf/etc/zabbix/apache_ssl.conf | 170 ++++++++++-------- .../web-apache-mysql/ol/docker-entrypoint.sh | 91 +++++----- .../web-apache-mysql/ubuntu/Dockerfile | 68 +++---- .../ubuntu/conf/etc/apache2/apache2.conf | 75 ++++++++ .../ubuntu/conf/etc/apache2/includes.conf | 8 + .../ubuntu/conf/etc/apache2/modules.conf | 21 +++ .../etc/php/8.3/apache2/conf.d/99-zabbix.ini | 10 -- .../ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf | 10 ++ .../conf/etc/php/8.3/fpm/pool.d/zabbix.conf | 36 ++++ .../supervisor/conf.d/supervisord_zabbix.conf | 30 ++++ .../conf/etc/supervisor/supervisord.conf | 35 ++++ .../ubuntu/conf/etc/zabbix/apache.conf | 32 +++- .../ubuntu/conf/etc/zabbix/apache_envvars | 4 - .../ubuntu/conf/etc/zabbix/apache_ssl.conf | 168 +++++++++-------- .../ubuntu/docker-entrypoint.sh | 108 +++++------ .../web-apache-pgsql/alpine/Dockerfile | 58 +++--- .../alpine/conf/etc/apache2/conf.d/mime.conf | 8 + .../alpine/conf/etc/apache2/httpd.conf | 75 ++++++++ .../alpine/conf/etc/apache2/includes.conf | 3 + .../alpine/conf/etc/apache2/modules.conf | 24 +++ .../conf/etc/php83/conf.d/99-zabbix.ini | 10 -- .../alpine/conf/etc/php83/php-fpm.conf | 10 ++ .../conf/etc/php83/php-fpm.d/zabbix.conf | 36 ++++ .../supervisor/conf.d/supervisord_zabbix.conf | 30 ++++ .../conf/etc/supervisor/supervisord.conf | 35 ++++ .../alpine/conf/etc/zabbix/apache.conf | 32 +++- .../alpine/conf/etc/zabbix/apache_ssl.conf | 165 +++++++++-------- .../alpine/docker-entrypoint.sh | 101 ++++++----- .../web-apache-pgsql/centos/Dockerfile | 42 +++-- .../conf/etc/httpd/conf.d/99-zabbix.conf | 3 - .../centos/conf/etc/httpd/conf.d/mime.conf | 9 + .../centos/conf/etc/httpd/conf/httpd.conf | 75 ++++++++ .../centos/conf/etc/httpd/includes.conf | 3 + .../centos/conf/etc/httpd/modules.conf | 24 +++ .../centos/conf/etc/zabbix/apache.conf | 21 ++- .../centos/conf/etc/zabbix/apache_ssl.conf | 170 ++++++++++-------- .../centos/docker-entrypoint.sh | 91 +++++----- Dockerfiles/web-apache-pgsql/ol/Dockerfile | 42 +++-- .../ol/conf/etc/httpd/conf.d/99-zabbix.conf | 3 - .../ol/conf/etc/httpd/conf.d/mime.conf | 9 + .../ol/conf/etc/httpd/conf/httpd.conf | 75 ++++++++ .../ol/conf/etc/httpd/includes.conf | 3 + .../ol/conf/etc/httpd/modules.conf | 24 +++ .../ol/conf/etc/zabbix/apache.conf | 21 ++- .../ol/conf/etc/zabbix/apache_ssl.conf | 170 ++++++++++-------- .../web-apache-pgsql/ol/docker-entrypoint.sh | 107 ++++++----- .../web-apache-pgsql/ubuntu/Dockerfile | 65 ++++--- .../ubuntu/conf/etc/apache2/apache2.conf | 75 ++++++++ .../ubuntu/conf/etc/apache2/includes.conf | 8 + .../ubuntu/conf/etc/apache2/modules.conf | 21 +++ .../etc/php/8.3/apache2/conf.d/99-zabbix.ini | 10 -- .../ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf | 10 ++ .../conf/etc/php/8.3/fpm/pool.d/zabbix.conf | 36 ++++ .../supervisor/conf.d/supervisord_zabbix.conf | 30 ++++ .../conf/etc/supervisor/supervisord.conf | 35 ++++ .../ubuntu/conf/etc/zabbix/apache.conf | 32 +++- .../ubuntu/conf/etc/zabbix/apache_ssl.conf | 168 +++++++++-------- .../ubuntu/docker-entrypoint.sh | 110 ++++++------ Dockerfiles/web-nginx-mysql/alpine/Dockerfile | 26 +-- .../alpine/conf/etc/php83/php-fpm.conf | 1 + .../alpine/conf/etc/zabbix/nginx.conf | 9 + .../alpine/docker-entrypoint.sh | 123 +++++++------ Dockerfiles/web-nginx-mysql/centos/Dockerfile | 28 +-- .../centos/conf/etc/php-fpm.conf | 1 + .../centos/conf/etc/zabbix/nginx.conf | 9 + .../centos/docker-entrypoint.sh | 123 +++++++------ Dockerfiles/web-nginx-mysql/ol/Dockerfile | 28 +-- .../web-nginx-mysql/ol/conf/etc/php-fpm.conf | 1 + .../ol/conf/etc/zabbix/nginx.conf | 9 + .../web-nginx-mysql/ol/docker-entrypoint.sh | 123 +++++++------ Dockerfiles/web-nginx-mysql/rhel/Dockerfile | 28 +-- .../rhel/conf/etc/php-fpm.conf | 1 + .../rhel/conf/etc/zabbix/nginx.conf | 9 + .../web-nginx-mysql/rhel/docker-entrypoint.sh | 127 ++++++------- Dockerfiles/web-nginx-mysql/ubuntu/Dockerfile | 28 +-- .../ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf | 1 + .../ubuntu/conf/etc/zabbix/nginx.conf | 9 + .../ubuntu/docker-entrypoint.sh | 125 +++++++------ Dockerfiles/web-nginx-pgsql/alpine/Dockerfile | 26 +-- .../alpine/conf/etc/php83/php-fpm.conf | 1 + .../alpine/conf/etc/zabbix/nginx.conf | 9 + .../alpine/docker-entrypoint.sh | 123 +++++++------ Dockerfiles/web-nginx-pgsql/centos/Dockerfile | 28 +-- .../centos/conf/etc/php-fpm.conf | 1 + .../centos/conf/etc/zabbix/nginx.conf | 9 + .../centos/docker-entrypoint.sh | 78 ++++++-- Dockerfiles/web-nginx-pgsql/ol/Dockerfile | 28 +-- .../web-nginx-pgsql/ol/conf/etc/php-fpm.conf | 1 + .../ol/conf/etc/zabbix/nginx.conf | 9 + .../web-nginx-pgsql/ol/docker-entrypoint.sh | 78 ++++++-- Dockerfiles/web-nginx-pgsql/ubuntu/Dockerfile | 28 +-- .../ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf | 1 + .../ubuntu/conf/etc/zabbix/nginx.conf | 9 + .../ubuntu/docker-entrypoint.sh | 80 +++++++-- compose_databases.yaml | 6 +- compose_zabbix_components.yaml | 115 +++++++----- 127 files changed, 3828 insertions(+), 1782 deletions(-) create mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/conf.d/mime.conf create mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/httpd.conf create mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/includes.conf create mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/modules.conf delete mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/conf.d/99-zabbix.ini create mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/php-fpm.conf create mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/php-fpm.d/zabbix.conf create mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/supervisor/conf.d/supervisord_zabbix.conf create mode 100644 Dockerfiles/web-apache-mysql/alpine/conf/etc/supervisor/supervisord.conf delete mode 100644 Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/99-zabbix.conf create mode 100644 Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/mime.conf create mode 100644 Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf/httpd.conf create mode 100644 Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/includes.conf create mode 100644 Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/modules.conf delete mode 100644 Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/99-zabbix.conf create mode 100644 Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/mime.conf create mode 100644 Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf/httpd.conf create mode 100644 Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/includes.conf create mode 100644 Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/modules.conf create mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/apache2.conf create mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/includes.conf create mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/modules.conf delete mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/apache2/conf.d/99-zabbix.ini create mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf create mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/fpm/pool.d/zabbix.conf create mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/supervisor/conf.d/supervisord_zabbix.conf create mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/supervisor/supervisord.conf delete mode 100644 Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_envvars create mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/conf.d/mime.conf create mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/httpd.conf create mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/includes.conf create mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/modules.conf delete mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/conf.d/99-zabbix.ini create mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/php-fpm.conf create mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/php-fpm.d/zabbix.conf create mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/supervisor/conf.d/supervisord_zabbix.conf create mode 100644 Dockerfiles/web-apache-pgsql/alpine/conf/etc/supervisor/supervisord.conf delete mode 100644 Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/99-zabbix.conf create mode 100644 Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/mime.conf create mode 100644 Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf/httpd.conf create mode 100644 Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/includes.conf create mode 100644 Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/modules.conf delete mode 100644 Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/99-zabbix.conf create mode 100644 Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/mime.conf create mode 100644 Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf/httpd.conf create mode 100644 Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/includes.conf create mode 100644 Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/modules.conf create mode 100644 Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/apache2.conf create mode 100644 Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/includes.conf create mode 100644 Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/modules.conf delete mode 100644 Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/apache2/conf.d/99-zabbix.ini create mode 100644 Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf create mode 100644 Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/fpm/pool.d/zabbix.conf create mode 100644 Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/supervisor/conf.d/supervisord_zabbix.conf create mode 100644 Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/supervisor/supervisord.conf diff --git a/Dockerfiles/agent/windows/docker-entrypoint.ps1 b/Dockerfiles/agent/windows/docker-entrypoint.ps1 index cb0363d86..4f78b8928 100644 --- a/Dockerfiles/agent/windows/docker-entrypoint.ps1 +++ b/Dockerfiles/agent/windows/docker-entrypoint.ps1 @@ -130,8 +130,8 @@ function File-Process-From-Env { ) if (![string]::IsNullOrEmpty($VarValue)) { - $VarValue | Set-Content "$ZabbixInternalEncDir\$VarName" - $FileName="$ZabbixInternalEncDir\$VarName" + $VarValue | Set-Content "$ZabbixInternalEncDir\VarName" + $FileName="$ZabbixInternalEncDir\VarName" } Update-Config-Var $ZbxAgentConfig "$VarName" "$FileName" diff --git a/Dockerfiles/agent2/windows/docker-entrypoint.ps1 b/Dockerfiles/agent2/windows/docker-entrypoint.ps1 index 55a0917a2..c7ff21919 100644 --- a/Dockerfiles/agent2/windows/docker-entrypoint.ps1 +++ b/Dockerfiles/agent2/windows/docker-entrypoint.ps1 @@ -130,8 +130,8 @@ function File-Process-From-Env { ) if (![string]::IsNullOrEmpty($VarValue)) { - $VarValue | Set-Content "$ZabbixInternalEncDir\$VarName" - $FileName="$ZabbixInternalEncDir\$VarName" + $VarValue | Set-Content "$ZabbixInternalEncDir\VarName" + $FileName="$ZabbixInternalEncDir\VarName" } Update-Config-Var $ZbxAgentConfig "$VarName" "$FileName" diff --git a/Dockerfiles/web-apache-mysql/alpine/Dockerfile b/Dockerfiles/web-apache-mysql/alpine/Dockerfile index d53b8a3aa..664271572 100644 --- a/Dockerfiles/web-apache-mysql/alpine/Dockerfile +++ b/Dockerfiles/web-apache-mysql/alpine/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with MySQL database support" \ @@ -28,19 +29,19 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov + TypesConfig /etc/apache2/mime.types + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + + + MIMEMagicFile /etc/apache2/magic + diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/httpd.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/httpd.conf new file mode 100644 index 000000000..2cf9de536 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/httpd.conf @@ -0,0 +1,75 @@ +ServerRoot /etc/apache2/ +ServerRoot /var/www +DefaultRuntimeDir /tmp/apache2/ +PidFile /tmp/apache2.pid + +ServerName 127.0.0.1 + +IncludeOptional /etc/apache2/includes.conf + +Timeout 300 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 5 + + + User ${APACHE_RUN_USER} + Group ${APACHE_RUN_GROUP} + + +HostnameLookups Off + +LogLevel warn + + + SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined + LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %O" common + LogFormat "%{Referer}i -> %U" referer + LogFormat "%{User-agent}i" agent + + CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs + + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). + + Require all denied + + +ServerTokens ${APACHE_SERVER_TOKENS} + +ServerSignature ${APACHE_SERVER_SIGNATURE} + +TraceEnable Off + +AddDefaultCharset UTF-8 + + + + SetHandler server-status + Require local + + + ExtendedStatus On + + + ProxyStatus On + + diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/includes.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/includes.conf new file mode 100644 index 000000000..1c093db0b --- /dev/null +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/includes.conf @@ -0,0 +1,3 @@ +IncludeOptional /etc/apache2/modules.conf + +IncludeOptional /etc/apache2/conf.d/*.conf diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/modules.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/modules.conf new file mode 100644 index 000000000..4f642f8e9 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/apache2/modules.conf @@ -0,0 +1,24 @@ +LoadModule logio_module modules/mod_logio.so +LoadModule unixd_module modules/mod_unixd.so +LoadModule log_config_module modules/mod_log_config.so +LoadModule access_compat_module modules/mod_access_compat.so +LoadModule auth_basic_module modules/mod_auth_basic.so +LoadModule authn_core_module modules/mod_authn_core.so +LoadModule authn_file_module modules/mod_authn_file.so +LoadModule authz_core_module modules/mod_authz_core.so +LoadModule authz_host_module modules/mod_authz_host.so +LoadModule authz_user_module modules/mod_authz_user.so +LoadModule dir_module modules/mod_dir.so +LoadModule env_module modules/mod_env.so +LoadModule filter_module modules/mod_filter.so +LoadModule mime_module modules/mod_mime.so +LoadModule mpm_event_module modules/mod_mpm_event.so +LoadModule negotiation_module modules/mod_negotiation.so +LoadModule reqtimeout_module modules/mod_reqtimeout.so +LoadModule setenvif_module modules/mod_setenvif.so +LoadModule status_module modules/mod_status.so + +LoadModule proxy_module modules/mod_proxy.so +LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so +LoadModule expires_module modules/mod_expires.so +LoadModule headers_module modules/mod_headers.so diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/conf.d/99-zabbix.ini b/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/conf.d/99-zabbix.ini deleted file mode 100644 index e180720b9..000000000 --- a/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/conf.d/99-zabbix.ini +++ /dev/null @@ -1,10 +0,0 @@ -max_execution_time = ${ZBX_MAXEXECUTIONTIME} -memory_limit = ${ZBX_MEMORYLIMIT} -post_max_size = ${ZBX_POSTMAXSIZE} -upload_max_filesize = ${ZBX_UPLOADMAXFILESIZE} -max_input_time = ${ZBX_MAXINPUTTIME} -; always_populate_raw_post_data=-1 -max_input_vars = 10000 -date.timezone = ${PHP_TZ} -; https://www.php.net/manual/en/security.hiding.php -expose_php = ${EXPOSE_WEB_SERVER_INFO} diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/php-fpm.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/php-fpm.conf new file mode 100644 index 000000000..e23aa2d90 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/php-fpm.conf @@ -0,0 +1,10 @@ +include=/etc/php83/php-fpm.d/*.conf + +[global] + +pid = /tmp/php-fpm.pid + +error_log = /dev/fd/2 +log_level = notice + +daemonize = no diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/php-fpm.d/zabbix.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/php-fpm.d/zabbix.conf new file mode 100644 index 000000000..66c3c1252 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/php83/php-fpm.d/zabbix.conf @@ -0,0 +1,36 @@ +[zabbix] + +; https://www.php.net/manual/en/security.hiding.php +php_value[expose_php] = ${EXPOSE_WEB_SERVER_INFO} + +listen = /tmp/php-fpm.sock + +clear_env = no + +pm = ${PHP_FPM_PM} +pm.max_children = ${PHP_FPM_PM_MAX_CHILDREN} +pm.start_servers = ${PHP_FPM_PM_START_SERVERS} +pm.min_spare_servers = ${PHP_FPM_PM_MIN_SPARE_SERVERS} +pm.max_spare_servers = ${PHP_FPM_PM_MAX_SPARE_SERVERS} +pm.max_requests = ${PHP_FPM_PM_MAX_REQUESTS} + +slowlog = /dev/fd/1 + +php_admin_value[error_log] = /dev/fd/2 +php_admin_flag[log_errors] = on +catch_workers_output = yes + +php_value[session.save_handler] = files +php_value[session.save_path] = /var/lib/php/session + +php_value[max_execution_time] = ${ZBX_MAXEXECUTIONTIME} +php_value[memory_limit] = ${ZBX_MEMORYLIMIT} +php_value[post_max_size] = ${ZBX_POSTMAXSIZE} +php_value[upload_max_filesize] = ${ZBX_UPLOADMAXFILESIZE} +php_value[max_input_time] = ${ZBX_MAXINPUTTIME} +php_value[max_input_vars] = 10000 +php_value[date.timezone] = ${PHP_TZ} + +; PHP-FPM monitoring +pm.status_path = /status +ping.path = /ping diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/supervisor/conf.d/supervisord_zabbix.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/supervisor/conf.d/supervisord_zabbix.conf new file mode 100644 index 000000000..447141984 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/supervisor/conf.d/supervisord_zabbix.conf @@ -0,0 +1,30 @@ +[supervisord] +nodaemon = true + +[program:httpd] +command = /usr/sbin/%(program_name)s -D FOREGROUND +auto_start = true +autorestart = true + +startsecs=2 +startretries=3 +stopsignal=TERM +stopwaitsecs=2 + +redirect_stderr=true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 + +[program:php-fpm83] +command = /usr/sbin/%(program_name)s -F -y /etc/php83/php-fpm.conf +auto_start = true +autorestart = true + +startsecs=2 +startretries=3 +stopsignal=TERM +stopwaitsecs=2 + +redirect_stderr=true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/supervisor/supervisord.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/supervisor/supervisord.conf new file mode 100644 index 000000000..f8d80e461 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/supervisor/supervisord.conf @@ -0,0 +1,35 @@ +; supervisor config file + +[unix_http_server] +file = /tmp/supervisor.sock ; (the path to the socket file) +chmod = 0700 ; sockef file mode (default 0700) +username = zbx +password = password + +[supervisord] +logfile = /dev/stdout ; (main log file;default $CWD/supervisord.log) +pidfile = /tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid) +childlogdir = /tmp ; ('AUTO' child log dir, default $TEMP) +critical = critical +;user = zabbix +logfile_maxbytes = 0 +logfile_backupcount = 0 +loglevel = info + +; the below section must remain in the config file for RPC +; (supervisorctl/web interface) to work, additional interfaces may be +; added by defining them in separate rpcinterface: sections +[rpcinterface:supervisor] +supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface + +[supervisorctl] +serverurl = unix:///tmp/supervisor.sock ; use a unix:// URL for a unix socket + +; The [include] section can just contain the "files" setting. This +; setting can list multiple files (separated by whitespace or +; newlines). It can also contain wildcards. The filenames are +; interpreted as relative to this file. Included files *cannot* +; include files themselves. + +[include] +files = /etc/supervisor/conf.d/*.conf diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/zabbix/apache.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/zabbix/apache.conf index b32e8167f..f0a69becd 100644 --- a/Dockerfiles/web-apache-mysql/alpine/conf/etc/zabbix/apache.conf +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/zabbix/apache.conf @@ -1,14 +1,44 @@ +Listen 8080 + DocumentRoot /usr/share/zabbix/ + ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DirectoryIndex ${HTTP_INDEX_FILE} + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml AddType application/x-httpd-php-source .phps + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + + + Order Allow,Deny + Allow from all + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + Options FollowSymLinks AllowOverride None Require all granted + + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + diff --git a/Dockerfiles/web-apache-mysql/alpine/conf/etc/zabbix/apache_ssl.conf b/Dockerfiles/web-apache-mysql/alpine/conf/etc/zabbix/apache_ssl.conf index 92b08a986..b46e7f800 100644 --- a/Dockerfiles/web-apache-mysql/alpine/conf/etc/zabbix/apache_ssl.conf +++ b/Dockerfiles/web-apache-mysql/alpine/conf/etc/zabbix/apache_ssl.conf @@ -1,88 +1,113 @@ -LoadModule ssl_module modules/mod_ssl.so -LoadModule socache_shmcb_module modules/mod_socache_shmcb.so +LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so +LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so Listen 8443 - - - DocumentRoot /usr/share/zabbix/ - ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DocumentRoot /usr/share/zabbix/ - AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml - AddType application/x-httpd-php-source .phps + ServerName zabbix - # Enable/Disable SSL for this virtual host. - SSLEngine on + DirectoryIndex ${HTTP_INDEX_FILE} - # intermediate configuration - SSLProtocol -all +TLSv1.2 +TLSv1.3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - SSLHonorCipherOrder off - SSLSessionTickets off + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml + AddType application/x-httpd-php-source .phps - SSLCertificateFile /etc/ssl/apache2/ssl.crt - SSLCertificateKeyFile /etc/ssl/apache2/ssl.key - # SSLCACertificatePath /etc/ssl/apache2/chain/ + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 - # enable HTTP/2, if available - Protocols h2 http/1.1 + # Enable/Disable SSL for this virtual host. + SSLEngine on - # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) - Header always set Strict-Transport-Security "max-age=63072000" + # intermediate configuration + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off - - Options FollowSymLinks - AllowOverride None - Require all granted - + SSLCertificateFile /etc/ssl/apache2/ssl.crt + SSLCertificateKeyFile /etc/ssl/apache2/ssl.key + # SSLCACertificatePath /etc/ssl/apache2/chain/ - - Require all denied - - Order deny,allow - Deny from all - - + # enable HTTP/2, if available + Protocols h2 http/1.1 - - Require all denied - - Order deny,allow - Deny from all - - + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" - - Require all denied - - Order deny,allow - Deny from all - - + + Order Allow,Deny + Allow from all - - Require all denied - - Order deny,allow - Deny from all - - + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + - - Require all denied - - Order deny,allow - Deny from all - - + + Options FollowSymLinks + AllowOverride None + Require all granted - - Require all denied - - Order deny,allow - Deny from all - - - - + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + diff --git a/Dockerfiles/web-apache-mysql/alpine/docker-entrypoint.sh b/Dockerfiles/web-apache-mysql/alpine/docker-entrypoint.sh index d332a4956..5c911a10b 100755 --- a/Dockerfiles/web-apache-mysql/alpine/docker-entrypoint.sh +++ b/Dockerfiles/web-apache-mysql/alpine/docker-entrypoint.sh @@ -18,11 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} +# Default user settings +: ${DAEMON_USER:="apache"} +: ${DAEMON_GROUP:="apache"} + # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Apache main configuration file HTTPD_CONF_FILE="/etc/apache2/httpd.conf" +# Apache additional configuration files directory +APACHE_SITES_DIR="/etc/apache2/conf.d" +# Directory with SSL certificate files for Apache +APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php83/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -131,7 +139,12 @@ check_db_connect() { } prepare_web_server() { - APACHE_SITES_DIR=/etc/apache2/conf.d + if [ "$(id -u)" == '0' ]; then + export APACHE_RUN_USER=${DAEMON_USER} + else + export APACHE_RUN_USER=$(id -n -u) + fi + export APACHE_RUN_GROUP=${DAEMON_GROUP} echo "** Adding Zabbix virtual host (HTTP)" if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then @@ -140,7 +153,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "/etc/ssl/apache2/ssl.crt" ] && [ -f "/etc/ssl/apache2/ssl.key" ]; then + if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then echo "** Adding Zabbix virtual host (HTTPS)" if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf" @@ -150,10 +163,42 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Apache2. Certificates are missed." fi + + export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"} + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + export APACHE_CUSTOM_LOG="/proc/self/fd/1" + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + export APACHE_CUSTOM_LOG="/dev/null" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + export APACHE_SERVER_TOKENS="OS" + export APACHE_SERVER_SIGNATURE="On" + if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then + export APACHE_SERVER_TOKENS="Prod" + export APACHE_SERVER_SIGNATURE="Off" + fi + + mkdir -p /tmp/apache2 } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" + + export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} + export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} + export PHP_FPM_PM_START_SERVERS=${PHP_FPM_PM_START_SERVERS:-"5"} + export PHP_FPM_PM_MIN_SPARE_SERVERS=${PHP_FPM_PM_MIN_SPARE_SERVERS:-"5"} + export PHP_FPM_PM_MAX_SPARE_SERVERS=${PHP_FPM_PM_MAX_SPARE_SERVERS:-"35"} + export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} + + if [ "$(id -u)" == '0' ]; then + echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + fi : ${ZBX_DENY_GUI_ACCESS:="false"} export ZBX_DENY_GUI_ACCESS=${ZBX_DENY_GUI_ACCESS,,} @@ -200,45 +245,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache.conf" - - if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "$HTTPD_CONF_FILE" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - if [ "${EXPOSE_WEB_SERVER_INFO}" = "off" ]; then - sed -i \ - -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \ - "$HTTPD_CONF_FILE" - else - EXPOSE_WEB_SERVER_INFO="on" - fi - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO^}/g" \ - "$HTTPD_CONF_FILE" } ################################################# @@ -247,17 +261,18 @@ echo "** Deploying Zabbix web-interface (Apache) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" if [ "$1" != "" ]; then echo "** Executing '$@'" exec "$@" -elif [ -f "/usr/sbin/httpd" ]; then - echo "** Executing HTTPD" - exec /usr/sbin/httpd -D FOREGROUND +elif [ -f "/usr/bin/supervisord" ]; then + echo "** Executing supervisord" + exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf else echo "Unknown instructions. Exiting..." exit 1 diff --git a/Dockerfiles/web-apache-mysql/centos/Dockerfile b/Dockerfiles/web-apache-mysql/centos/Dockerfile index 48985fe3b..efe44530f 100644 --- a/Dockerfiles/web-apache-mysql/centos/Dockerfile +++ b/Dockerfiles/web-apache-mysql/centos/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with MySQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ chgrp -R 0 /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ chmod -R g=u /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ @@ -125,12 +126,15 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ chgrp -R 0 /run/httpd/ /var/lib/php/session/ && \ chmod -R g=u /run/httpd/ /var/lib/php/session/ && \ microdnf -y remove \ - findutils \ - glibc-locale-source + findutils \ + glibc-locale-source + +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/99-zabbix.conf b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/99-zabbix.conf deleted file mode 100644 index c28b761b9..000000000 --- a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/99-zabbix.conf +++ /dev/null @@ -1,3 +0,0 @@ - - PidFile "/tmp/httpd.pid" - diff --git a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/mime.conf b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/mime.conf new file mode 100644 index 000000000..6dd43b1cf --- /dev/null +++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/mime.conf @@ -0,0 +1,9 @@ + + TypesConfig /etc/mime.types + + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + + + MIMEMagicFile conf/magic + diff --git a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf/httpd.conf b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf/httpd.conf new file mode 100644 index 000000000..eacc15123 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf/httpd.conf @@ -0,0 +1,75 @@ +ServerRoot /etc/httpd/ +ServerRoot /var/www +DefaultRuntimeDir /tmp/httpd/ +PidFile /tmp/httpd.pid + +ServerName 127.0.0.1 + +IncludeOptional /etc/httpd/includes.conf + +Timeout 300 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 5 + + + User ${APACHE_RUN_USER} + Group ${APACHE_RUN_GROUP} + + +HostnameLookups Off + +LogLevel warn + + + SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined + LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %O" common + LogFormat "%{Referer}i -> %U" referer + LogFormat "%{User-agent}i" agent + + CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs + + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). + + Require all denied + + +ServerTokens ${APACHE_SERVER_TOKENS} + +ServerSignature ${APACHE_SERVER_SIGNATURE} + +TraceEnable Off + +AddDefaultCharset UTF-8 + + + + SetHandler server-status + Require local + + + ExtendedStatus On + + + ProxyStatus On + + diff --git a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/includes.conf b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/includes.conf new file mode 100644 index 000000000..f7ee6da9b --- /dev/null +++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/includes.conf @@ -0,0 +1,3 @@ +IncludeOptional /etc/httpd/modules.conf + +IncludeOptional /etc/httpd/conf.d/*.conf diff --git a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/modules.conf b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/modules.conf new file mode 100644 index 000000000..e84a9daac --- /dev/null +++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/modules.conf @@ -0,0 +1,24 @@ +LoadModule logio_module /usr/lib64/httpd/modules/mod_logio.so +LoadModule unixd_module /usr/lib64/httpd/modules/mod_unixd.so +LoadModule log_config_module /usr/lib64/httpd/modules/mod_log_config.so +LoadModule access_compat_module /usr/lib64/httpd/modules/mod_access_compat.so +LoadModule auth_basic_module /usr/lib64/httpd/modules/mod_auth_basic.so +LoadModule authn_core_module /usr/lib64/httpd/modules/mod_authn_core.so +LoadModule authn_file_module /usr/lib64/httpd/modules/mod_authn_file.so +LoadModule authz_core_module /usr/lib64/httpd/modules/mod_authz_core.so +LoadModule authz_host_module /usr/lib64/httpd/modules/mod_authz_host.so +LoadModule authz_user_module /usr/lib64/httpd/modules/mod_authz_user.so +LoadModule dir_module /usr/lib64/httpd/modules/mod_dir.so +LoadModule env_module /usr/lib64/httpd/modules/mod_env.so +LoadModule filter_module /usr/lib64/httpd/modules/mod_filter.so +LoadModule mime_module /usr/lib64/httpd/modules/mod_mime.so +LoadModule mpm_event_module /usr/lib64/httpd/modules/mod_mpm_event.so +LoadModule negotiation_module /usr/lib64/httpd/modules/mod_negotiation.so +LoadModule reqtimeout_module /usr/lib64/httpd/modules/mod_reqtimeout.so +LoadModule setenvif_module /usr/lib64/httpd/modules/mod_setenvif.so +LoadModule status_module /usr/lib64/httpd/modules/mod_status.so + +LoadModule proxy_module /usr/lib64/httpd/modules/mod_proxy.so +LoadModule proxy_fcgi_module /usr/lib64/httpd/modules/mod_proxy_fcgi.so +LoadModule expires_module /usr/lib64/httpd/modules/mod_expires.so +LoadModule headers_module /usr/lib64/httpd/modules/mod_headers.so diff --git a/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache.conf b/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache.conf index e696330bf..f0a69becd 100644 --- a/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache.conf +++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache.conf @@ -1,10 +1,17 @@ +Listen 8080 + DocumentRoot /usr/share/zabbix/ + ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DirectoryIndex ${HTTP_INDEX_FILE} + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml AddType application/x-httpd-php-source .phps + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + Order Allow,Deny Allow from all @@ -20,6 +27,18 @@ SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + diff --git a/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache_ssl.conf b/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache_ssl.conf index 43faf0eff..dfa10d875 100644 --- a/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache_ssl.conf +++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache_ssl.conf @@ -1,97 +1,113 @@ -LoadModule ssl_module modules/mod_ssl.so -LoadModule socache_shmcb_module modules/mod_socache_shmcb.so +LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so +LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so Listen 8443 - - DocumentRoot /usr/share/zabbix/ - ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DocumentRoot /usr/share/zabbix/ - AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml - AddType application/x-httpd-php-source .phps + ServerName zabbix - # Enable/Disable SSL for this virtual host. - SSLEngine on + DirectoryIndex ${HTTP_INDEX_FILE} - # intermediate configuration - SSLProtocol -all +TLSv1.2 +TLSv1.3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - SSLHonorCipherOrder off - SSLSessionTickets off + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml + AddType application/x-httpd-php-source .phps - SSLCertificateFile /etc/ssl/apache2/ssl.crt - SSLCertificateKeyFile /etc/ssl/apache2/ssl.key - # SSLCACertificatePath /etc/ssl/apache2/chain/ + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 - # enable HTTP/2, if available - Protocols h2 http/1.1 + # Enable/Disable SSL for this virtual host. + SSLEngine on - # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) - Header always set Strict-Transport-Security "max-age=63072000" + # intermediate configuration + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off - - Order Allow,Deny - Allow from all + SSLCertificateFile /etc/ssl/apache2/ssl.crt + SSLCertificateKeyFile /etc/ssl/apache2/ssl.key + # SSLCACertificatePath /etc/ssl/apache2/chain/ + # enable HTTP/2, if available + Protocols h2 http/1.1 + + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" + + + Order Allow,Deny + Allow from all + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + Options FollowSymLinks + AllowOverride None + Require all granted + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" - + - - Options FollowSymLinks - AllowOverride None - Require all granted + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + - - SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" - - + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - - + + Require all denied + + Order deny,allow + Deny from all + + + diff --git a/Dockerfiles/web-apache-mysql/centos/docker-entrypoint.sh b/Dockerfiles/web-apache-mysql/centos/docker-entrypoint.sh index 6860e171f..de2b83a75 100755 --- a/Dockerfiles/web-apache-mysql/centos/docker-entrypoint.sh +++ b/Dockerfiles/web-apache-mysql/centos/docker-entrypoint.sh @@ -18,11 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} +# Default user settings +: ${DAEMON_USER:="apache"} +: ${DAEMON_GROUP:="apache"} + # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Apache main configuration file HTTPD_CONF_FILE="/etc/httpd/conf/httpd.conf" +# Apache additional configuration files directory +APACHE_SITES_DIR="/etc/httpd/conf.d" +# Directory with SSL certificate files for Apache +APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -131,7 +139,12 @@ check_db_connect() { } prepare_web_server() { - APACHE_SITES_DIR=/etc/httpd/conf.d + if [ "$(id -u)" == '0' ]; then + export APACHE_RUN_USER=${DAEMON_USER} + else + export APACHE_RUN_USER=$(id -n -u) + fi + export APACHE_RUN_GROUP=${DAEMON_GROUP} echo "** Adding Zabbix virtual host (HTTP)" if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then @@ -140,7 +153,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "/etc/ssl/apache2/ssl.crt" ] && [ -f "/etc/ssl/apache2/ssl.key" ]; then + if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then echo "** Adding Zabbix virtual host (HTTPS)" if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf" @@ -150,12 +163,28 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Apache2. Certificates are missed." fi + + export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"} + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + export APACHE_CUSTOM_LOG="/proc/self/fd/1" + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + export APACHE_CUSTOM_LOG="/dev/null" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + export APACHE_SERVER_TOKENS="OS" + export APACHE_SERVER_SIGNATURE="On" + if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then + export APACHE_SERVER_TOKENS="Prod" + export APACHE_SERVER_SIGNATURE="Off" + fi + + mkdir -p /tmp/httpd } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -165,10 +194,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - echo "user = zabbix" >> "$PHP_CONFIG_FILE" - echo "group = zabbix" >> "$PHP_CONFIG_FILE" - echo "listen.owner = nginx" >> "$PHP_CONFIG_FILE" - echo "listen.group = nginx" >> "$PHP_CONFIG_FILE" + echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -216,45 +245,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache.conf" - - if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "$HTTPD_CONF_FILE" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - if [ "${EXPOSE_WEB_SERVER_INFO}" = "off" ]; then - sed -i \ - -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \ - "$HTTPD_CONF_FILE" - else - EXPOSE_WEB_SERVER_INFO="on" - fi - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO^}/g" \ - "$HTTPD_CONF_FILE" } ################################################# @@ -263,8 +261,9 @@ echo "** Deploying Zabbix web-interface (Apache) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-apache-mysql/ol/Dockerfile b/Dockerfiles/web-apache-mysql/ol/Dockerfile index 64ed61535..ce4f319ff 100644 --- a/Dockerfiles/web-apache-mysql/ol/Dockerfile +++ b/Dockerfiles/web-apache-mysql/ol/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with MySQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ chgrp -R 0 /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ chmod -R g=u /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ @@ -112,12 +113,15 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ chgrp -R 0 /run/httpd/ /var/lib/php/session/ && \ chmod -R g=u /run/httpd/ /var/lib/php/session/ && \ microdnf -y remove \ - findutils \ - glibc-locale-source + findutils \ + glibc-locale-source + +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/99-zabbix.conf b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/99-zabbix.conf deleted file mode 100644 index c28b761b9..000000000 --- a/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/99-zabbix.conf +++ /dev/null @@ -1,3 +0,0 @@ - - PidFile "/tmp/httpd.pid" - diff --git a/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/mime.conf b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/mime.conf new file mode 100644 index 000000000..6dd43b1cf --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf.d/mime.conf @@ -0,0 +1,9 @@ + + TypesConfig /etc/mime.types + + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + + + MIMEMagicFile conf/magic + diff --git a/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf/httpd.conf b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf/httpd.conf new file mode 100644 index 000000000..eacc15123 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/conf/httpd.conf @@ -0,0 +1,75 @@ +ServerRoot /etc/httpd/ +ServerRoot /var/www +DefaultRuntimeDir /tmp/httpd/ +PidFile /tmp/httpd.pid + +ServerName 127.0.0.1 + +IncludeOptional /etc/httpd/includes.conf + +Timeout 300 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 5 + + + User ${APACHE_RUN_USER} + Group ${APACHE_RUN_GROUP} + + +HostnameLookups Off + +LogLevel warn + + + SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined + LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %O" common + LogFormat "%{Referer}i -> %U" referer + LogFormat "%{User-agent}i" agent + + CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs + + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). + + Require all denied + + +ServerTokens ${APACHE_SERVER_TOKENS} + +ServerSignature ${APACHE_SERVER_SIGNATURE} + +TraceEnable Off + +AddDefaultCharset UTF-8 + + + + SetHandler server-status + Require local + + + ExtendedStatus On + + + ProxyStatus On + + diff --git a/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/includes.conf b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/includes.conf new file mode 100644 index 000000000..f7ee6da9b --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/includes.conf @@ -0,0 +1,3 @@ +IncludeOptional /etc/httpd/modules.conf + +IncludeOptional /etc/httpd/conf.d/*.conf diff --git a/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/modules.conf b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/modules.conf new file mode 100644 index 000000000..e84a9daac --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ol/conf/etc/httpd/modules.conf @@ -0,0 +1,24 @@ +LoadModule logio_module /usr/lib64/httpd/modules/mod_logio.so +LoadModule unixd_module /usr/lib64/httpd/modules/mod_unixd.so +LoadModule log_config_module /usr/lib64/httpd/modules/mod_log_config.so +LoadModule access_compat_module /usr/lib64/httpd/modules/mod_access_compat.so +LoadModule auth_basic_module /usr/lib64/httpd/modules/mod_auth_basic.so +LoadModule authn_core_module /usr/lib64/httpd/modules/mod_authn_core.so +LoadModule authn_file_module /usr/lib64/httpd/modules/mod_authn_file.so +LoadModule authz_core_module /usr/lib64/httpd/modules/mod_authz_core.so +LoadModule authz_host_module /usr/lib64/httpd/modules/mod_authz_host.so +LoadModule authz_user_module /usr/lib64/httpd/modules/mod_authz_user.so +LoadModule dir_module /usr/lib64/httpd/modules/mod_dir.so +LoadModule env_module /usr/lib64/httpd/modules/mod_env.so +LoadModule filter_module /usr/lib64/httpd/modules/mod_filter.so +LoadModule mime_module /usr/lib64/httpd/modules/mod_mime.so +LoadModule mpm_event_module /usr/lib64/httpd/modules/mod_mpm_event.so +LoadModule negotiation_module /usr/lib64/httpd/modules/mod_negotiation.so +LoadModule reqtimeout_module /usr/lib64/httpd/modules/mod_reqtimeout.so +LoadModule setenvif_module /usr/lib64/httpd/modules/mod_setenvif.so +LoadModule status_module /usr/lib64/httpd/modules/mod_status.so + +LoadModule proxy_module /usr/lib64/httpd/modules/mod_proxy.so +LoadModule proxy_fcgi_module /usr/lib64/httpd/modules/mod_proxy_fcgi.so +LoadModule expires_module /usr/lib64/httpd/modules/mod_expires.so +LoadModule headers_module /usr/lib64/httpd/modules/mod_headers.so diff --git a/Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache.conf b/Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache.conf index e696330bf..f0a69becd 100644 --- a/Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache.conf +++ b/Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache.conf @@ -1,10 +1,17 @@ +Listen 8080 + DocumentRoot /usr/share/zabbix/ + ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DirectoryIndex ${HTTP_INDEX_FILE} + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml AddType application/x-httpd-php-source .phps + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + Order Allow,Deny Allow from all @@ -20,6 +27,18 @@ SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + diff --git a/Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache_ssl.conf b/Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache_ssl.conf index 43faf0eff..dfa10d875 100644 --- a/Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache_ssl.conf +++ b/Dockerfiles/web-apache-mysql/ol/conf/etc/zabbix/apache_ssl.conf @@ -1,97 +1,113 @@ -LoadModule ssl_module modules/mod_ssl.so -LoadModule socache_shmcb_module modules/mod_socache_shmcb.so +LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so +LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so Listen 8443 - - DocumentRoot /usr/share/zabbix/ - ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DocumentRoot /usr/share/zabbix/ - AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml - AddType application/x-httpd-php-source .phps + ServerName zabbix - # Enable/Disable SSL for this virtual host. - SSLEngine on + DirectoryIndex ${HTTP_INDEX_FILE} - # intermediate configuration - SSLProtocol -all +TLSv1.2 +TLSv1.3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - SSLHonorCipherOrder off - SSLSessionTickets off + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml + AddType application/x-httpd-php-source .phps - SSLCertificateFile /etc/ssl/apache2/ssl.crt - SSLCertificateKeyFile /etc/ssl/apache2/ssl.key - # SSLCACertificatePath /etc/ssl/apache2/chain/ + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 - # enable HTTP/2, if available - Protocols h2 http/1.1 + # Enable/Disable SSL for this virtual host. + SSLEngine on - # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) - Header always set Strict-Transport-Security "max-age=63072000" + # intermediate configuration + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off - - Order Allow,Deny - Allow from all + SSLCertificateFile /etc/ssl/apache2/ssl.crt + SSLCertificateKeyFile /etc/ssl/apache2/ssl.key + # SSLCACertificatePath /etc/ssl/apache2/chain/ + # enable HTTP/2, if available + Protocols h2 http/1.1 + + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" + + + Order Allow,Deny + Allow from all + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + Options FollowSymLinks + AllowOverride None + Require all granted + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" - + - - Options FollowSymLinks - AllowOverride None - Require all granted + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + - - SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" - - + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - - + + Require all denied + + Order deny,allow + Deny from all + + + diff --git a/Dockerfiles/web-apache-mysql/ol/docker-entrypoint.sh b/Dockerfiles/web-apache-mysql/ol/docker-entrypoint.sh index 6860e171f..de2b83a75 100755 --- a/Dockerfiles/web-apache-mysql/ol/docker-entrypoint.sh +++ b/Dockerfiles/web-apache-mysql/ol/docker-entrypoint.sh @@ -18,11 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} +# Default user settings +: ${DAEMON_USER:="apache"} +: ${DAEMON_GROUP:="apache"} + # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Apache main configuration file HTTPD_CONF_FILE="/etc/httpd/conf/httpd.conf" +# Apache additional configuration files directory +APACHE_SITES_DIR="/etc/httpd/conf.d" +# Directory with SSL certificate files for Apache +APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -131,7 +139,12 @@ check_db_connect() { } prepare_web_server() { - APACHE_SITES_DIR=/etc/httpd/conf.d + if [ "$(id -u)" == '0' ]; then + export APACHE_RUN_USER=${DAEMON_USER} + else + export APACHE_RUN_USER=$(id -n -u) + fi + export APACHE_RUN_GROUP=${DAEMON_GROUP} echo "** Adding Zabbix virtual host (HTTP)" if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then @@ -140,7 +153,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "/etc/ssl/apache2/ssl.crt" ] && [ -f "/etc/ssl/apache2/ssl.key" ]; then + if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then echo "** Adding Zabbix virtual host (HTTPS)" if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf" @@ -150,12 +163,28 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Apache2. Certificates are missed." fi + + export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"} + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + export APACHE_CUSTOM_LOG="/proc/self/fd/1" + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + export APACHE_CUSTOM_LOG="/dev/null" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + export APACHE_SERVER_TOKENS="OS" + export APACHE_SERVER_SIGNATURE="On" + if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then + export APACHE_SERVER_TOKENS="Prod" + export APACHE_SERVER_SIGNATURE="Off" + fi + + mkdir -p /tmp/httpd } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -165,10 +194,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - echo "user = zabbix" >> "$PHP_CONFIG_FILE" - echo "group = zabbix" >> "$PHP_CONFIG_FILE" - echo "listen.owner = nginx" >> "$PHP_CONFIG_FILE" - echo "listen.group = nginx" >> "$PHP_CONFIG_FILE" + echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -216,45 +245,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache.conf" - - if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "$HTTPD_CONF_FILE" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - if [ "${EXPOSE_WEB_SERVER_INFO}" = "off" ]; then - sed -i \ - -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \ - "$HTTPD_CONF_FILE" - else - EXPOSE_WEB_SERVER_INFO="on" - fi - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO^}/g" \ - "$HTTPD_CONF_FILE" } ################################################# @@ -263,8 +261,9 @@ echo "** Deploying Zabbix web-interface (Apache) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-apache-mysql/ubuntu/Dockerfile b/Dockerfiles/web-apache-mysql/ubuntu/Dockerfile index bee53e3a7..e5c0c669a 100644 --- a/Dockerfiles/web-apache-mysql/ubuntu/Dockerfile +++ b/Dockerfiles/web-apache-mysql/ubuntu/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with MySQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /usr/sbin/policy-rc.d && \ INSTALL_PKGS="bash \ tzdata \ - apache2 \ - curl \ - libapache2-mod-php \ + curl \ ca-certificates \ + curl \ mysql-client \ + apache2 \ locales \ libldap-common \ php8.3-bcmath \ + php8.3-fpm \ php8.3-gd \ php8.3-ldap \ php8.3-mbstring \ php8.3-mysql \ - php8.3-xml" && \ + php8.3-xml \ + supervisor" && \ apt-get -y update && \ DEBIAN_FRONTEND=noninteractive apt-get -y \ + -o Dpkg::Options::="--force-confdef" \ + -o Dpkg::Options::="--force-confold" \ --no-install-recommends install \ ${INSTALL_PKGS} && \ groupadd \ @@ -69,50 +74,45 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \ mkdir -p ${ZABBIX_CONF_DIR} && \ mkdir -p ${ZABBIX_CONF_DIR}/web && \ mkdir -p ${ZABBIX_CONF_DIR}/web/certs && \ + mkdir -p /var/lib/php/session && \ + find /etc/ -name '*.dpkg-dist' | xargs rm -f && \ rm -f /etc/apache2/sites-available/* && \ rm -f /etc/apache2/sites-enabled/* && \ - /usr/sbin/a2enmod ssl && \ - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /proc/self/fd/1!g' \ - -e 's!^(\s*ErrorLog)\s+\S+!\1 /proc/self/fd/2!g' \ - "/etc/apache2/apache2.conf" && \ - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /proc/self/fd/1!g' \ - -e 's!^(\s*ErrorLog)\s+\S+!\1 /proc/self/fd/2!g' \ - "/etc/apache2/conf-available/other-vhosts-access-log.conf" && \ - sed -i 's/Listen 80/Listen 8080/g' /etc/apache2/ports.conf && \ - sed -i 's/Listen 443/Listen 8443/g' /etc/apache2/ports.conf && \ - sed -i 's|/var/run/apache2$SUFFIX|/tmp|g' /etc/apache2/envvars && \ - rm -f /var/run/apache2/apache2.pid && \ - cd /usr/share/zabbix/ && \ + rm -f /etc/php/8.3/fpm/pool.d/www.conf && \ + rm -f /var/run/apache2/ && \ + cd ${ZABBIX_WWW_ROOT}/ && \ rm -f conf/zabbix.conf.php conf/maintenance.inc.php conf/zabbix.conf.php.example && \ rm -rf tests && \ rm -f locale/add_new_language.sh locale/update_po.sh locale/make_mo.sh && \ - find /usr/share/zabbix/locale -name '*.po' | xargs rm -f && \ - find /usr/share/zabbix/locale -name '*.sh' | xargs rm -f && \ - ln -s "${ZABBIX_CONF_DIR}/web/zabbix.conf.php" "/usr/share/zabbix/conf/zabbix.conf.php" && \ - ln -s "${ZABBIX_CONF_DIR}/web/maintenance.inc.php" "/usr/share/zabbix/conf/maintenance.inc.php" && \ + find ${ZABBIX_WWW_ROOT}/locale -name '*.po' | xargs rm -f && \ + find ${ZABBIX_WWW_ROOT}/locale -name '*.sh' | xargs rm -f && \ + ln -s "${ZABBIX_CONF_DIR}/web/zabbix.conf.php" "${ZABBIX_WWW_ROOT}/conf/zabbix.conf.php" && \ + ln -s "${ZABBIX_CONF_DIR}/web/maintenance.inc.php" "${ZABBIX_WWW_ROOT}/conf/maintenance.inc.php" && \ mkdir -p /var/lib/locales/supported.d/ && \ rm -f /var/lib/locales/supported.d/local && \ - cat /usr/share/zabbix/include/locales.inc.php | grep display | grep true | awk '{$1=$1};1' | \ + cat ${ZABBIX_WWW_ROOT}/include/locales.inc.php | grep display | grep true | awk '{$1=$1};1' | \ cut -d"'" -f 2 | sort | \ xargs -I '{}' bash -c 'echo "{}.UTF-8 UTF-8" >> /var/lib/locales/supported.d/local' && \ dpkg-reconfigure locales && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chown --quiet -R zabbix:root /etc/apache2/ /etc/php/8.3/ && \ - chgrp -R 0 /etc/apache2/ /etc/php/8.3/ && \ - chmod -R g=u /etc/apache2/ /etc/php/8.3/ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chown --quiet -R zabbix:root /etc/apache2/ /etc/php/8.3/fpm/ && \ + chgrp -R 0 /etc/apache2/ /etc/php/8.3/fpm/ && \ + chmod -R g=u /etc/apache2/ /etc/php/8.3/fpm/ && \ + chown --quiet -R zabbix:root /var/lib/php/session/ && \ + chgrp -R 0 /var/lib/php/session/ && \ + chmod -R g=u /var/lib/php/session/ + +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] USER 1997 ENTRYPOINT ["docker-entrypoint.sh"] - -CMD ["/usr/sbin/apache2ctl", "-D", "FOREGROUND"] diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/apache2.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/apache2.conf new file mode 100644 index 000000000..2cf9de536 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/apache2.conf @@ -0,0 +1,75 @@ +ServerRoot /etc/apache2/ +ServerRoot /var/www +DefaultRuntimeDir /tmp/apache2/ +PidFile /tmp/apache2.pid + +ServerName 127.0.0.1 + +IncludeOptional /etc/apache2/includes.conf + +Timeout 300 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 5 + + + User ${APACHE_RUN_USER} + Group ${APACHE_RUN_GROUP} + + +HostnameLookups Off + +LogLevel warn + + + SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined + LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %O" common + LogFormat "%{Referer}i -> %U" referer + LogFormat "%{User-agent}i" agent + + CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs + + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). + + Require all denied + + +ServerTokens ${APACHE_SERVER_TOKENS} + +ServerSignature ${APACHE_SERVER_SIGNATURE} + +TraceEnable Off + +AddDefaultCharset UTF-8 + + + + SetHandler server-status + Require local + + + ExtendedStatus On + + + ProxyStatus On + + diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/includes.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/includes.conf new file mode 100644 index 000000000..f6d7bdec1 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/includes.conf @@ -0,0 +1,8 @@ +IncludeOptional /etc/apache2/modules.conf + +IncludeOptional mods-enabled/mime.conf +IncludeOptional mods-enabled/negotiation.conf +IncludeOptional mods-enabled/reqtimeout.conf +IncludeOptional mods-enabled/setenvif.conf + +IncludeOptional sites-enabled/*.conf diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/modules.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/modules.conf new file mode 100644 index 000000000..8151e37b1 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/apache2/modules.conf @@ -0,0 +1,21 @@ +LoadModule access_compat_module /usr/lib/apache2/modules/mod_access_compat.so +LoadModule auth_basic_module /usr/lib/apache2/modules/mod_auth_basic.so +LoadModule authn_core_module /usr/lib/apache2/modules/mod_authn_core.so +LoadModule authn_file_module /usr/lib/apache2/modules/mod_authn_file.so +LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so +LoadModule authz_host_module /usr/lib/apache2/modules/mod_authz_host.so +LoadModule authz_user_module /usr/lib/apache2/modules/mod_authz_user.so +LoadModule dir_module /usr/lib/apache2/modules/mod_dir.so +LoadModule env_module /usr/lib/apache2/modules/mod_env.so +LoadModule filter_module /usr/lib/apache2/modules/mod_filter.so +LoadModule mime_module /usr/lib/apache2/modules/mod_mime.so +LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so +LoadModule negotiation_module /usr/lib/apache2/modules/mod_negotiation.so +LoadModule reqtimeout_module /usr/lib/apache2/modules/mod_reqtimeout.so +LoadModule setenvif_module /usr/lib/apache2/modules/mod_setenvif.so +LoadModule status_module /usr/lib/apache2/modules/mod_status.so + +LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so +LoadModule proxy_fcgi_module /usr/lib/apache2/modules/mod_proxy_fcgi.so +LoadModule expires_module /usr/lib/apache2/modules/mod_expires.so +LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/apache2/conf.d/99-zabbix.ini b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/apache2/conf.d/99-zabbix.ini deleted file mode 100644 index e180720b9..000000000 --- a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/apache2/conf.d/99-zabbix.ini +++ /dev/null @@ -1,10 +0,0 @@ -max_execution_time = ${ZBX_MAXEXECUTIONTIME} -memory_limit = ${ZBX_MEMORYLIMIT} -post_max_size = ${ZBX_POSTMAXSIZE} -upload_max_filesize = ${ZBX_UPLOADMAXFILESIZE} -max_input_time = ${ZBX_MAXINPUTTIME} -; always_populate_raw_post_data=-1 -max_input_vars = 10000 -date.timezone = ${PHP_TZ} -; https://www.php.net/manual/en/security.hiding.php -expose_php = ${EXPOSE_WEB_SERVER_INFO} diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf new file mode 100644 index 000000000..5311405bf --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf @@ -0,0 +1,10 @@ +include=/etc/php/8.3/fpm/pool.d/*.conf + +[global] + +pid = /tmp/php-fpm.pid + +error_log = /dev/fd/2 +log_level = notice + +daemonize = no diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/fpm/pool.d/zabbix.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/fpm/pool.d/zabbix.conf new file mode 100644 index 000000000..66c3c1252 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/php/8.3/fpm/pool.d/zabbix.conf @@ -0,0 +1,36 @@ +[zabbix] + +; https://www.php.net/manual/en/security.hiding.php +php_value[expose_php] = ${EXPOSE_WEB_SERVER_INFO} + +listen = /tmp/php-fpm.sock + +clear_env = no + +pm = ${PHP_FPM_PM} +pm.max_children = ${PHP_FPM_PM_MAX_CHILDREN} +pm.start_servers = ${PHP_FPM_PM_START_SERVERS} +pm.min_spare_servers = ${PHP_FPM_PM_MIN_SPARE_SERVERS} +pm.max_spare_servers = ${PHP_FPM_PM_MAX_SPARE_SERVERS} +pm.max_requests = ${PHP_FPM_PM_MAX_REQUESTS} + +slowlog = /dev/fd/1 + +php_admin_value[error_log] = /dev/fd/2 +php_admin_flag[log_errors] = on +catch_workers_output = yes + +php_value[session.save_handler] = files +php_value[session.save_path] = /var/lib/php/session + +php_value[max_execution_time] = ${ZBX_MAXEXECUTIONTIME} +php_value[memory_limit] = ${ZBX_MEMORYLIMIT} +php_value[post_max_size] = ${ZBX_POSTMAXSIZE} +php_value[upload_max_filesize] = ${ZBX_UPLOADMAXFILESIZE} +php_value[max_input_time] = ${ZBX_MAXINPUTTIME} +php_value[max_input_vars] = 10000 +php_value[date.timezone] = ${PHP_TZ} + +; PHP-FPM monitoring +pm.status_path = /status +ping.path = /ping diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/supervisor/conf.d/supervisord_zabbix.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/supervisor/conf.d/supervisord_zabbix.conf new file mode 100644 index 000000000..04c8578fb --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/supervisor/conf.d/supervisord_zabbix.conf @@ -0,0 +1,30 @@ +[supervisord] +nodaemon = true + +[program:apache2] +command = /usr/sbin/%(program_name)s -D FOREGROUND +auto_start = true +autorestart = true + +startsecs=2 +startretries=3 +stopsignal=TERM +stopwaitsecs=2 + +redirect_stderr=true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 + +[program:php-fpm8.3] +command = /usr/sbin/%(program_name)s -F -y /etc/php/8.3/fpm/php-fpm.conf +auto_start = true +autorestart = true + +startsecs=2 +startretries=3 +stopsignal=TERM +stopwaitsecs=2 + +redirect_stderr=true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/supervisor/supervisord.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/supervisor/supervisord.conf new file mode 100644 index 000000000..f8d80e461 --- /dev/null +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/supervisor/supervisord.conf @@ -0,0 +1,35 @@ +; supervisor config file + +[unix_http_server] +file = /tmp/supervisor.sock ; (the path to the socket file) +chmod = 0700 ; sockef file mode (default 0700) +username = zbx +password = password + +[supervisord] +logfile = /dev/stdout ; (main log file;default $CWD/supervisord.log) +pidfile = /tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid) +childlogdir = /tmp ; ('AUTO' child log dir, default $TEMP) +critical = critical +;user = zabbix +logfile_maxbytes = 0 +logfile_backupcount = 0 +loglevel = info + +; the below section must remain in the config file for RPC +; (supervisorctl/web interface) to work, additional interfaces may be +; added by defining them in separate rpcinterface: sections +[rpcinterface:supervisor] +supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface + +[supervisorctl] +serverurl = unix:///tmp/supervisor.sock ; use a unix:// URL for a unix socket + +; The [include] section can just contain the "files" setting. This +; setting can list multiple files (separated by whitespace or +; newlines). It can also contain wildcards. The filenames are +; interpreted as relative to this file. Included files *cannot* +; include files themselves. + +[include] +files = /etc/supervisor/conf.d/*.conf diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache.conf index b32e8167f..f0a69becd 100644 --- a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache.conf +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache.conf @@ -1,14 +1,44 @@ +Listen 8080 + DocumentRoot /usr/share/zabbix/ + ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DirectoryIndex ${HTTP_INDEX_FILE} + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml AddType application/x-httpd-php-source .phps + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + + + Order Allow,Deny + Allow from all + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + Options FollowSymLinks AllowOverride None Require all granted + + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_envvars b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_envvars deleted file mode 100644 index 7826620ba..000000000 --- a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_envvars +++ /dev/null @@ -1,4 +0,0 @@ -export APACHE_RUN_USER=$(id -n -u) -export APACHE_RUN_GROUP=www-data -export APACHE_PID_FILE=/tmp/apache2.pid -export APACHE_RUN_DIR=/tmp/apache2 diff --git a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_ssl.conf b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_ssl.conf index a26afff0a..b46e7f800 100644 --- a/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_ssl.conf +++ b/Dockerfiles/web-apache-mysql/ubuntu/conf/etc/zabbix/apache_ssl.conf @@ -1,87 +1,113 @@ LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so -LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so - - - DocumentRoot /usr/share/zabbix/ - ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} +Listen 8443 - AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml - AddType application/x-httpd-php-source .phps + + DocumentRoot /usr/share/zabbix/ - # Enable/Disable SSL for this virtual host. - SSLEngine on + ServerName zabbix - # intermediate configuration - SSLProtocol -all +TLSv1.2 +TLSv1.3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - SSLHonorCipherOrder off - SSLSessionTickets off + DirectoryIndex ${HTTP_INDEX_FILE} - SSLCertificateFile /etc/ssl/apache2/ssl.crt - SSLCertificateKeyFile /etc/ssl/apache2/ssl.key - # SSLCACertificatePath /etc/ssl/apache2/chain/ + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml + AddType application/x-httpd-php-source .phps - # enable HTTP/2, if available - Protocols h2 http/1.1 + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 - # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) - Header always set Strict-Transport-Security "max-age=63072000" + # Enable/Disable SSL for this virtual host. + SSLEngine on - - Options FollowSymLinks - AllowOverride None - Require all granted - + # intermediate configuration + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off - - Require all denied - - Order deny,allow - Deny from all - - + SSLCertificateFile /etc/ssl/apache2/ssl.crt + SSLCertificateKeyFile /etc/ssl/apache2/ssl.key + # SSLCACertificatePath /etc/ssl/apache2/chain/ - - Require all denied - - Order deny,allow - Deny from all - - + # enable HTTP/2, if available + Protocols h2 http/1.1 - - Require all denied - - Order deny,allow - Deny from all - - + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" - - Require all denied - - Order deny,allow - Deny from all - - + + Order Allow,Deny + Allow from all - - Require all denied - - Order deny,allow - Deny from all - - + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + - - Require all denied - - Order deny,allow - Deny from all - - - - + + Options FollowSymLinks + AllowOverride None + Require all granted + + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + diff --git a/Dockerfiles/web-apache-mysql/ubuntu/docker-entrypoint.sh b/Dockerfiles/web-apache-mysql/ubuntu/docker-entrypoint.sh index fcc8c9cd6..72fcfa34e 100755 --- a/Dockerfiles/web-apache-mysql/ubuntu/docker-entrypoint.sh +++ b/Dockerfiles/web-apache-mysql/ubuntu/docker-entrypoint.sh @@ -18,13 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} +# Default user settings +: ${DAEMON_USER:="www-data"} +: ${DAEMON_GROUP:="www-data"} + # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Apache main configuration file HTTPD_CONF_FILE="/etc/apache2/apache2.conf" -# Apache security configuration file -HTTPD_SECURITY_CONF_FILE="/etc/apache2/conf-enabled/security.conf" +# Apache additional configuration files directory +APACHE_SITES_DIR="/etc/apache2/sites-enabled" +# Directory with SSL certificate files for Apache +APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php/8.3/fpm/pool.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -133,9 +139,12 @@ check_db_connect() { } prepare_web_server() { - APACHE_SITES_DIR="/etc/apache2/sites-enabled" - - ln -sfT "$ZABBIX_CONF_DIR/apache_envvars" "/etc/apache2/envvars" + if [ "$(id -u)" == '0' ]; then + export APACHE_RUN_USER=${DAEMON_USER} + else + export APACHE_RUN_USER=$(id -n -u) + fi + export APACHE_RUN_GROUP=${DAEMON_GROUP} echo "** Adding Zabbix virtual host (HTTP)" if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then @@ -144,7 +153,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "/etc/ssl/apache2/ssl.crt" ] && [ -f "/etc/ssl/apache2/ssl.key" ]; then + if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then echo "** Adding Zabbix virtual host (HTTPS)" if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf" @@ -154,10 +163,42 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Apache2. Certificates are missed." fi + + export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"} + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + export APACHE_CUSTOM_LOG="/proc/self/fd/1" + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + export APACHE_CUSTOM_LOG="/dev/null" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + export APACHE_SERVER_TOKENS="OS" + export APACHE_SERVER_SIGNATURE="On" + if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then + export APACHE_SERVER_TOKENS="Prod" + export APACHE_SERVER_SIGNATURE="Off" + fi + + mkdir -p /tmp/apache2 } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" + + export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} + export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} + export PHP_FPM_PM_START_SERVERS=${PHP_FPM_PM_START_SERVERS:-"5"} + export PHP_FPM_PM_MIN_SPARE_SERVERS=${PHP_FPM_PM_MIN_SPARE_SERVERS:-"5"} + export PHP_FPM_PM_MAX_SPARE_SERVERS=${PHP_FPM_PM_MAX_SPARE_SERVERS:-"35"} + export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} + + if [ "$(id -u)" == '0' ]; then + echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + fi : ${ZBX_DENY_GUI_ACCESS:="false"} export ZBX_DENY_GUI_ACCESS=${ZBX_DENY_GUI_ACCESS,,} @@ -204,48 +245,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache.conf" - - if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "$HTTPD_CONF_FILE" - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "/etc/apache2/conf-available/other-vhosts-access-log.conf" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - - if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then - sed -i \ - -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \ - "$HTTPD_SECURITY_CONF_FILE" - fi - - sed -i \ - -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO}/g" \ - "$HTTPD_SECURITY_CONF_FILE" } ################################################# @@ -254,17 +261,18 @@ echo "** Deploying Zabbix web-interface (Apache) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" if [ "$1" != "" ]; then echo "** Executing '$@'" exec "$@" -elif [ -f "/usr/sbin/httpd" ]; then - echo "** Executing HTTPD" - exec /usr/sbin/httpd -D FOREGROUND +elif [ -f "/usr/bin/supervisord" ]; then + echo "** Executing supervisord" + exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf else echo "Unknown instructions. Exiting..." exit 1 diff --git a/Dockerfiles/web-apache-pgsql/alpine/Dockerfile b/Dockerfiles/web-apache-pgsql/alpine/Dockerfile index 3ef0020f6..9b06176d4 100644 --- a/Dockerfiles/web-apache-pgsql/alpine/Dockerfile +++ b/Dockerfiles/web-apache-pgsql/alpine/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with PostgreSQL database support" \ @@ -28,17 +29,17 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov + TypesConfig /etc/apache2/mime.types + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + + + MIMEMagicFile /etc/apache2/magic + diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/httpd.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/httpd.conf new file mode 100644 index 000000000..2cf9de536 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/httpd.conf @@ -0,0 +1,75 @@ +ServerRoot /etc/apache2/ +ServerRoot /var/www +DefaultRuntimeDir /tmp/apache2/ +PidFile /tmp/apache2.pid + +ServerName 127.0.0.1 + +IncludeOptional /etc/apache2/includes.conf + +Timeout 300 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 5 + + + User ${APACHE_RUN_USER} + Group ${APACHE_RUN_GROUP} + + +HostnameLookups Off + +LogLevel warn + + + SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined + LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %O" common + LogFormat "%{Referer}i -> %U" referer + LogFormat "%{User-agent}i" agent + + CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs + + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). + + Require all denied + + +ServerTokens ${APACHE_SERVER_TOKENS} + +ServerSignature ${APACHE_SERVER_SIGNATURE} + +TraceEnable Off + +AddDefaultCharset UTF-8 + + + + SetHandler server-status + Require local + + + ExtendedStatus On + + + ProxyStatus On + + diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/includes.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/includes.conf new file mode 100644 index 000000000..1c093db0b --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/includes.conf @@ -0,0 +1,3 @@ +IncludeOptional /etc/apache2/modules.conf + +IncludeOptional /etc/apache2/conf.d/*.conf diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/modules.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/modules.conf new file mode 100644 index 000000000..4f642f8e9 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/apache2/modules.conf @@ -0,0 +1,24 @@ +LoadModule logio_module modules/mod_logio.so +LoadModule unixd_module modules/mod_unixd.so +LoadModule log_config_module modules/mod_log_config.so +LoadModule access_compat_module modules/mod_access_compat.so +LoadModule auth_basic_module modules/mod_auth_basic.so +LoadModule authn_core_module modules/mod_authn_core.so +LoadModule authn_file_module modules/mod_authn_file.so +LoadModule authz_core_module modules/mod_authz_core.so +LoadModule authz_host_module modules/mod_authz_host.so +LoadModule authz_user_module modules/mod_authz_user.so +LoadModule dir_module modules/mod_dir.so +LoadModule env_module modules/mod_env.so +LoadModule filter_module modules/mod_filter.so +LoadModule mime_module modules/mod_mime.so +LoadModule mpm_event_module modules/mod_mpm_event.so +LoadModule negotiation_module modules/mod_negotiation.so +LoadModule reqtimeout_module modules/mod_reqtimeout.so +LoadModule setenvif_module modules/mod_setenvif.so +LoadModule status_module modules/mod_status.so + +LoadModule proxy_module modules/mod_proxy.so +LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so +LoadModule expires_module modules/mod_expires.so +LoadModule headers_module modules/mod_headers.so diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/conf.d/99-zabbix.ini b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/conf.d/99-zabbix.ini deleted file mode 100644 index e180720b9..000000000 --- a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/conf.d/99-zabbix.ini +++ /dev/null @@ -1,10 +0,0 @@ -max_execution_time = ${ZBX_MAXEXECUTIONTIME} -memory_limit = ${ZBX_MEMORYLIMIT} -post_max_size = ${ZBX_POSTMAXSIZE} -upload_max_filesize = ${ZBX_UPLOADMAXFILESIZE} -max_input_time = ${ZBX_MAXINPUTTIME} -; always_populate_raw_post_data=-1 -max_input_vars = 10000 -date.timezone = ${PHP_TZ} -; https://www.php.net/manual/en/security.hiding.php -expose_php = ${EXPOSE_WEB_SERVER_INFO} diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/php-fpm.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/php-fpm.conf new file mode 100644 index 000000000..e23aa2d90 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/php-fpm.conf @@ -0,0 +1,10 @@ +include=/etc/php83/php-fpm.d/*.conf + +[global] + +pid = /tmp/php-fpm.pid + +error_log = /dev/fd/2 +log_level = notice + +daemonize = no diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/php-fpm.d/zabbix.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/php-fpm.d/zabbix.conf new file mode 100644 index 000000000..66c3c1252 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/php83/php-fpm.d/zabbix.conf @@ -0,0 +1,36 @@ +[zabbix] + +; https://www.php.net/manual/en/security.hiding.php +php_value[expose_php] = ${EXPOSE_WEB_SERVER_INFO} + +listen = /tmp/php-fpm.sock + +clear_env = no + +pm = ${PHP_FPM_PM} +pm.max_children = ${PHP_FPM_PM_MAX_CHILDREN} +pm.start_servers = ${PHP_FPM_PM_START_SERVERS} +pm.min_spare_servers = ${PHP_FPM_PM_MIN_SPARE_SERVERS} +pm.max_spare_servers = ${PHP_FPM_PM_MAX_SPARE_SERVERS} +pm.max_requests = ${PHP_FPM_PM_MAX_REQUESTS} + +slowlog = /dev/fd/1 + +php_admin_value[error_log] = /dev/fd/2 +php_admin_flag[log_errors] = on +catch_workers_output = yes + +php_value[session.save_handler] = files +php_value[session.save_path] = /var/lib/php/session + +php_value[max_execution_time] = ${ZBX_MAXEXECUTIONTIME} +php_value[memory_limit] = ${ZBX_MEMORYLIMIT} +php_value[post_max_size] = ${ZBX_POSTMAXSIZE} +php_value[upload_max_filesize] = ${ZBX_UPLOADMAXFILESIZE} +php_value[max_input_time] = ${ZBX_MAXINPUTTIME} +php_value[max_input_vars] = 10000 +php_value[date.timezone] = ${PHP_TZ} + +; PHP-FPM monitoring +pm.status_path = /status +ping.path = /ping diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/supervisor/conf.d/supervisord_zabbix.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/supervisor/conf.d/supervisord_zabbix.conf new file mode 100644 index 000000000..447141984 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/supervisor/conf.d/supervisord_zabbix.conf @@ -0,0 +1,30 @@ +[supervisord] +nodaemon = true + +[program:httpd] +command = /usr/sbin/%(program_name)s -D FOREGROUND +auto_start = true +autorestart = true + +startsecs=2 +startretries=3 +stopsignal=TERM +stopwaitsecs=2 + +redirect_stderr=true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 + +[program:php-fpm83] +command = /usr/sbin/%(program_name)s -F -y /etc/php83/php-fpm.conf +auto_start = true +autorestart = true + +startsecs=2 +startretries=3 +stopsignal=TERM +stopwaitsecs=2 + +redirect_stderr=true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/supervisor/supervisord.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/supervisor/supervisord.conf new file mode 100644 index 000000000..f8d80e461 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/supervisor/supervisord.conf @@ -0,0 +1,35 @@ +; supervisor config file + +[unix_http_server] +file = /tmp/supervisor.sock ; (the path to the socket file) +chmod = 0700 ; sockef file mode (default 0700) +username = zbx +password = password + +[supervisord] +logfile = /dev/stdout ; (main log file;default $CWD/supervisord.log) +pidfile = /tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid) +childlogdir = /tmp ; ('AUTO' child log dir, default $TEMP) +critical = critical +;user = zabbix +logfile_maxbytes = 0 +logfile_backupcount = 0 +loglevel = info + +; the below section must remain in the config file for RPC +; (supervisorctl/web interface) to work, additional interfaces may be +; added by defining them in separate rpcinterface: sections +[rpcinterface:supervisor] +supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface + +[supervisorctl] +serverurl = unix:///tmp/supervisor.sock ; use a unix:// URL for a unix socket + +; The [include] section can just contain the "files" setting. This +; setting can list multiple files (separated by whitespace or +; newlines). It can also contain wildcards. The filenames are +; interpreted as relative to this file. Included files *cannot* +; include files themselves. + +[include] +files = /etc/supervisor/conf.d/*.conf diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/zabbix/apache.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/zabbix/apache.conf index b32e8167f..f0a69becd 100644 --- a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/zabbix/apache.conf +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/zabbix/apache.conf @@ -1,14 +1,44 @@ +Listen 8080 + DocumentRoot /usr/share/zabbix/ + ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DirectoryIndex ${HTTP_INDEX_FILE} + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml AddType application/x-httpd-php-source .phps + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + + + Order Allow,Deny + Allow from all + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + Options FollowSymLinks AllowOverride None Require all granted + + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + diff --git a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/zabbix/apache_ssl.conf b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/zabbix/apache_ssl.conf index 92b08a986..768da0d1b 100644 --- a/Dockerfiles/web-apache-pgsql/alpine/conf/etc/zabbix/apache_ssl.conf +++ b/Dockerfiles/web-apache-pgsql/alpine/conf/etc/zabbix/apache_ssl.conf @@ -3,86 +3,111 @@ LoadModule socache_shmcb_module modules/mod_socache_shmcb.so Listen 8443 - - - DocumentRoot /usr/share/zabbix/ - ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DocumentRoot /usr/share/zabbix/ - AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml - AddType application/x-httpd-php-source .phps + ServerName zabbix - # Enable/Disable SSL for this virtual host. - SSLEngine on + DirectoryIndex ${HTTP_INDEX_FILE} - # intermediate configuration - SSLProtocol -all +TLSv1.2 +TLSv1.3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - SSLHonorCipherOrder off - SSLSessionTickets off + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml + AddType application/x-httpd-php-source .phps - SSLCertificateFile /etc/ssl/apache2/ssl.crt - SSLCertificateKeyFile /etc/ssl/apache2/ssl.key - # SSLCACertificatePath /etc/ssl/apache2/chain/ + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 - # enable HTTP/2, if available - Protocols h2 http/1.1 + # Enable/Disable SSL for this virtual host. + SSLEngine on - # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) - Header always set Strict-Transport-Security "max-age=63072000" + # intermediate configuration + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off - - Options FollowSymLinks - AllowOverride None - Require all granted - + SSLCertificateFile /etc/ssl/apache2/ssl.crt + SSLCertificateKeyFile /etc/ssl/apache2/ssl.key + # SSLCACertificatePath /etc/ssl/apache2/chain/ - - Require all denied - - Order deny,allow - Deny from all - - + # enable HTTP/2, if available + Protocols h2 http/1.1 - - Require all denied - - Order deny,allow - Deny from all - - + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" - - Require all denied - - Order deny,allow - Deny from all - - + + Order Allow,Deny + Allow from all - - Require all denied - - Order deny,allow - Deny from all - - + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + - - Require all denied - - Order deny,allow - Deny from all - - + + Options FollowSymLinks + AllowOverride None + Require all granted - - Require all denied - - Order deny,allow - Deny from all - - - - + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + diff --git a/Dockerfiles/web-apache-pgsql/alpine/docker-entrypoint.sh b/Dockerfiles/web-apache-pgsql/alpine/docker-entrypoint.sh index fa87faf19..d33d2b21f 100755 --- a/Dockerfiles/web-apache-pgsql/alpine/docker-entrypoint.sh +++ b/Dockerfiles/web-apache-pgsql/alpine/docker-entrypoint.sh @@ -18,11 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} +# Default user settings +: ${DAEMON_USER:="apache"} +: ${DAEMON_GROUP:="apache"} + # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Apache main configuration file HTTPD_CONF_FILE="/etc/apache2/httpd.conf" +# Apache additional configuration files directory +APACHE_SITES_DIR="/etc/apache2/conf.d" +# Directory with SSL certificate files for Apache +APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php83/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -130,7 +138,12 @@ check_db_connect() { } prepare_web_server() { - APACHE_SITES_DIR=/etc/apache2/conf.d + if [ "$(id -u)" == '0' ]; then + export APACHE_RUN_USER=${DAEMON_USER} + else + export APACHE_RUN_USER=$(id -n -u) + fi + export APACHE_RUN_GROUP=${DAEMON_GROUP} echo "** Adding Zabbix virtual host (HTTP)" if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then @@ -139,7 +152,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "/etc/ssl/apache2/ssl.crt" ] && [ -f "/etc/ssl/apache2/ssl.key" ]; then + if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then echo "** Adding Zabbix virtual host (HTTPS)" if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf" @@ -149,10 +162,42 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Apache2. Certificates are missed." fi + + export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"} + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + export APACHE_CUSTOM_LOG="/proc/self/fd/1" + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + export APACHE_CUSTOM_LOG="/dev/null" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + export APACHE_SERVER_TOKENS="OS" + export APACHE_SERVER_SIGNATURE="On" + if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then + export APACHE_SERVER_TOKENS="Prod" + export APACHE_SERVER_SIGNATURE="Off" + fi + + mkdir -p /tmp/apache2 } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" + + export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} + export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} + export PHP_FPM_PM_START_SERVERS=${PHP_FPM_PM_START_SERVERS:-"5"} + export PHP_FPM_PM_MIN_SPARE_SERVERS=${PHP_FPM_PM_MIN_SPARE_SERVERS:-"5"} + export PHP_FPM_PM_MAX_SPARE_SERVERS=${PHP_FPM_PM_MAX_SPARE_SERVERS:-"35"} + export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} + + if [ "$(id -u)" == '0' ]; then + echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + fi : ${ZBX_DENY_GUI_ACCESS:="false"} export ZBX_DENY_GUI_ACCESS=${ZBX_DENY_GUI_ACCESS,,} @@ -199,45 +244,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache.conf" - - if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "$HTTPD_CONF_FILE" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - if [ "${EXPOSE_WEB_SERVER_INFO}" = "off" ]; then - sed -i \ - -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \ - "$HTTPD_CONF_FILE" - else - EXPOSE_WEB_SERVER_INFO="on" - fi - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO^}/g" \ - "$HTTPD_CONF_FILE" } ################################################# @@ -246,17 +260,18 @@ echo "** Deploying Zabbix web-interface (Apache) with PostgreSQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" if [ "$1" != "" ]; then echo "** Executing '$@'" exec "$@" -elif [ -f "/usr/sbin/httpd" ]; then - echo "** Executing HTTPD" - exec /usr/sbin/httpd -D FOREGROUND +elif [ -f "/usr/bin/supervisord" ]; then + echo "** Executing supervisord" + exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf else echo "Unknown instructions. Exiting..." exit 1 diff --git a/Dockerfiles/web-apache-pgsql/centos/Dockerfile b/Dockerfiles/web-apache-pgsql/centos/Dockerfile index b58c6b081..6b3636624 100644 --- a/Dockerfiles/web-apache-pgsql/centos/Dockerfile +++ b/Dockerfiles/web-apache-pgsql/centos/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with PostgreSQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ chgrp -R 0 /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ chmod -R g=u /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ @@ -126,12 +127,15 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ chgrp -R 0 /run/httpd/ /var/lib/php/session/ && \ chmod -R g=u /run/httpd/ /var/lib/php/session/ && \ microdnf -y remove \ - findutils \ - glibc-locale-source + findutils \ + glibc-locale-source + +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit ` EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/99-zabbix.conf b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/99-zabbix.conf deleted file mode 100644 index c28b761b9..000000000 --- a/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/99-zabbix.conf +++ /dev/null @@ -1,3 +0,0 @@ - - PidFile "/tmp/httpd.pid" - diff --git a/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/mime.conf b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/mime.conf new file mode 100644 index 000000000..6dd43b1cf --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf.d/mime.conf @@ -0,0 +1,9 @@ + + TypesConfig /etc/mime.types + + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + + + MIMEMagicFile conf/magic + diff --git a/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf/httpd.conf b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf/httpd.conf new file mode 100644 index 000000000..eacc15123 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/conf/httpd.conf @@ -0,0 +1,75 @@ +ServerRoot /etc/httpd/ +ServerRoot /var/www +DefaultRuntimeDir /tmp/httpd/ +PidFile /tmp/httpd.pid + +ServerName 127.0.0.1 + +IncludeOptional /etc/httpd/includes.conf + +Timeout 300 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 5 + + + User ${APACHE_RUN_USER} + Group ${APACHE_RUN_GROUP} + + +HostnameLookups Off + +LogLevel warn + + + SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined + LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %O" common + LogFormat "%{Referer}i -> %U" referer + LogFormat "%{User-agent}i" agent + + CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs + + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). + + Require all denied + + +ServerTokens ${APACHE_SERVER_TOKENS} + +ServerSignature ${APACHE_SERVER_SIGNATURE} + +TraceEnable Off + +AddDefaultCharset UTF-8 + + + + SetHandler server-status + Require local + + + ExtendedStatus On + + + ProxyStatus On + + diff --git a/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/includes.conf b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/includes.conf new file mode 100644 index 000000000..f7ee6da9b --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/includes.conf @@ -0,0 +1,3 @@ +IncludeOptional /etc/httpd/modules.conf + +IncludeOptional /etc/httpd/conf.d/*.conf diff --git a/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/modules.conf b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/modules.conf new file mode 100644 index 000000000..e84a9daac --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/centos/conf/etc/httpd/modules.conf @@ -0,0 +1,24 @@ +LoadModule logio_module /usr/lib64/httpd/modules/mod_logio.so +LoadModule unixd_module /usr/lib64/httpd/modules/mod_unixd.so +LoadModule log_config_module /usr/lib64/httpd/modules/mod_log_config.so +LoadModule access_compat_module /usr/lib64/httpd/modules/mod_access_compat.so +LoadModule auth_basic_module /usr/lib64/httpd/modules/mod_auth_basic.so +LoadModule authn_core_module /usr/lib64/httpd/modules/mod_authn_core.so +LoadModule authn_file_module /usr/lib64/httpd/modules/mod_authn_file.so +LoadModule authz_core_module /usr/lib64/httpd/modules/mod_authz_core.so +LoadModule authz_host_module /usr/lib64/httpd/modules/mod_authz_host.so +LoadModule authz_user_module /usr/lib64/httpd/modules/mod_authz_user.so +LoadModule dir_module /usr/lib64/httpd/modules/mod_dir.so +LoadModule env_module /usr/lib64/httpd/modules/mod_env.so +LoadModule filter_module /usr/lib64/httpd/modules/mod_filter.so +LoadModule mime_module /usr/lib64/httpd/modules/mod_mime.so +LoadModule mpm_event_module /usr/lib64/httpd/modules/mod_mpm_event.so +LoadModule negotiation_module /usr/lib64/httpd/modules/mod_negotiation.so +LoadModule reqtimeout_module /usr/lib64/httpd/modules/mod_reqtimeout.so +LoadModule setenvif_module /usr/lib64/httpd/modules/mod_setenvif.so +LoadModule status_module /usr/lib64/httpd/modules/mod_status.so + +LoadModule proxy_module /usr/lib64/httpd/modules/mod_proxy.so +LoadModule proxy_fcgi_module /usr/lib64/httpd/modules/mod_proxy_fcgi.so +LoadModule expires_module /usr/lib64/httpd/modules/mod_expires.so +LoadModule headers_module /usr/lib64/httpd/modules/mod_headers.so diff --git a/Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache.conf b/Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache.conf index e696330bf..f0a69becd 100644 --- a/Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache.conf +++ b/Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache.conf @@ -1,10 +1,17 @@ +Listen 8080 + DocumentRoot /usr/share/zabbix/ + ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DirectoryIndex ${HTTP_INDEX_FILE} + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml AddType application/x-httpd-php-source .phps + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + Order Allow,Deny Allow from all @@ -20,6 +27,18 @@ SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + diff --git a/Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache_ssl.conf b/Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache_ssl.conf index 43faf0eff..dfa10d875 100644 --- a/Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache_ssl.conf +++ b/Dockerfiles/web-apache-pgsql/centos/conf/etc/zabbix/apache_ssl.conf @@ -1,97 +1,113 @@ -LoadModule ssl_module modules/mod_ssl.so -LoadModule socache_shmcb_module modules/mod_socache_shmcb.so +LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so +LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so Listen 8443 - - DocumentRoot /usr/share/zabbix/ - ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DocumentRoot /usr/share/zabbix/ - AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml - AddType application/x-httpd-php-source .phps + ServerName zabbix - # Enable/Disable SSL for this virtual host. - SSLEngine on + DirectoryIndex ${HTTP_INDEX_FILE} - # intermediate configuration - SSLProtocol -all +TLSv1.2 +TLSv1.3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - SSLHonorCipherOrder off - SSLSessionTickets off + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml + AddType application/x-httpd-php-source .phps - SSLCertificateFile /etc/ssl/apache2/ssl.crt - SSLCertificateKeyFile /etc/ssl/apache2/ssl.key - # SSLCACertificatePath /etc/ssl/apache2/chain/ + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 - # enable HTTP/2, if available - Protocols h2 http/1.1 + # Enable/Disable SSL for this virtual host. + SSLEngine on - # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) - Header always set Strict-Transport-Security "max-age=63072000" + # intermediate configuration + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off - - Order Allow,Deny - Allow from all + SSLCertificateFile /etc/ssl/apache2/ssl.crt + SSLCertificateKeyFile /etc/ssl/apache2/ssl.key + # SSLCACertificatePath /etc/ssl/apache2/chain/ + # enable HTTP/2, if available + Protocols h2 http/1.1 + + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" + + + Order Allow,Deny + Allow from all + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + Options FollowSymLinks + AllowOverride None + Require all granted + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" - + - - Options FollowSymLinks - AllowOverride None - Require all granted + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + - - SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" - - + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - - + + Require all denied + + Order deny,allow + Deny from all + + + diff --git a/Dockerfiles/web-apache-pgsql/centos/docker-entrypoint.sh b/Dockerfiles/web-apache-pgsql/centos/docker-entrypoint.sh index b49ef0bf3..2d4210fb4 100755 --- a/Dockerfiles/web-apache-pgsql/centos/docker-entrypoint.sh +++ b/Dockerfiles/web-apache-pgsql/centos/docker-entrypoint.sh @@ -18,11 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} +# Default user settings +: ${DAEMON_USER:="apache"} +: ${DAEMON_GROUP:="apache"} + # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Apache main configuration file HTTPD_CONF_FILE="/etc/httpd/conf/httpd.conf" +# Apache additional configuration files directory +APACHE_SITES_DIR="/etc/httpd/conf.d" +# Directory with SSL certificate files for Apache +APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -130,7 +138,12 @@ check_db_connect() { } prepare_web_server() { - APACHE_SITES_DIR=/etc/httpd/conf.d + if [ "$(id -u)" == '0' ]; then + export APACHE_RUN_USER=${DAEMON_USER} + else + export APACHE_RUN_USER=$(id -n -u) + fi + export APACHE_RUN_GROUP=${DAEMON_GROUP} echo "** Adding Zabbix virtual host (HTTP)" if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then @@ -139,7 +152,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "/etc/ssl/apache2/ssl.crt" ] && [ -f "/etc/ssl/apache2/ssl.key" ]; then + if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then echo "** Adding Zabbix virtual host (HTTPS)" if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf" @@ -149,12 +162,28 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Apache2. Certificates are missed." fi + + export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"} + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + export APACHE_CUSTOM_LOG="/proc/self/fd/1" + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + export APACHE_CUSTOM_LOG="/dev/null" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + export APACHE_SERVER_TOKENS="OS" + export APACHE_SERVER_SIGNATURE="On" + if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then + export APACHE_SERVER_TOKENS="Prod" + export APACHE_SERVER_SIGNATURE="Off" + fi + + mkdir -p /tmp/httpd } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -164,10 +193,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - echo "user = zabbix" >> "$PHP_CONFIG_FILE" - echo "group = zabbix" >> "$PHP_CONFIG_FILE" - echo "listen.owner = nginx" >> "$PHP_CONFIG_FILE" - echo "listen.group = nginx" >> "$PHP_CONFIG_FILE" + echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -215,45 +244,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache.conf" - - if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "$HTTPD_CONF_FILE" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - if [ "${EXPOSE_WEB_SERVER_INFO}" = "off" ]; then - sed -i \ - -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \ - "$HTTPD_CONF_FILE" - else - EXPOSE_WEB_SERVER_INFO="on" - fi - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO^}/g" \ - "$HTTPD_CONF_FILE" } ################################################# @@ -262,8 +260,9 @@ echo "** Deploying Zabbix web-interface (Apache) with PostgreSQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-apache-pgsql/ol/Dockerfile b/Dockerfiles/web-apache-pgsql/ol/Dockerfile index d7d43cb3b..9afb0c463 100644 --- a/Dockerfiles/web-apache-pgsql/ol/Dockerfile +++ b/Dockerfiles/web-apache-pgsql/ol/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with PostgreSQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ chgrp -R 0 /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ chmod -R g=u /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \ @@ -113,12 +114,15 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ chgrp -R 0 /run/httpd/ /var/lib/php/session/ && \ chmod -R g=u /run/httpd/ /var/lib/php/session/ && \ microdnf -y remove \ - findutils \ - glibc-locale-source + findutils \ + glibc-locale-source + +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/99-zabbix.conf b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/99-zabbix.conf deleted file mode 100644 index c28b761b9..000000000 --- a/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/99-zabbix.conf +++ /dev/null @@ -1,3 +0,0 @@ - - PidFile "/tmp/httpd.pid" - diff --git a/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/mime.conf b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/mime.conf new file mode 100644 index 000000000..6dd43b1cf --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf.d/mime.conf @@ -0,0 +1,9 @@ + + TypesConfig /etc/mime.types + + AddType application/x-compress .Z + AddType application/x-gzip .gz .tgz + + + MIMEMagicFile conf/magic + diff --git a/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf/httpd.conf b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf/httpd.conf new file mode 100644 index 000000000..eacc15123 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/conf/httpd.conf @@ -0,0 +1,75 @@ +ServerRoot /etc/httpd/ +ServerRoot /var/www +DefaultRuntimeDir /tmp/httpd/ +PidFile /tmp/httpd.pid + +ServerName 127.0.0.1 + +IncludeOptional /etc/httpd/includes.conf + +Timeout 300 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 5 + + + User ${APACHE_RUN_USER} + Group ${APACHE_RUN_GROUP} + + +HostnameLookups Off + +LogLevel warn + + + SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined + LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %O" common + LogFormat "%{Referer}i -> %U" referer + LogFormat "%{User-agent}i" agent + + CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs + + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). + + Require all denied + + +ServerTokens ${APACHE_SERVER_TOKENS} + +ServerSignature ${APACHE_SERVER_SIGNATURE} + +TraceEnable Off + +AddDefaultCharset UTF-8 + + + + SetHandler server-status + Require local + + + ExtendedStatus On + + + ProxyStatus On + + diff --git a/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/includes.conf b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/includes.conf new file mode 100644 index 000000000..f7ee6da9b --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/includes.conf @@ -0,0 +1,3 @@ +IncludeOptional /etc/httpd/modules.conf + +IncludeOptional /etc/httpd/conf.d/*.conf diff --git a/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/modules.conf b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/modules.conf new file mode 100644 index 000000000..e84a9daac --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ol/conf/etc/httpd/modules.conf @@ -0,0 +1,24 @@ +LoadModule logio_module /usr/lib64/httpd/modules/mod_logio.so +LoadModule unixd_module /usr/lib64/httpd/modules/mod_unixd.so +LoadModule log_config_module /usr/lib64/httpd/modules/mod_log_config.so +LoadModule access_compat_module /usr/lib64/httpd/modules/mod_access_compat.so +LoadModule auth_basic_module /usr/lib64/httpd/modules/mod_auth_basic.so +LoadModule authn_core_module /usr/lib64/httpd/modules/mod_authn_core.so +LoadModule authn_file_module /usr/lib64/httpd/modules/mod_authn_file.so +LoadModule authz_core_module /usr/lib64/httpd/modules/mod_authz_core.so +LoadModule authz_host_module /usr/lib64/httpd/modules/mod_authz_host.so +LoadModule authz_user_module /usr/lib64/httpd/modules/mod_authz_user.so +LoadModule dir_module /usr/lib64/httpd/modules/mod_dir.so +LoadModule env_module /usr/lib64/httpd/modules/mod_env.so +LoadModule filter_module /usr/lib64/httpd/modules/mod_filter.so +LoadModule mime_module /usr/lib64/httpd/modules/mod_mime.so +LoadModule mpm_event_module /usr/lib64/httpd/modules/mod_mpm_event.so +LoadModule negotiation_module /usr/lib64/httpd/modules/mod_negotiation.so +LoadModule reqtimeout_module /usr/lib64/httpd/modules/mod_reqtimeout.so +LoadModule setenvif_module /usr/lib64/httpd/modules/mod_setenvif.so +LoadModule status_module /usr/lib64/httpd/modules/mod_status.so + +LoadModule proxy_module /usr/lib64/httpd/modules/mod_proxy.so +LoadModule proxy_fcgi_module /usr/lib64/httpd/modules/mod_proxy_fcgi.so +LoadModule expires_module /usr/lib64/httpd/modules/mod_expires.so +LoadModule headers_module /usr/lib64/httpd/modules/mod_headers.so diff --git a/Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache.conf b/Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache.conf index e696330bf..f0a69becd 100644 --- a/Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache.conf +++ b/Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache.conf @@ -1,10 +1,17 @@ +Listen 8080 + DocumentRoot /usr/share/zabbix/ + ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DirectoryIndex ${HTTP_INDEX_FILE} + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml AddType application/x-httpd-php-source .phps + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + Order Allow,Deny Allow from all @@ -20,6 +27,18 @@ SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + diff --git a/Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache_ssl.conf b/Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache_ssl.conf index 43faf0eff..dfa10d875 100644 --- a/Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache_ssl.conf +++ b/Dockerfiles/web-apache-pgsql/ol/conf/etc/zabbix/apache_ssl.conf @@ -1,97 +1,113 @@ -LoadModule ssl_module modules/mod_ssl.so -LoadModule socache_shmcb_module modules/mod_socache_shmcb.so +LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so +LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so Listen 8443 - - DocumentRoot /usr/share/zabbix/ - ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DocumentRoot /usr/share/zabbix/ - AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml - AddType application/x-httpd-php-source .phps + ServerName zabbix - # Enable/Disable SSL for this virtual host. - SSLEngine on + DirectoryIndex ${HTTP_INDEX_FILE} - # intermediate configuration - SSLProtocol -all +TLSv1.2 +TLSv1.3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - SSLHonorCipherOrder off - SSLSessionTickets off + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml + AddType application/x-httpd-php-source .phps - SSLCertificateFile /etc/ssl/apache2/ssl.crt - SSLCertificateKeyFile /etc/ssl/apache2/ssl.key - # SSLCACertificatePath /etc/ssl/apache2/chain/ + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 - # enable HTTP/2, if available - Protocols h2 http/1.1 + # Enable/Disable SSL for this virtual host. + SSLEngine on - # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) - Header always set Strict-Transport-Security "max-age=63072000" + # intermediate configuration + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off - - Order Allow,Deny - Allow from all + SSLCertificateFile /etc/ssl/apache2/ssl.crt + SSLCertificateKeyFile /etc/ssl/apache2/ssl.key + # SSLCACertificatePath /etc/ssl/apache2/chain/ + # enable HTTP/2, if available + Protocols h2 http/1.1 + + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" + + + Order Allow,Deny + Allow from all + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + Options FollowSymLinks + AllowOverride None + Require all granted + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" - + - - Options FollowSymLinks - AllowOverride None - Require all granted + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + - - SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" - - + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - + + Require all denied + + Order deny,allow + Deny from all + + - - Require all denied - - Order deny,allow - Deny from all - - - + + Require all denied + + Order deny,allow + Deny from all + + + diff --git a/Dockerfiles/web-apache-pgsql/ol/docker-entrypoint.sh b/Dockerfiles/web-apache-pgsql/ol/docker-entrypoint.sh index b49ef0bf3..7e3295cea 100755 --- a/Dockerfiles/web-apache-pgsql/ol/docker-entrypoint.sh +++ b/Dockerfiles/web-apache-pgsql/ol/docker-entrypoint.sh @@ -18,11 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} +# Default user settings +: ${DAEMON_USER:="apache"} +: ${DAEMON_GROUP:="apache"} + # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Apache main configuration file HTTPD_CONF_FILE="/etc/httpd/conf/httpd.conf" +# Apache additional configuration files directory +APACHE_SITES_DIR="/etc/httpd/conf.d" +# Directory with SSL certificate files for Apache +APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -151,10 +159,53 @@ prepare_web_server() { fi } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" +prepare_web_server() { + if [ "$(id -u)" == '0' ]; then + export APACHE_RUN_USER=${DAEMON_USER} + else + export APACHE_RUN_USER=$(id -n -u) + fi + export APACHE_RUN_GROUP=${DAEMON_GROUP} - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" + echo "** Adding Zabbix virtual host (HTTP)" + if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then + ln -sfT "$ZABBIX_CONF_DIR/apache.conf" "$APACHE_SITES_DIR/zabbix.conf" + else + echo "**** Impossible to enable HTTP virtual host" + fi + + if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then + echo "** Adding Zabbix virtual host (HTTPS)" + if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then + ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf" + else + echo "**** Impossible to enable HTTPS virtual host" + fi + else + echo "**** Impossible to enable SSL support for Apache2. Certificates are missed." + fi + + export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"} + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + export APACHE_CUSTOM_LOG="/proc/self/fd/1" + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + export APACHE_CUSTOM_LOG="/dev/null" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + export APACHE_SERVER_TOKENS="OS" + export APACHE_SERVER_SIGNATURE="On" + if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then + export APACHE_SERVER_TOKENS="Prod" + export APACHE_SERVER_SIGNATURE="Off" + fi + + mkdir -p /tmp/httpd +} + +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -164,10 +215,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - echo "user = zabbix" >> "$PHP_CONFIG_FILE" - echo "group = zabbix" >> "$PHP_CONFIG_FILE" - echo "listen.owner = nginx" >> "$PHP_CONFIG_FILE" - echo "listen.group = nginx" >> "$PHP_CONFIG_FILE" + echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -215,45 +266,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache.conf" - - if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "$HTTPD_CONF_FILE" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - if [ "${EXPOSE_WEB_SERVER_INFO}" = "off" ]; then - sed -i \ - -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \ - "$HTTPD_CONF_FILE" - else - EXPOSE_WEB_SERVER_INFO="on" - fi - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO^}/g" \ - "$HTTPD_CONF_FILE" } ################################################# @@ -262,8 +282,9 @@ echo "** Deploying Zabbix web-interface (Apache) with PostgreSQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/Dockerfile b/Dockerfiles/web-apache-pgsql/ubuntu/Dockerfile index b5a49a902..58b013180 100644 --- a/Dockerfiles/web-apache-pgsql/ubuntu/Dockerfile +++ b/Dockerfiles/web-apache-pgsql/ubuntu/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with PostgreSQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /usr/sbin/policy-rc.d && \ INSTALL_PKGS="bash \ tzdata \ - apache2 \ curl \ - libapache2-mod-php \ ca-certificates \ + apache2 \ locales \ libldap-common \ php8.3-bcmath \ + php8.3-fpm \ php8.3-gd \ php8.3-ldap \ php8.3-mbstring \ php8.3-xml \ php8.3-pgsql \ - postgresql-client" && \ + postgresql-client \ + supervisor" && \ apt-get -y update && \ DEBIAN_FRONTEND=noninteractive apt-get -y \ + -o Dpkg::Options::="--force-confdef" \ + -o Dpkg::Options::="--force-confold" \ --no-install-recommends install \ ${INSTALL_PKGS} && \ groupadd \ @@ -69,50 +73,45 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \ mkdir -p ${ZABBIX_CONF_DIR} && \ mkdir -p ${ZABBIX_CONF_DIR}/web && \ mkdir -p ${ZABBIX_CONF_DIR}/web/certs && \ + mkdir -p /var/lib/php/session && \ + find /etc/ -name '*.dpkg-dist' | xargs rm -f && \ rm -f /etc/apache2/sites-available/* && \ rm -f /etc/apache2/sites-enabled/* && \ - /usr/sbin/a2enmod ssl && \ - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /proc/self/fd/1!g' \ - -e 's!^(\s*ErrorLog)\s+\S+!\1 /proc/self/fd/2!g' \ - "/etc/apache2/apache2.conf" && \ - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /proc/self/fd/1!g' \ - -e 's!^(\s*ErrorLog)\s+\S+!\1 /proc/self/fd/2!g' \ - "/etc/apache2/conf-available/other-vhosts-access-log.conf" && \ - sed -i 's/Listen 80/Listen 8080/g' /etc/apache2/ports.conf && \ - sed -i 's/Listen 443/Listen 8443/g' /etc/apache2/ports.conf && \ - sed -i 's|/var/run/apache2$SUFFIX|/tmp|g' /etc/apache2/envvars && \ - rm -f /var/run/apache2/apache2.pid && \ - cd /usr/share/zabbix/ && \ + rm -f /etc/php/8.3/fpm/pool.d/www.conf && \ + rm -f /var/run/apache2/ && \ + cd ${ZABBIX_WWW_ROOT}/ && \ rm -f conf/zabbix.conf.php conf/maintenance.inc.php conf/zabbix.conf.php.example && \ rm -rf tests && \ rm -f locale/add_new_language.sh locale/update_po.sh locale/make_mo.sh && \ - find /usr/share/zabbix/locale -name '*.po' | xargs rm -f && \ - find /usr/share/zabbix/locale -name '*.sh' | xargs rm -f && \ - ln -s "${ZABBIX_CONF_DIR}/web/zabbix.conf.php" "/usr/share/zabbix/conf/zabbix.conf.php" && \ - ln -s "${ZABBIX_CONF_DIR}/web/maintenance.inc.php" "/usr/share/zabbix/conf/maintenance.inc.php" && \ + find ${ZABBIX_WWW_ROOT}/locale -name '*.po' | xargs rm -f && \ + find ${ZABBIX_WWW_ROOT}/locale -name '*.sh' | xargs rm -f && \ + ln -s "${ZABBIX_CONF_DIR}/web/zabbix.conf.php" "${ZABBIX_WWW_ROOT}/conf/zabbix.conf.php" && \ + ln -s "${ZABBIX_CONF_DIR}/web/maintenance.inc.php" "${ZABBIX_WWW_ROOT}/conf/maintenance.inc.php" && \ mkdir -p /var/lib/locales/supported.d/ && \ rm -f /var/lib/locales/supported.d/local && \ - cat /usr/share/zabbix/include/locales.inc.php | grep display | grep true | awk '{$1=$1};1' | \ + cat ${ZABBIX_WWW_ROOT}/include/locales.inc.php | grep display | grep true | awk '{$1=$1};1' | \ cut -d"'" -f 2 | sort | \ xargs -I '{}' bash -c 'echo "{}.UTF-8 UTF-8" >> /var/lib/locales/supported.d/local' && \ dpkg-reconfigure locales && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chown --quiet -R zabbix:root /etc/apache2/ /etc/php/8.3/ && \ - chgrp -R 0 /etc/apache2/ /etc/php/8.3/ && \ - chmod -R g=u /etc/apache2/ /etc/php/8.3/ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chown --quiet -R zabbix:root /etc/apache2/ /etc/php/8.3/fpm/ && \ + chgrp -R 0 /etc/apache2/ /etc/php/8.3/fpm/ && \ + chmod -R g=u /etc/apache2/ /etc/php/8.3/fpm/ && \ + chown --quiet -R zabbix:root /var/lib/php/session/ && \ + chgrp -R 0 /var/lib/php/session/ && \ + chmod -R g=u /var/lib/php/session/ + +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] USER 1997 ENTRYPOINT ["docker-entrypoint.sh"] - -CMD ["/usr/sbin/apache2ctl", "-D", "FOREGROUND"] diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/apache2.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/apache2.conf new file mode 100644 index 000000000..2cf9de536 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/apache2.conf @@ -0,0 +1,75 @@ +ServerRoot /etc/apache2/ +ServerRoot /var/www +DefaultRuntimeDir /tmp/apache2/ +PidFile /tmp/apache2.pid + +ServerName 127.0.0.1 + +IncludeOptional /etc/apache2/includes.conf + +Timeout 300 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 5 + + + User ${APACHE_RUN_USER} + Group ${APACHE_RUN_GROUP} + + +HostnameLookups Off + +LogLevel warn + + + SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs + + LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined + LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined + LogFormat "%h %l %u %t \"%r\" %>s %O" common + LogFormat "%{Referer}i -> %U" referer + LogFormat "%{User-agent}i" agent + + CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs + + +ErrorLog /proc/self/fd/2 + +LogLevel warn + + + StartServers 2 + MinSpareThreads 25 + MaxSpareThreads 75 + ThreadLimit 64 + ThreadsPerChild 25 + MaxRequestWorkers 150 + MaxConnectionsPerChild 0 + + +# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac). + + Require all denied + + +ServerTokens ${APACHE_SERVER_TOKENS} + +ServerSignature ${APACHE_SERVER_SIGNATURE} + +TraceEnable Off + +AddDefaultCharset UTF-8 + + + + SetHandler server-status + Require local + + + ExtendedStatus On + + + ProxyStatus On + + diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/includes.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/includes.conf new file mode 100644 index 000000000..f6d7bdec1 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/includes.conf @@ -0,0 +1,8 @@ +IncludeOptional /etc/apache2/modules.conf + +IncludeOptional mods-enabled/mime.conf +IncludeOptional mods-enabled/negotiation.conf +IncludeOptional mods-enabled/reqtimeout.conf +IncludeOptional mods-enabled/setenvif.conf + +IncludeOptional sites-enabled/*.conf diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/modules.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/modules.conf new file mode 100644 index 000000000..8151e37b1 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/apache2/modules.conf @@ -0,0 +1,21 @@ +LoadModule access_compat_module /usr/lib/apache2/modules/mod_access_compat.so +LoadModule auth_basic_module /usr/lib/apache2/modules/mod_auth_basic.so +LoadModule authn_core_module /usr/lib/apache2/modules/mod_authn_core.so +LoadModule authn_file_module /usr/lib/apache2/modules/mod_authn_file.so +LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so +LoadModule authz_host_module /usr/lib/apache2/modules/mod_authz_host.so +LoadModule authz_user_module /usr/lib/apache2/modules/mod_authz_user.so +LoadModule dir_module /usr/lib/apache2/modules/mod_dir.so +LoadModule env_module /usr/lib/apache2/modules/mod_env.so +LoadModule filter_module /usr/lib/apache2/modules/mod_filter.so +LoadModule mime_module /usr/lib/apache2/modules/mod_mime.so +LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so +LoadModule negotiation_module /usr/lib/apache2/modules/mod_negotiation.so +LoadModule reqtimeout_module /usr/lib/apache2/modules/mod_reqtimeout.so +LoadModule setenvif_module /usr/lib/apache2/modules/mod_setenvif.so +LoadModule status_module /usr/lib/apache2/modules/mod_status.so + +LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so +LoadModule proxy_fcgi_module /usr/lib/apache2/modules/mod_proxy_fcgi.so +LoadModule expires_module /usr/lib/apache2/modules/mod_expires.so +LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/apache2/conf.d/99-zabbix.ini b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/apache2/conf.d/99-zabbix.ini deleted file mode 100644 index e180720b9..000000000 --- a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/apache2/conf.d/99-zabbix.ini +++ /dev/null @@ -1,10 +0,0 @@ -max_execution_time = ${ZBX_MAXEXECUTIONTIME} -memory_limit = ${ZBX_MEMORYLIMIT} -post_max_size = ${ZBX_POSTMAXSIZE} -upload_max_filesize = ${ZBX_UPLOADMAXFILESIZE} -max_input_time = ${ZBX_MAXINPUTTIME} -; always_populate_raw_post_data=-1 -max_input_vars = 10000 -date.timezone = ${PHP_TZ} -; https://www.php.net/manual/en/security.hiding.php -expose_php = ${EXPOSE_WEB_SERVER_INFO} diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf new file mode 100644 index 000000000..5311405bf --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf @@ -0,0 +1,10 @@ +include=/etc/php/8.3/fpm/pool.d/*.conf + +[global] + +pid = /tmp/php-fpm.pid + +error_log = /dev/fd/2 +log_level = notice + +daemonize = no diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/fpm/pool.d/zabbix.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/fpm/pool.d/zabbix.conf new file mode 100644 index 000000000..66c3c1252 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/php/8.3/fpm/pool.d/zabbix.conf @@ -0,0 +1,36 @@ +[zabbix] + +; https://www.php.net/manual/en/security.hiding.php +php_value[expose_php] = ${EXPOSE_WEB_SERVER_INFO} + +listen = /tmp/php-fpm.sock + +clear_env = no + +pm = ${PHP_FPM_PM} +pm.max_children = ${PHP_FPM_PM_MAX_CHILDREN} +pm.start_servers = ${PHP_FPM_PM_START_SERVERS} +pm.min_spare_servers = ${PHP_FPM_PM_MIN_SPARE_SERVERS} +pm.max_spare_servers = ${PHP_FPM_PM_MAX_SPARE_SERVERS} +pm.max_requests = ${PHP_FPM_PM_MAX_REQUESTS} + +slowlog = /dev/fd/1 + +php_admin_value[error_log] = /dev/fd/2 +php_admin_flag[log_errors] = on +catch_workers_output = yes + +php_value[session.save_handler] = files +php_value[session.save_path] = /var/lib/php/session + +php_value[max_execution_time] = ${ZBX_MAXEXECUTIONTIME} +php_value[memory_limit] = ${ZBX_MEMORYLIMIT} +php_value[post_max_size] = ${ZBX_POSTMAXSIZE} +php_value[upload_max_filesize] = ${ZBX_UPLOADMAXFILESIZE} +php_value[max_input_time] = ${ZBX_MAXINPUTTIME} +php_value[max_input_vars] = 10000 +php_value[date.timezone] = ${PHP_TZ} + +; PHP-FPM monitoring +pm.status_path = /status +ping.path = /ping diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/supervisor/conf.d/supervisord_zabbix.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/supervisor/conf.d/supervisord_zabbix.conf new file mode 100644 index 000000000..04c8578fb --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/supervisor/conf.d/supervisord_zabbix.conf @@ -0,0 +1,30 @@ +[supervisord] +nodaemon = true + +[program:apache2] +command = /usr/sbin/%(program_name)s -D FOREGROUND +auto_start = true +autorestart = true + +startsecs=2 +startretries=3 +stopsignal=TERM +stopwaitsecs=2 + +redirect_stderr=true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 + +[program:php-fpm8.3] +command = /usr/sbin/%(program_name)s -F -y /etc/php/8.3/fpm/php-fpm.conf +auto_start = true +autorestart = true + +startsecs=2 +startretries=3 +stopsignal=TERM +stopwaitsecs=2 + +redirect_stderr=true +stdout_logfile = /dev/stdout +stdout_logfile_maxbytes = 0 diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/supervisor/supervisord.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/supervisor/supervisord.conf new file mode 100644 index 000000000..f8d80e461 --- /dev/null +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/supervisor/supervisord.conf @@ -0,0 +1,35 @@ +; supervisor config file + +[unix_http_server] +file = /tmp/supervisor.sock ; (the path to the socket file) +chmod = 0700 ; sockef file mode (default 0700) +username = zbx +password = password + +[supervisord] +logfile = /dev/stdout ; (main log file;default $CWD/supervisord.log) +pidfile = /tmp/supervisord.pid ; (supervisord pidfile;default supervisord.pid) +childlogdir = /tmp ; ('AUTO' child log dir, default $TEMP) +critical = critical +;user = zabbix +logfile_maxbytes = 0 +logfile_backupcount = 0 +loglevel = info + +; the below section must remain in the config file for RPC +; (supervisorctl/web interface) to work, additional interfaces may be +; added by defining them in separate rpcinterface: sections +[rpcinterface:supervisor] +supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface + +[supervisorctl] +serverurl = unix:///tmp/supervisor.sock ; use a unix:// URL for a unix socket + +; The [include] section can just contain the "files" setting. This +; setting can list multiple files (separated by whitespace or +; newlines). It can also contain wildcards. The filenames are +; interpreted as relative to this file. Included files *cannot* +; include files themselves. + +[include] +files = /etc/supervisor/conf.d/*.conf diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache.conf index b32e8167f..f0a69becd 100644 --- a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache.conf +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache.conf @@ -1,14 +1,44 @@ +Listen 8080 + DocumentRoot /usr/share/zabbix/ + ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} + + DirectoryIndex ${HTTP_INDEX_FILE} + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml AddType application/x-httpd-php-source .phps + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 + + + Order Allow,Deny + Allow from all + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + Options FollowSymLinks AllowOverride None Require all granted + + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache_ssl.conf b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache_ssl.conf index a26afff0a..b46e7f800 100644 --- a/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache_ssl.conf +++ b/Dockerfiles/web-apache-pgsql/ubuntu/conf/etc/zabbix/apache_ssl.conf @@ -1,87 +1,113 @@ LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so -LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so - - - DocumentRoot /usr/share/zabbix/ - ServerName zabbix - DirectoryIndex {HTTP_INDEX_FILE} +Listen 8443 - AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml - AddType application/x-httpd-php-source .phps + + DocumentRoot /usr/share/zabbix/ - # Enable/Disable SSL for this virtual host. - SSLEngine on + ServerName zabbix - # intermediate configuration - SSLProtocol -all +TLSv1.2 +TLSv1.3 - SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 - SSLHonorCipherOrder off - SSLSessionTickets off + DirectoryIndex ${HTTP_INDEX_FILE} - SSLCertificateFile /etc/ssl/apache2/ssl.crt - SSLCertificateKeyFile /etc/ssl/apache2/ssl.key - # SSLCACertificatePath /etc/ssl/apache2/chain/ + AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml + AddType application/x-httpd-php-source .phps - # enable HTTP/2, if available - Protocols h2 http/1.1 + SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1 - # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) - Header always set Strict-Transport-Security "max-age=63072000" + # Enable/Disable SSL for this virtual host. + SSLEngine on - - Options FollowSymLinks - AllowOverride None - Require all granted - + # intermediate configuration + SSLProtocol -all +TLSv1.2 +TLSv1.3 + SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 + SSLHonorCipherOrder off + SSLSessionTickets off - - Require all denied - - Order deny,allow - Deny from all - - + SSLCertificateFile /etc/ssl/apache2/ssl.crt + SSLCertificateKeyFile /etc/ssl/apache2/ssl.key + # SSLCACertificatePath /etc/ssl/apache2/chain/ - - Require all denied - - Order deny,allow - Deny from all - - + # enable HTTP/2, if available + Protocols h2 http/1.1 - - Require all denied - - Order deny,allow - Deny from all - - + # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds) + Header always set Strict-Transport-Security "max-age=63072000" - - Require all denied - - Order deny,allow - Deny from all - - + + Order Allow,Deny + Allow from all - - Require all denied - - Order deny,allow - Deny from all - - + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + - - Require all denied - - Order deny,allow - Deny from all - - - - + + Options FollowSymLinks + AllowOverride None + Require all granted + + + SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost" + + + + ExpiresActive On + ExpiresDefault "access plus 1 year" + Header append Cache-Control "public" + + + + ExpiresActive On + ExpiresDefault "access plus 14 day" + Header append Cache-Control "public" + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + + + Require all denied + + Order deny,allow + Deny from all + + + diff --git a/Dockerfiles/web-apache-pgsql/ubuntu/docker-entrypoint.sh b/Dockerfiles/web-apache-pgsql/ubuntu/docker-entrypoint.sh index e24276e83..c77439437 100755 --- a/Dockerfiles/web-apache-pgsql/ubuntu/docker-entrypoint.sh +++ b/Dockerfiles/web-apache-pgsql/ubuntu/docker-entrypoint.sh @@ -18,13 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} +# Default user settings +: ${DAEMON_USER:="www-data"} +: ${DAEMON_GROUP:="www-data"} + # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Apache main configuration file HTTPD_CONF_FILE="/etc/apache2/apache2.conf" -# Apache security configuration file -HTTPD_SECURITY_CONF_FILE="/etc/apache2/conf-enabled/security.conf" +# Apache additional configuration files directory +APACHE_SITES_DIR="/etc/apache2/sites-enabled" +# Directory with SSL certificate files for Apache +APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php/8.3/fpm/pool.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -132,9 +138,12 @@ check_db_connect() { } prepare_web_server() { - APACHE_SITES_DIR="/etc/apache2/sites-enabled" - - ln -sfT "$ZABBIX_CONF_DIR/apache_envvars" "/etc/apache2/envvars" + if [ "$(id -u)" == '0' ]; then + export APACHE_RUN_USER=${DAEMON_USER} + else + export APACHE_RUN_USER=$(id -n -u) + fi + export APACHE_RUN_GROUP=${DAEMON_GROUP} echo "** Adding Zabbix virtual host (HTTP)" if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then @@ -143,7 +152,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "/etc/ssl/apache2/ssl.crt" ] && [ -f "/etc/ssl/apache2/ssl.key" ]; then + if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then echo "** Adding Zabbix virtual host (HTTPS)" if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf" @@ -153,14 +162,42 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Apache2. Certificates are missed." fi + + export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"} + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + export APACHE_CUSTOM_LOG="/proc/self/fd/1" + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + export APACHE_CUSTOM_LOG="/dev/null" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + export APACHE_SERVER_TOKENS="OS" + export APACHE_SERVER_SIGNATURE="On" + if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then + export APACHE_SERVER_TOKENS="Prod" + export APACHE_SERVER_SIGNATURE="Off" + fi + + mkdir -p /tmp/httpd } -clear_deploy() { - echo "** Cleaning the system" -} +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" + export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} + export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} + export PHP_FPM_PM_START_SERVERS=${PHP_FPM_PM_START_SERVERS:-"5"} + export PHP_FPM_PM_MIN_SPARE_SERVERS=${PHP_FPM_PM_MIN_SPARE_SERVERS:-"5"} + export PHP_FPM_PM_MAX_SPARE_SERVERS=${PHP_FPM_PM_MAX_SPARE_SERVERS:-"35"} + export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} + + if [ "$(id -u)" == '0' ]; then + echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" + fi : ${ZBX_DENY_GUI_ACCESS:="false"} export ZBX_DENY_GUI_ACCESS=${ZBX_DENY_GUI_ACCESS,,} @@ -207,48 +244,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache.conf" - - if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/apache_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "$HTTPD_CONF_FILE" - sed -ri \ - -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \ - "/etc/apache2/conf-available/other-vhosts-access-log.conf" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - - if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then - sed -i \ - -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \ - "$HTTPD_SECURITY_CONF_FILE" - fi - - sed -i \ - -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO}/g" \ - "$HTTPD_SECURITY_CONF_FILE" } ################################################# @@ -257,17 +260,18 @@ echo "** Deploying Zabbix web-interface (Apache) with PostgreSQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" if [ "$1" != "" ]; then echo "** Executing '$@'" exec "$@" -elif [ -f "/usr/sbin/httpd" ]; then - echo "** Executing HTTPD" - exec /usr/sbin/httpd -D FOREGROUND +elif [ -f "/usr/bin/supervisord" ]; then + echo "** Executing supervisord" + exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf else echo "Unknown instructions. Exiting..." exit 1 diff --git a/Dockerfiles/web-nginx-mysql/alpine/Dockerfile b/Dockerfiles/web-nginx-mysql/alpine/Dockerfile index 56ac07671..e9ef1eca7 100644 --- a/Dockerfiles/web-nginx-mysql/alpine/Dockerfile +++ b/Dockerfiles/web-nginx-mysql/alpine/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Nginx web server with MySQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov > "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -227,55 +274,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$NGINX_CONF_FILE" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx.conf" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - - [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ - "$NGINX_CONF_FILE" } ################################################# @@ -284,8 +290,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-nginx-mysql/centos/Dockerfile b/Dockerfiles/web-nginx-mysql/centos/Dockerfile index 658896122..9d571952e 100644 --- a/Dockerfiles/web-nginx-mysql/centos/Dockerfile +++ b/Dockerfiles/web-nginx-mysql/centos/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Nginx web server with MySQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chgrp -R 0 /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chmod -R g=u /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ @@ -124,9 +125,12 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ findutils \ glibc-locale-source +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 + EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-nginx-mysql/centos/conf/etc/php-fpm.conf b/Dockerfiles/web-nginx-mysql/centos/conf/etc/php-fpm.conf index ce0225346..c3accf48d 100644 --- a/Dockerfiles/web-nginx-mysql/centos/conf/etc/php-fpm.conf +++ b/Dockerfiles/web-nginx-mysql/centos/conf/etc/php-fpm.conf @@ -5,5 +5,6 @@ include=/etc/php-fpm.d/*.conf pid = /tmp/php-fpm.pid error_log = /dev/fd/2 +log_level = notice daemonize = no diff --git a/Dockerfiles/web-nginx-mysql/centos/conf/etc/zabbix/nginx.conf b/Dockerfiles/web-nginx-mysql/centos/conf/etc/zabbix/nginx.conf index 8de1ca686..05c958cc3 100644 --- a/Dockerfiles/web-nginx-mysql/centos/conf/etc/zabbix/nginx.conf +++ b/Dockerfiles/web-nginx-mysql/centos/conf/etc/zabbix/nginx.conf @@ -46,8 +46,17 @@ server { return 404; } + location = /nginx-status { + access_log off; + allow 127.0.0.1; + allow ::1; + deny all; + stub_status; + } + location ~ ^/(status|ping)$ { access_log off; + fastcgi_pass unix:/tmp/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name; diff --git a/Dockerfiles/web-nginx-mysql/centos/docker-entrypoint.sh b/Dockerfiles/web-nginx-mysql/centos/docker-entrypoint.sh index b18c1ad55..45b21095f 100755 --- a/Dockerfiles/web-nginx-mysql/centos/docker-entrypoint.sh +++ b/Dockerfiles/web-nginx-mysql/centos/docker-entrypoint.sh @@ -18,14 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} -# Default user +# Default user settings : ${DAEMON_USER:="nginx"} +: ${DAEMON_GROUP:="nginx"} # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Nginx main configuration file NGINX_CONF_FILE="/etc/nginx/nginx.conf" +# Nginx virtual hosts configuration directory +NGINX_CONFD_DIR="/etc/nginx/conf.d" +# Directory with SSL certificate files for Nginx +NGINX_SSL_CONFIG_DIR="/etc/ssl/nginx" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -134,12 +139,15 @@ check_db_connect() { } prepare_web_server() { - NGINX_CONFD_DIR="/etc/nginx/conf.d" - NGINX_SSL_CONFIG="/etc/ssl/nginx" + if [ "$(id -u)" == '0' ]; then + sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" + fi if [ ! -f "/proc/net/if_inet6" ]; then sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx.conf" sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" fi echo "** Adding Zabbix virtual host (HTTP)" @@ -149,7 +157,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "$NGINX_SSL_CONFIG/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG/dhparam.pem" ]; then + if [ -f "$NGINX_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG_DIR/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG_DIR/dhparam.pem" ]; then echo "** Enable SSL support for Nginx" if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/nginx_ssl.conf" "$NGINX_CONFD_DIR/nginx_ssl.conf" @@ -159,12 +167,53 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Nginx. Certificates are missed." fi + + FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + : ${HTTP_INDEX_FILE:="index.php"} + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$NGINX_CONF_FILE" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx.conf" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + + [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" + + export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} + sed -i \ + -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ + "$NGINX_CONF_FILE" } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -174,12 +223,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" - echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -227,55 +274,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$NGINX_CONF_FILE" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx.conf" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - - [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ - "$NGINX_CONF_FILE" } ################################################# @@ -284,8 +290,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-nginx-mysql/ol/Dockerfile b/Dockerfiles/web-nginx-mysql/ol/Dockerfile index 4c6afd4b5..34189f079 100644 --- a/Dockerfiles/web-nginx-mysql/ol/Dockerfile +++ b/Dockerfiles/web-nginx-mysql/ol/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Nginx web server with MySQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chgrp -R 0 /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chmod -R g=u /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ @@ -111,9 +112,12 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ findutils \ glibc-locale-source +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 + EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-nginx-mysql/ol/conf/etc/php-fpm.conf b/Dockerfiles/web-nginx-mysql/ol/conf/etc/php-fpm.conf index ce0225346..c3accf48d 100644 --- a/Dockerfiles/web-nginx-mysql/ol/conf/etc/php-fpm.conf +++ b/Dockerfiles/web-nginx-mysql/ol/conf/etc/php-fpm.conf @@ -5,5 +5,6 @@ include=/etc/php-fpm.d/*.conf pid = /tmp/php-fpm.pid error_log = /dev/fd/2 +log_level = notice daemonize = no diff --git a/Dockerfiles/web-nginx-mysql/ol/conf/etc/zabbix/nginx.conf b/Dockerfiles/web-nginx-mysql/ol/conf/etc/zabbix/nginx.conf index 8de1ca686..05c958cc3 100644 --- a/Dockerfiles/web-nginx-mysql/ol/conf/etc/zabbix/nginx.conf +++ b/Dockerfiles/web-nginx-mysql/ol/conf/etc/zabbix/nginx.conf @@ -46,8 +46,17 @@ server { return 404; } + location = /nginx-status { + access_log off; + allow 127.0.0.1; + allow ::1; + deny all; + stub_status; + } + location ~ ^/(status|ping)$ { access_log off; + fastcgi_pass unix:/tmp/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name; diff --git a/Dockerfiles/web-nginx-mysql/ol/docker-entrypoint.sh b/Dockerfiles/web-nginx-mysql/ol/docker-entrypoint.sh index b18c1ad55..45b21095f 100755 --- a/Dockerfiles/web-nginx-mysql/ol/docker-entrypoint.sh +++ b/Dockerfiles/web-nginx-mysql/ol/docker-entrypoint.sh @@ -18,14 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} -# Default user +# Default user settings : ${DAEMON_USER:="nginx"} +: ${DAEMON_GROUP:="nginx"} # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Nginx main configuration file NGINX_CONF_FILE="/etc/nginx/nginx.conf" +# Nginx virtual hosts configuration directory +NGINX_CONFD_DIR="/etc/nginx/conf.d" +# Directory with SSL certificate files for Nginx +NGINX_SSL_CONFIG_DIR="/etc/ssl/nginx" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -134,12 +139,15 @@ check_db_connect() { } prepare_web_server() { - NGINX_CONFD_DIR="/etc/nginx/conf.d" - NGINX_SSL_CONFIG="/etc/ssl/nginx" + if [ "$(id -u)" == '0' ]; then + sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" + fi if [ ! -f "/proc/net/if_inet6" ]; then sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx.conf" sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" fi echo "** Adding Zabbix virtual host (HTTP)" @@ -149,7 +157,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "$NGINX_SSL_CONFIG/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG/dhparam.pem" ]; then + if [ -f "$NGINX_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG_DIR/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG_DIR/dhparam.pem" ]; then echo "** Enable SSL support for Nginx" if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/nginx_ssl.conf" "$NGINX_CONFD_DIR/nginx_ssl.conf" @@ -159,12 +167,53 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Nginx. Certificates are missed." fi + + FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + : ${HTTP_INDEX_FILE:="index.php"} + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$NGINX_CONF_FILE" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx.conf" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + + [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" + + export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} + sed -i \ + -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ + "$NGINX_CONF_FILE" } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -174,12 +223,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" - echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -227,55 +274,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$NGINX_CONF_FILE" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx.conf" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - - [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ - "$NGINX_CONF_FILE" } ################################################# @@ -284,8 +290,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-nginx-mysql/rhel/Dockerfile b/Dockerfiles/web-nginx-mysql/rhel/Dockerfile index 59539d612..c34e6973e 100644 --- a/Dockerfiles/web-nginx-mysql/rhel/Dockerfile +++ b/Dockerfiles/web-nginx-mysql/rhel/Dockerfile @@ -16,7 +16,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL description="Zabbix web-interface based on Nginx web server with MySQL database support" \ maintainer="alexey.pustovalov@zabbix.com" \ @@ -48,7 +49,7 @@ STOPSIGNAL SIGTERM COPY ["licenses", "/licenses"] COPY ["conf/etc/", "/etc/"] -COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/ui", "/usr/share/zabbix"] +COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/ui", "${ZABBIX_WWW_ROOT}"] RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ --mount=type=tmpfs,target=/var/cache/yum/ \ @@ -125,20 +126,20 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ rm -f /etc/php-fpm.d/www.conf && \ ln -sf /dev/stdout /var/log/nginx/access.log && \ ln -sf /dev/stderr /var/log/nginx/error.log && \ - cd /usr/share/zabbix/ && \ + cd ${ZABBIX_WWW_ROOT}/ && \ rm -f conf/zabbix.conf.php conf/maintenance.inc.php conf/zabbix.conf.php.example && \ rm -rf tests && \ rm -f locale/add_new_language.sh locale/update_po.sh locale/make_mo.sh && \ - find /usr/share/zabbix/locale -name '*.po' | xargs rm -f && \ - find /usr/share/zabbix/locale -name '*.sh' | xargs rm -f && \ - ln -s "${ZABBIX_CONF_DIR}/web/zabbix.conf.php" "/usr/share/zabbix/conf/zabbix.conf.php" && \ - ln -s "${ZABBIX_CONF_DIR}/web/maintenance.inc.php" "/usr/share/zabbix/conf/maintenance.inc.php" && \ - cat /usr/share/zabbix/include/locales.inc.php | grep display | grep true | awk '{$1=$1};1' | \ + find ${ZABBIX_WWW_ROOT}/locale -name '*.po' | xargs rm -f && \ + find ${ZABBIX_WWW_ROOT}/locale -name '*.sh' | xargs rm -f && \ + ln -s "${ZABBIX_CONF_DIR}/web/zabbix.conf.php" "${ZABBIX_WWW_ROOT}/conf/zabbix.conf.php" && \ + ln -s "${ZABBIX_CONF_DIR}/web/maintenance.inc.php" "${ZABBIX_WWW_ROOT}/conf/maintenance.inc.php" && \ + cat ${ZABBIX_WWW_ROOT}/include/locales.inc.php | grep display | grep true | awk '{$1=$1};1' | \ cut -d"'" -f 2 | sort | \ xargs -I '{}' bash -c 'echo "{}" && localedef -c -i {} -f UTF-8 {}.UTF-8 2>/dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chgrp -R 0 /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chmod -R g=u /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ @@ -149,9 +150,12 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ findutils \ glibc-locale-source +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 + EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-nginx-mysql/rhel/conf/etc/php-fpm.conf b/Dockerfiles/web-nginx-mysql/rhel/conf/etc/php-fpm.conf index ce0225346..c3accf48d 100644 --- a/Dockerfiles/web-nginx-mysql/rhel/conf/etc/php-fpm.conf +++ b/Dockerfiles/web-nginx-mysql/rhel/conf/etc/php-fpm.conf @@ -5,5 +5,6 @@ include=/etc/php-fpm.d/*.conf pid = /tmp/php-fpm.pid error_log = /dev/fd/2 +log_level = notice daemonize = no diff --git a/Dockerfiles/web-nginx-mysql/rhel/conf/etc/zabbix/nginx.conf b/Dockerfiles/web-nginx-mysql/rhel/conf/etc/zabbix/nginx.conf index 8de1ca686..05c958cc3 100644 --- a/Dockerfiles/web-nginx-mysql/rhel/conf/etc/zabbix/nginx.conf +++ b/Dockerfiles/web-nginx-mysql/rhel/conf/etc/zabbix/nginx.conf @@ -46,8 +46,17 @@ server { return 404; } + location = /nginx-status { + access_log off; + allow 127.0.0.1; + allow ::1; + deny all; + stub_status; + } + location ~ ^/(status|ping)$ { access_log off; + fastcgi_pass unix:/tmp/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name; diff --git a/Dockerfiles/web-nginx-mysql/rhel/docker-entrypoint.sh b/Dockerfiles/web-nginx-mysql/rhel/docker-entrypoint.sh index 138c184be..45b21095f 100755 --- a/Dockerfiles/web-nginx-mysql/rhel/docker-entrypoint.sh +++ b/Dockerfiles/web-nginx-mysql/rhel/docker-entrypoint.sh @@ -18,14 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} -# Default user +# Default user settings : ${DAEMON_USER:="nginx"} +: ${DAEMON_GROUP:="nginx"} # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Nginx main configuration file NGINX_CONF_FILE="/etc/nginx/nginx.conf" +# Nginx virtual hosts configuration directory +NGINX_CONFD_DIR="/etc/nginx/conf.d" +# Directory with SSL certificate files for Nginx +NGINX_SSL_CONFIG_DIR="/etc/ssl/nginx" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -134,37 +139,81 @@ check_db_connect() { } prepare_web_server() { - NGINX_CONFD_DIR="/etc/nginx/conf.d" - NGINX_SSL_CONFIG="/etc/ssl/nginx" + if [ "$(id -u)" == '0' ]; then + sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" + fi if [ ! -f "/proc/net/if_inet6" ]; then sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx.conf" sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" fi echo "** Adding Zabbix virtual host (HTTP)" if [ -f "$ZABBIX_CONF_DIR/nginx.conf" ]; then - ln -s "$ZABBIX_CONF_DIR/nginx.conf" "$NGINX_CONFD_DIR" + ln -sfT "$ZABBIX_CONF_DIR/nginx.conf" "$NGINX_CONFD_DIR/nginx.conf" else echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "$NGINX_SSL_CONFIG/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG/dhparam.pem" ]; then + if [ -f "$NGINX_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG_DIR/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG_DIR/dhparam.pem" ]; then echo "** Enable SSL support for Nginx" if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then - ln -s "$ZABBIX_CONF_DIR/nginx_ssl.conf" "$NGINX_CONFD_DIR" + ln -sfT "$ZABBIX_CONF_DIR/nginx_ssl.conf" "$NGINX_CONFD_DIR/nginx_ssl.conf" else echo "**** Impossible to enable HTTPS virtual host" fi else echo "**** Impossible to enable SSL support for Nginx. Certificates are missed." fi + + FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + : ${HTTP_INDEX_FILE:="index.php"} + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$NGINX_CONF_FILE" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx.conf" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + + [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" + + export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} + sed -i \ + -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ + "$NGINX_CONF_FILE" } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -174,12 +223,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" - echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -227,55 +274,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$NGINX_CONF_FILE" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx.conf" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - - [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ - "$NGINX_CONF_FILE" } ################################################# @@ -284,8 +290,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-nginx-mysql/ubuntu/Dockerfile b/Dockerfiles/web-nginx-mysql/ubuntu/Dockerfile index 62e78878c..a3005fae9 100644 --- a/Dockerfiles/web-nginx-mysql/ubuntu/Dockerfile +++ b/Dockerfiles/web-nginx-mysql/ubuntu/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Nginx web server with MySQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov > /var/lib/locales/supported.d/local' && \ dpkg-reconfigure locales && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/nginx/ /etc/php/8.3/fpm/php-fpm.conf /etc/php/8.3/fpm/pool.d/ && \ chgrp -R 0 /etc/nginx/ /etc/php/8.3/fpm/php-fpm.conf /etc/php/8.3/fpm/pool.d/ && \ chmod -R g=u /etc/nginx/ /etc/php/8.3/fpm/php-fpm.conf /etc/php/8.3/fpm/pool.d/ && \ @@ -103,9 +104,12 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \ chgrp -R 0 /var/lib/php/session/ && \ chmod -R g=u /var/lib/php/session/ +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 + EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf b/Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf index 14deee27a..5311405bf 100644 --- a/Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf +++ b/Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf @@ -5,5 +5,6 @@ include=/etc/php/8.3/fpm/pool.d/*.conf pid = /tmp/php-fpm.pid error_log = /dev/fd/2 +log_level = notice daemonize = no diff --git a/Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/zabbix/nginx.conf b/Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/zabbix/nginx.conf index 8de1ca686..05c958cc3 100644 --- a/Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/zabbix/nginx.conf +++ b/Dockerfiles/web-nginx-mysql/ubuntu/conf/etc/zabbix/nginx.conf @@ -46,8 +46,17 @@ server { return 404; } + location = /nginx-status { + access_log off; + allow 127.0.0.1; + allow ::1; + deny all; + stub_status; + } + location ~ ^/(status|ping)$ { access_log off; + fastcgi_pass unix:/tmp/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name; diff --git a/Dockerfiles/web-nginx-mysql/ubuntu/docker-entrypoint.sh b/Dockerfiles/web-nginx-mysql/ubuntu/docker-entrypoint.sh index 03bf51702..1924db6c9 100755 --- a/Dockerfiles/web-nginx-mysql/ubuntu/docker-entrypoint.sh +++ b/Dockerfiles/web-nginx-mysql/ubuntu/docker-entrypoint.sh @@ -18,14 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} -# Default user +# Default user settings : ${DAEMON_USER:="www-data"} +: ${DAEMON_GROUP:="www-data"} # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Nginx main configuration file -NGINX_CONF_FILE="/etc/nginx/nginx.conf" +NGINX_MAIN_FILE="/etc/nginx/nginx.conf" +# Nginx virtual hosts configuration directory +NGINX_CONFD_DIR="/etc/nginx/http.d" +# Directory with SSL certificate files for Nginx +NGINX_SSL_CONFIG_DIR="/etc/ssl/nginx" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php/8.3/fpm/pool.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -134,12 +139,15 @@ check_db_connect() { } prepare_web_server() { - NGINX_CONFD_DIR="/etc/nginx/conf.d" - NGINX_SSL_CONFIG="/etc/ssl/nginx" + if [ "$(id -u)" == '0' ]; then + sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" + fi if [ ! -f "/proc/net/if_inet6" ]; then sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx.conf" sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" fi echo "** Adding Zabbix virtual host (HTTP)" @@ -149,7 +157,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "$NGINX_SSL_CONFIG/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG/dhparam.pem" ]; then + if [ -f "$NGINX_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG_DIR/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG_DIR/dhparam.pem" ]; then echo "** Enable SSL support for Nginx" if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/nginx_ssl.conf" "$NGINX_CONFD_DIR/nginx_ssl.conf" @@ -159,12 +167,53 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Nginx. Certificates are missed." fi + + FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + : ${HTTP_INDEX_FILE:="index.php"} + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$NGINX_CONF_FILE" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx.conf" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + + [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" + + export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} + sed -i \ + -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ + "$NGINX_CONF_FILE" } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php/8.3/fpm/pool.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -174,12 +223,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" - echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -227,55 +274,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$NGINX_CONF_FILE" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx.conf" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - - [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ - "$NGINX_CONF_FILE" } ################################################# @@ -284,8 +290,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with MySQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-nginx-pgsql/alpine/Dockerfile b/Dockerfiles/web-nginx-pgsql/alpine/Dockerfile index c2fc08db5..16d0b7564 100644 --- a/Dockerfiles/web-nginx-pgsql/alpine/Dockerfile +++ b/Dockerfiles/web-nginx-pgsql/alpine/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Nginx web server with PostgreSQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov > "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -226,55 +273,14 @@ prepare_zbx_web_config() { export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY} export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT} export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT} +} +prepare_zbx_config() { if [ -n "${ZBX_SESSION_NAME}" ]; then cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp" sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php" rm -f "/tmp/defines.inc.php_tmp" fi - - FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - : ${HTTP_INDEX_FILE:="index.php"} - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx.conf" - - if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then - sed -i \ - -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - - sed -i \ - -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${ENABLE_WEB_ACCESS_LOG:="true"} - - if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$NGINX_CONF_FILE" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx.conf" - sed -ri \ - -e 's!^(\s*access_log).+\;!\1 off\;!g' \ - "$ZABBIX_CONF_DIR/nginx_ssl.conf" - fi - - : ${EXPOSE_WEB_SERVER_INFO:="on"} - - [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" - - export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} - sed -i \ - -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ - "$NGINX_CONF_FILE" } ################################################# @@ -283,8 +289,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with PostgreSQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-nginx-pgsql/centos/Dockerfile b/Dockerfiles/web-nginx-pgsql/centos/Dockerfile index c88a6b7ef..2eb5211e2 100644 --- a/Dockerfiles/web-nginx-pgsql/centos/Dockerfile +++ b/Dockerfiles/web-nginx-pgsql/centos/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Nginx web server with PostgreSQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chgrp -R 0 /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chmod -R g=u /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ @@ -125,9 +126,12 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ findutils \ glibc-locale-source +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 + EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-nginx-pgsql/centos/conf/etc/php-fpm.conf b/Dockerfiles/web-nginx-pgsql/centos/conf/etc/php-fpm.conf index ce0225346..c3accf48d 100644 --- a/Dockerfiles/web-nginx-pgsql/centos/conf/etc/php-fpm.conf +++ b/Dockerfiles/web-nginx-pgsql/centos/conf/etc/php-fpm.conf @@ -5,5 +5,6 @@ include=/etc/php-fpm.d/*.conf pid = /tmp/php-fpm.pid error_log = /dev/fd/2 +log_level = notice daemonize = no diff --git a/Dockerfiles/web-nginx-pgsql/centos/conf/etc/zabbix/nginx.conf b/Dockerfiles/web-nginx-pgsql/centos/conf/etc/zabbix/nginx.conf index 8de1ca686..05c958cc3 100644 --- a/Dockerfiles/web-nginx-pgsql/centos/conf/etc/zabbix/nginx.conf +++ b/Dockerfiles/web-nginx-pgsql/centos/conf/etc/zabbix/nginx.conf @@ -46,8 +46,17 @@ server { return 404; } + location = /nginx-status { + access_log off; + allow 127.0.0.1; + allow ::1; + deny all; + stub_status; + } + location ~ ^/(status|ping)$ { access_log off; + fastcgi_pass unix:/tmp/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name; diff --git a/Dockerfiles/web-nginx-pgsql/centos/docker-entrypoint.sh b/Dockerfiles/web-nginx-pgsql/centos/docker-entrypoint.sh index f62169496..30ce85e0f 100755 --- a/Dockerfiles/web-nginx-pgsql/centos/docker-entrypoint.sh +++ b/Dockerfiles/web-nginx-pgsql/centos/docker-entrypoint.sh @@ -18,14 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} -# Default user +# Default user settings : ${DAEMON_USER:="nginx"} +: ${DAEMON_GROUP:="nginx"} # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Nginx main configuration file NGINX_CONF_FILE="/etc/nginx/nginx.conf" +# Nginx virtual hosts configuration directory +NGINX_CONFD_DIR="/etc/nginx/conf.d" +# Directory with SSL certificate files for Nginx +NGINX_SSL_CONFIG_DIR="/etc/ssl/nginx" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -133,12 +138,15 @@ check_db_connect() { } prepare_web_server() { - NGINX_CONFD_DIR="/etc/nginx/conf.d" - NGINX_SSL_CONFIG="/etc/ssl/nginx" + if [ "$(id -u)" == '0' ]; then + sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" + fi if [ ! -f "/proc/net/if_inet6" ]; then sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx.conf" sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" fi echo "** Adding Zabbix virtual host (HTTP)" @@ -148,7 +156,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "$NGINX_SSL_CONFIG/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG/dhparam.pem" ]; then + if [ -f "$NGINX_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG_DIR/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG_DIR/dhparam.pem" ]; then echo "** Enable SSL support for Nginx" if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/nginx_ssl.conf" "$NGINX_CONFD_DIR/nginx_ssl.conf" @@ -158,12 +166,53 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Nginx. Certificates are missed." fi + + FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + : ${HTTP_INDEX_FILE:="index.php"} + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$NGINX_CONF_FILE" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx.conf" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + + [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" + + export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} + sed -i \ + -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ + "$NGINX_CONF_FILE" } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -173,12 +222,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" - echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -283,8 +330,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with PostgreSQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-nginx-pgsql/ol/Dockerfile b/Dockerfiles/web-nginx-pgsql/ol/Dockerfile index 72bfd6006..c2c7184c8 100644 --- a/Dockerfiles/web-nginx-pgsql/ol/Dockerfile +++ b/Dockerfiles/web-nginx-pgsql/ol/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Nginx web server with PostgreSQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov /dev/null' && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chgrp -R 0 /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ chmod -R g=u /etc/nginx/ /etc/php-fpm.d/ /etc/php-fpm.conf /var/log/nginx/ && \ @@ -114,9 +115,12 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \ findutils \ glibc-locale-source +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 + EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-nginx-pgsql/ol/conf/etc/php-fpm.conf b/Dockerfiles/web-nginx-pgsql/ol/conf/etc/php-fpm.conf index ce0225346..c3accf48d 100644 --- a/Dockerfiles/web-nginx-pgsql/ol/conf/etc/php-fpm.conf +++ b/Dockerfiles/web-nginx-pgsql/ol/conf/etc/php-fpm.conf @@ -5,5 +5,6 @@ include=/etc/php-fpm.d/*.conf pid = /tmp/php-fpm.pid error_log = /dev/fd/2 +log_level = notice daemonize = no diff --git a/Dockerfiles/web-nginx-pgsql/ol/conf/etc/zabbix/nginx.conf b/Dockerfiles/web-nginx-pgsql/ol/conf/etc/zabbix/nginx.conf index 8de1ca686..05c958cc3 100644 --- a/Dockerfiles/web-nginx-pgsql/ol/conf/etc/zabbix/nginx.conf +++ b/Dockerfiles/web-nginx-pgsql/ol/conf/etc/zabbix/nginx.conf @@ -46,8 +46,17 @@ server { return 404; } + location = /nginx-status { + access_log off; + allow 127.0.0.1; + allow ::1; + deny all; + stub_status; + } + location ~ ^/(status|ping)$ { access_log off; + fastcgi_pass unix:/tmp/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name; diff --git a/Dockerfiles/web-nginx-pgsql/ol/docker-entrypoint.sh b/Dockerfiles/web-nginx-pgsql/ol/docker-entrypoint.sh index f62169496..30ce85e0f 100755 --- a/Dockerfiles/web-nginx-pgsql/ol/docker-entrypoint.sh +++ b/Dockerfiles/web-nginx-pgsql/ol/docker-entrypoint.sh @@ -18,14 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} -# Default user +# Default user settings : ${DAEMON_USER:="nginx"} +: ${DAEMON_GROUP:="nginx"} # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Nginx main configuration file NGINX_CONF_FILE="/etc/nginx/nginx.conf" +# Nginx virtual hosts configuration directory +NGINX_CONFD_DIR="/etc/nginx/conf.d" +# Directory with SSL certificate files for Nginx +NGINX_SSL_CONFIG_DIR="/etc/ssl/nginx" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -133,12 +138,15 @@ check_db_connect() { } prepare_web_server() { - NGINX_CONFD_DIR="/etc/nginx/conf.d" - NGINX_SSL_CONFIG="/etc/ssl/nginx" + if [ "$(id -u)" == '0' ]; then + sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" + fi if [ ! -f "/proc/net/if_inet6" ]; then sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx.conf" sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" fi echo "** Adding Zabbix virtual host (HTTP)" @@ -148,7 +156,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "$NGINX_SSL_CONFIG/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG/dhparam.pem" ]; then + if [ -f "$NGINX_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG_DIR/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG_DIR/dhparam.pem" ]; then echo "** Enable SSL support for Nginx" if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/nginx_ssl.conf" "$NGINX_CONFD_DIR/nginx_ssl.conf" @@ -158,12 +166,53 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Nginx. Certificates are missed." fi + + FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + : ${HTTP_INDEX_FILE:="index.php"} + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$NGINX_CONF_FILE" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx.conf" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + + [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" + + export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} + sed -i \ + -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ + "$NGINX_CONF_FILE" } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -173,12 +222,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" - echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -283,8 +330,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with PostgreSQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/Dockerfiles/web-nginx-pgsql/ubuntu/Dockerfile b/Dockerfiles/web-nginx-pgsql/ubuntu/Dockerfile index 35119feb8..0e9dd0374 100644 --- a/Dockerfiles/web-nginx-pgsql/ubuntu/Dockerfile +++ b/Dockerfiles/web-nginx-pgsql/ubuntu/Dockerfile @@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git ENV TERM=xterm \ ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \ - ZABBIX_CONF_DIR="/etc/zabbix" + ZABBIX_CONF_DIR="/etc/zabbix" \ + ZABBIX_WWW_ROOT="/usr/share/zabbix" LABEL org.opencontainers.image.authors="Alexey Pustovalov " \ org.opencontainers.image.description="Zabbix web-interface based on Nginx web server with PostgreSQL database support" \ @@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov > /var/lib/locales/supported.d/local' && \ dpkg-reconfigure locales && \ - chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ - chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \ + chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ + chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \ chown --quiet -R zabbix:root /etc/nginx/ /etc/php/8.3/fpm/php-fpm.conf /etc/php/8.3/fpm/pool.d/ && \ chgrp -R 0 /etc/nginx/ /etc/php/8.3/fpm/php-fpm.conf /etc/php/8.3/fpm/pool.d/ && \ chmod -R g=u /etc/nginx/ /etc/php/8.3/fpm/php-fpm.conf /etc/php/8.3/fpm/pool.d/ && \ @@ -103,9 +104,12 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \ chgrp -R 0 /var/lib/php/session/ && \ chmod -R g=u /var/lib/php/session/ +HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \ + CMD curl -f http://localhost:8080/ping || exit 1 + EXPOSE 8080/TCP 8443/TCP -WORKDIR /usr/share/zabbix +WORKDIR ${ZABBIX_WWW_ROOT} COPY ["docker-entrypoint.sh", "/usr/bin/"] diff --git a/Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf b/Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf index 14deee27a..5311405bf 100644 --- a/Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf +++ b/Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/php/8.3/fpm/php-fpm.conf @@ -5,5 +5,6 @@ include=/etc/php/8.3/fpm/pool.d/*.conf pid = /tmp/php-fpm.pid error_log = /dev/fd/2 +log_level = notice daemonize = no diff --git a/Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/zabbix/nginx.conf b/Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/zabbix/nginx.conf index 8de1ca686..05c958cc3 100644 --- a/Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/zabbix/nginx.conf +++ b/Dockerfiles/web-nginx-pgsql/ubuntu/conf/etc/zabbix/nginx.conf @@ -46,8 +46,17 @@ server { return 404; } + location = /nginx-status { + access_log off; + allow 127.0.0.1; + allow ::1; + deny all; + stub_status; + } + location ~ ^/(status|ping)$ { access_log off; + fastcgi_pass unix:/tmp/php-fpm.sock; fastcgi_param SCRIPT_FILENAME $webroot$fastcgi_script_name; diff --git a/Dockerfiles/web-nginx-pgsql/ubuntu/docker-entrypoint.sh b/Dockerfiles/web-nginx-pgsql/ubuntu/docker-entrypoint.sh index 8f2c88f9d..ae6aecb21 100755 --- a/Dockerfiles/web-nginx-pgsql/ubuntu/docker-entrypoint.sh +++ b/Dockerfiles/web-nginx-pgsql/ubuntu/docker-entrypoint.sh @@ -18,14 +18,19 @@ fi # Default timezone for web interface : ${PHP_TZ:="Europe/Riga"} -# Default user +# Default user settings : ${DAEMON_USER:="www-data"} +: ${DAEMON_GROUP:="www-data"} # Default directories -# Web interface www-root directory -ZABBIX_WWW_ROOT="/usr/share/zabbix" # Nginx main configuration file -NGINX_CONF_FILE="/etc/nginx/nginx.conf" +NGINX_MAIN_FILE="/etc/nginx/nginx.conf" +# Nginx virtual hosts configuration directory +NGINX_CONFD_DIR="/etc/nginx/http.d" +# Directory with SSL certificate files for Nginx +NGINX_SSL_CONFIG_DIR="/etc/ssl/nginx" +# PHP-FPM configuration file +PHP_CONFIG_FILE="/etc/php/8.3/fpm/pool.d/zabbix.conf" # usage: file_env VAR [DEFAULT] # as example: file_env 'MYSQL_PASSWORD' 'zabbix' @@ -133,12 +138,15 @@ check_db_connect() { } prepare_web_server() { - NGINX_CONFD_DIR="/etc/nginx/conf.d" - NGINX_SSL_CONFIG="/etc/ssl/nginx" + if [ "$(id -u)" == '0' ]; then + sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" + fi if [ ! -f "/proc/net/if_inet6" ]; then sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx.conf" sed -i '/listen \[::\]/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" + sed -i '/allow ::1/d' "$ZABBIX_CONF_DIR/nginx_ssl.conf" fi echo "** Adding Zabbix virtual host (HTTP)" @@ -148,7 +156,7 @@ prepare_web_server() { echo "**** Impossible to enable HTTP virtual host" fi - if [ -f "$NGINX_SSL_CONFIG/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG/dhparam.pem" ]; then + if [ -f "$NGINX_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$NGINX_SSL_CONFIG_DIR/ssl.key" ] && [ -f "$NGINX_SSL_CONFIG_DIR/dhparam.pem" ]; then echo "** Enable SSL support for Nginx" if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then ln -sfT "$ZABBIX_CONF_DIR/nginx_ssl.conf" "$NGINX_CONFD_DIR/nginx_ssl.conf" @@ -158,12 +166,53 @@ prepare_web_server() { else echo "**** Impossible to enable SSL support for Nginx. Certificates are missed." fi + + FCGI_READ_TIMEOUT=$(expr ${ZBX_MAXEXECUTIONTIME} + 1) + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + : ${HTTP_INDEX_FILE:="index.php"} + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx.conf" + + if [ -f "$ZABBIX_CONF_DIR/nginx_ssl.conf" ]; then + sed -i \ + -e "s/{FCGI_READ_TIMEOUT}/${FCGI_READ_TIMEOUT}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + + sed -i \ + -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${ENABLE_WEB_ACCESS_LOG:="true"} + + if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$NGINX_CONF_FILE" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx.conf" + sed -ri \ + -e 's!^(\s*access_log).+\;!\1 off\;!g' \ + "$ZABBIX_CONF_DIR/nginx_ssl.conf" + fi + + : ${EXPOSE_WEB_SERVER_INFO:="on"} + + [[ "${EXPOSE_WEB_SERVER_INFO}" != "off" ]] && EXPOSE_WEB_SERVER_INFO="on" + + export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO} + sed -i \ + -e "s/{EXPOSE_WEB_SERVER_INFO}/${EXPOSE_WEB_SERVER_INFO}/g" \ + "$NGINX_CONF_FILE" } -prepare_zbx_web_config() { - echo "** Preparing Zabbix frontend configuration file" - - PHP_CONFIG_FILE="/etc/php/8.3/fpm/pool.d/zabbix.conf" +prepare_zbx_php_config() { + echo "** Preparing PHP configuration" export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"} export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"} @@ -173,12 +222,10 @@ prepare_zbx_web_config() { export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"} if [ "$(id -u)" == '0' ]; then - sed -i -e "/^[#;] user/s/.*/user ${DAEMON_USER};/" "$NGINX_CONF_FILE" - echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" - echo "listen.group = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE" + echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE" fi : ${ZBX_DENY_GUI_ACCESS:="false"} @@ -283,8 +330,9 @@ echo "** Deploying Zabbix web-interface (Nginx) with PostgreSQL database" check_variables check_db_connect +prepare_zbx_php_config prepare_web_server -prepare_zbx_web_config +prepare_zbx_config echo "########################################################" diff --git a/compose_databases.yaml b/compose_databases.yaml index 8e392bb6b..29ce78b5f 100644 --- a/compose_databases.yaml +++ b/compose_databases.yaml @@ -20,7 +20,8 @@ services: - ${ENV_VARS_DIRECTORY}/mysql_init/init_proxy_db.sql:/docker-entrypoint-initdb.d/mysql_init_proxy.sql:ro # - mysql_socket:/var/run/mysqld/ env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_mysql + - path: ${ENV_VARS_DIRECTORY}/.env_db_mysql + required: true - path: ${ENV_VARS_DIRECTORY}/.env_db_mysql_override required: false environment: @@ -50,7 +51,8 @@ services: - ${ENV_VARS_DIRECTORY}/.ZBX_DB_KEY_FILE:/run/secrets/server-key.pem:ro # - pgsql_socket:/var/run/postgresql/ env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_pgsql + - path: ${ENV_VARS_DIRECTORY}/.env_db_pgsql + required: true - path: ${ENV_VARS_DIRECTORY}/.env_db_pgsql_override required: false secrets: diff --git a/compose_zabbix_components.yaml b/compose_zabbix_components.yaml index 1edf1b678..51d61a565 100644 --- a/compose_zabbix_components.yaml +++ b/compose_zabbix_components.yaml @@ -33,7 +33,8 @@ services: cpus: '0.5' memory: 512M env_file: - - ${ENV_VARS_DIRECTORY}/.env_srv + - path: ${ENV_VARS_DIRECTORY}/.env_srv + required: true - path: ${ENV_VARS_DIRECTORY}/.env_srv_override required: false networks: @@ -56,8 +57,8 @@ services: - net.ipv4.conf.all.send_redirects=0 # - net.ipv4.ping_group_range=0 1995 labels: - com.zabbix.company: "Zabbix LLC" - com.zabbix.component: "zabbix-server" + com.zabbix.company: "Zabbix SIA" + com.zabbix.component: "server" server-mysql-db-init: init: true @@ -71,7 +72,8 @@ services: # volumes: # - dbsocket:/var/run/mysqld/ env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_mysql + - path: ${ENV_VARS_DIRECTORY}/.env_db_mysql + required: true secrets: - MYSQL_USER - MYSQL_PASSWORD @@ -97,7 +99,8 @@ services: # - pgsql_socket:/var/run/postgresql command: init_db_only env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_pgsql + - path: ${ENV_VARS_DIRECTORY}/.env_db_pgsql + required: true secrets: - POSTGRES_USER - POSTGRES_PASSWORD @@ -115,7 +118,8 @@ services: # volumes: # - mysql_socket:/var/run/mysqld/ env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_mysql + - path: ${ENV_VARS_DIRECTORY}/.env_db_mysql + required: true secrets: - MYSQL_USER - MYSQL_PASSWORD @@ -139,7 +143,8 @@ services: # - ${ENV_VARS_DIRECTORY}/.ZBX_DB_KEY_FILE:/run/secrets/client-key.pem:ro # - pgsql_socket:/var/run/postgresql env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_pgsql + - path: ${ENV_VARS_DIRECTORY}/.env_db_pgsql + required: true secrets: - POSTGRES_USER - POSTGRES_PASSWORD @@ -179,7 +184,8 @@ services: cpus: '0.3' memory: 256M env_file: - - ${ENV_VARS_DIRECTORY}/.env_prx + - path: ${ENV_VARS_DIRECTORY}/.env_prx + required: true networks: backend: frontend: @@ -193,8 +199,8 @@ services: - net.ipv4.conf.all.send_redirects=0 # - net.ipv4.ping_group_range=0 1995 labels: - com.zabbix.company: "Zabbix LLC" - com.zabbix.component: "zabbix-proxy" + com.zabbix.company: "Zabbix SIA" + com.zabbix.component: "proxy" proxy-sqlite3: extends: @@ -206,7 +212,8 @@ services: protocol: tcp app_protocol: zabbix-trapper env_file: - - ${ENV_VARS_DIRECTORY}/.env_prx_sqlite3 + - path: ${ENV_VARS_DIRECTORY}/.env_prx_sqlite3 + required: true - path: ${ENV_VARS_DIRECTORY}/.env_prx_sqlite3_override required: false networks: @@ -230,7 +237,8 @@ services: # volumes: # - dbsocket:/var/run/mysqld/ env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_mysql_proxy + - path: ${ENV_VARS_DIRECTORY}/.env_db_mysql_proxy + required: true secrets: - MYSQL_USER - MYSQL_PASSWORD @@ -257,8 +265,10 @@ services: # volumes: # - mysql_socket:/var/run/mysqld/ env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_mysql_proxy - - ${ENV_VARS_DIRECTORY}/.env_prx_mysql + - path: ${ENV_VARS_DIRECTORY}/.env_db_mysql_proxy + required: true + - path: ${ENV_VARS_DIRECTORY}/.env_prx_mysql + required: true - path: ${ENV_VARS_DIRECTORY}/.env_prx_mysql_override required: false secrets: @@ -298,7 +308,9 @@ services: - /etc/localtime:/etc/localtime:ro - ${DATA_DIRECTORY}/etc/ssl/apache2:/etc/ssl/apache2:ro - ${DATA_DIRECTORY}/usr/share/zabbix/modules/:/usr/share/zabbix/modules/:ro - tmpfs: /tmp + tmpfs: + - /tmp + - /var/lib/php/session:mode=770,uid=1997,gid=1995 deploy: resources: limits: @@ -308,15 +320,17 @@ services: cpus: '0.5' memory: 256M env_file: - - ${ENV_VARS_DIRECTORY}/.env_web + - path: ${ENV_VARS_DIRECTORY}/.env_web + required: true - path: ${ENV_VARS_DIRECTORY}/.env_web_override required: false healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:8080/"] - interval: 10s - timeout: 5s + test: ["CMD", "curl", "-f", "http://localhost:8080/ping"] + interval: 1m30s + timeout: 3s retries: 3 - start_period: 30s + start_period: 40s + start_interval: 5s networks: database: backend: @@ -325,8 +339,8 @@ services: sysctls: - net.core.somaxconn=65535 labels: - com.zabbix.company: "Zabbix LLC" - com.zabbix.component: "zabbix-frontend" + com.zabbix.company: "Zabbix SIA" + com.zabbix.component: "frontend" com.zabbix.webserver: "apache2" web-apache-mysql: @@ -335,7 +349,8 @@ services: # volumes: # - mysql_socket:/var/run/mysqld/ env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_mysql + - path: ${ENV_VARS_DIRECTORY}/.env_db_mysql + required: true secrets: - MYSQL_USER - MYSQL_PASSWORD @@ -355,7 +370,8 @@ services: # - ${ENV_VARS_DIRECTORY}/.ZBX_DB_KEY_FILE:/run/secrets/client-key.pem:ro # - pgsql_socket:/var/run/postgresql env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_pgsql + - path: ${ENV_VARS_DIRECTORY}/.env_db_pgsql + required: true secrets: - POSTGRES_USER - POSTGRES_PASSWORD @@ -385,7 +401,9 @@ services: - /etc/localtime:/etc/localtime:ro - ${DATA_DIRECTORY}/etc/ssl/nginx:/etc/ssl/nginx:ro - ${DATA_DIRECTORY}/usr/share/zabbix/modules/:/usr/share/zabbix/modules/:ro - tmpfs: /tmp + tmpfs: + - /tmp + - /var/lib/php/session:mode=770,uid=1997,gid=1995 deploy: resources: limits: @@ -395,15 +413,17 @@ services: cpus: '0.5' memory: 256M env_file: - - ${ENV_VARS_DIRECTORY}/.env_web + - path: ${ENV_VARS_DIRECTORY}/.env_web + required: true - path: ${ENV_VARS_DIRECTORY}/.env_web_override required: false healthcheck: test: ["CMD", "curl", "-f", "http://localhost:8080/ping"] - interval: 10s - timeout: 5s + interval: 1m30s + timeout: 3s retries: 3 - start_period: 30s + start_period: 40s + start_interval: 5s networks: database: backend: @@ -412,8 +432,8 @@ services: sysctls: - net.core.somaxconn=65535 labels: - com.zabbix.company: "Zabbix LLC" - com.zabbix.component: "zabbix-frontend" + com.zabbix.company: "Zabbix SIA" + com.zabbix.component: "frontend" com.zabbix.webserver: "nginx" web-nginx-mysql: @@ -446,7 +466,8 @@ services: # - ${ENV_VARS_DIRECTORY}/.ZBX_DB_KEY_FILE:/run/secrets/client-key.pem:ro # - pgsql_socket:/var/run/postgresql env_file: - - ${ENV_VARS_DIRECTORY}/.env_db_pgsql + - path: ${ENV_VARS_DIRECTORY}/.env_db_pgsql + required: true secrets: - POSTGRES_USER - POSTGRES_PASSWORD @@ -488,7 +509,8 @@ services: memory: 64M mode: global env_file: - - ${ENV_VARS_DIRECTORY}/.env_agent + - path: ${ENV_VARS_DIRECTORY}/.env_agent + required: true - path: ${ENV_VARS_DIRECTORY}/.env_agent_override required: false privileged: true @@ -501,8 +523,8 @@ services: stop_grace_period: 5s labels: com.zabbix.description: "Zabbix agent" - com.zabbix.company: "Zabbix LLC" - com.zabbix.component: "zabbix-agentd" + com.zabbix.company: "Zabbix SIA" + com.zabbix.component: "agent" agent2: profiles: @@ -538,7 +560,8 @@ services: memory: 64M mode: global env_file: - - ${ENV_VARS_DIRECTORY}/.env_agent + - path: ${ENV_VARS_DIRECTORY}/.env_agent + required: true - path: ${ENV_VARS_DIRECTORY}/.env_agent_override required: false privileged: true @@ -551,8 +574,8 @@ services: stop_grace_period: 5s labels: com.zabbix.description: "Zabbix agent 2" - com.zabbix.company: "Zabbix LLC" - com.zabbix.component: "zabbix-agent2" + com.zabbix.company: "Zabbix SIA" + com.zabbix.component: "agent2" java-gateway: profiles: @@ -574,7 +597,8 @@ services: cpus: '0.25' memory: 256M env_file: - - ${ENV_VARS_DIRECTORY}/.env_java + - path: ${ENV_VARS_DIRECTORY}/.env_java + required: true - path: ${ENV_VARS_DIRECTORY}/.env_java_override required: false networks: @@ -585,7 +609,7 @@ services: stop_grace_period: 5s labels: com.zabbix.description: "Zabbix Java Gateway" - com.zabbix.company: "Zabbix LLC" + com.zabbix.company: "Zabbix SIA" com.zabbix.component: "java-gateway" snmptraps: @@ -616,7 +640,8 @@ services: cpus: '0.25' memory: 128M env_file: - - ${ENV_VARS_DIRECTORY}/.env_snmptraps + - path: ${ENV_VARS_DIRECTORY}/.env_snmptraps + required: true - path: ${ENV_VARS_DIRECTORY}/.env_snmptraps_override required: false networks: @@ -627,7 +652,7 @@ services: stop_grace_period: 5s labels: com.zabbix.description: "Zabbix snmptraps" - com.zabbix.company: "Zabbix LLC" + com.zabbix.company: "Zabbix SIA" com.zabbix.component: "snmptraps" web-service: @@ -641,6 +666,7 @@ services: protocol: tcp restart: "${RESTART_POLICY}" attach: false + read_only: true volumes: - ${DATA_DIRECTORY}/var/lib/zabbix/enc:/var/lib/zabbix/enc:ro tmpfs: /tmp @@ -655,7 +681,8 @@ services: cpus: '0.25' memory: 256M env_file: - - ${ENV_VARS_DIRECTORY}/.env_web_service + - path: ${ENV_VARS_DIRECTORY}/.env_web_service + required: true - path: ${ENV_VARS_DIRECTORY}/.env_web_service_override required: false networks: @@ -665,5 +692,5 @@ services: stop_grace_period: 5s labels: com.zabbix.description: "Zabbix web service" - com.zabbix.company: "Zabbix LLC" + com.zabbix.company: "Zabbix SIA" com.zabbix.component: "web-service"