Migrate to PHP-FPM for all Web images

2025-08-09 16:45:05 +02:00 · 2025-01-13 19:24:39 +09:00
parent 5d9fbca9ea
commit 05daffc99e
127 changed files with 3828 additions and 1782 deletions
--- a/Dockerfiles/web-apache-mysql/centos/Dockerfile
+++ b/Dockerfiles/web-apache-mysql/centos/Dockerfile
@ -14,7 +14,8 @@ ARG ZBX_SOURCES=https://git.zabbix.com/scm/zbx/zabbix.git

 ENV TERM=xterm \
    ZBX_VERSION=${ZBX_VERSION} ZBX_SOURCES=${ZBX_SOURCES} \
-    ZABBIX_CONF_DIR="/etc/zabbix"
+    ZABBIX_CONF_DIR="/etc/zabbix" \
+    ZABBIX_WWW_ROOT="/usr/share/zabbix"

 LABEL org.opencontainers.image.authors="Alexey Pustovalov <alexey.pustovalov@zabbix.com>" \
      org.opencontainers.image.description="Zabbix web-interface based on Apache2 web server with MySQL database support" \
@ -28,7 +29,7 @@ LABEL org.opencontainers.image.authors="Alexey Pustovalov <alexey.pustovalov@zab

 STOPSIGNAL SIGTERM

-COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/ui", "/usr/share/zabbix"]
+COPY --from=builder ["/tmp/zabbix-${ZBX_VERSION}/ui", "${ZABBIX_WWW_ROOT}"]
 COPY ["conf/etc/", "/etc/"]

 RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
@ -52,12 +53,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
            glibc-locale-source \
            shadow-utils \
            supervisor" && \
-    microdnf -y module enable \
-        --disablerepo "*" \
-        --enablerepo "appstream" \
-        --setopt=install_weak_deps=0 \
-        --setopt=keepcache=0 \
-        php:8.2 && \
    microdnf -y install \
        --disablerepo "*" \
        --enablerepo "extras-common" \
@ -65,6 +60,12 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
        --setopt=keepcache=0 \
        --best \
        --nodocs epel-release && \
+    microdnf -y module enable \
+        --disablerepo "*" \
+        --enablerepo "appstream" \
+        --setopt=install_weak_deps=0 \
+        --setopt=keepcache=0 \
+        php:8.2 && \
    microdnf -y install \
        --disablerepo "*" \
        --enablerepo "baseos" \
@ -98,26 +99,26 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
    mkdir -p ${ZABBIX_CONF_DIR}/web/certs && \
    rm -f "/etc/httpd/conf.d/default.conf" && \
    rm -f "/etc/httpd/conf.d/ssl.conf" && \
+    rm -f "/etc/httpd/conf.d/autoindex.conf" && \
+    rm -f "/etc/httpd/conf.d/php.conf" && \
+    rm -f "/etc/httpd/conf.d/userdir.conf" && \
+    rm -f "/etc/httpd/conf.d/welcome.conf" && \
    rm -f /etc/php-fpm.d/www.conf && \
-    sed -ri \
-            -e 's!^(\s*CustomLog)\s+\S+!\1 /proc/self/fd/1!g' \
-            -e 's!^(\s*ErrorLog)\s+\S+!\1 /proc/self/fd/2!g' \
-        "/etc/httpd/conf/httpd.conf" && \
-    sed -i 's/Listen 80/Listen 8080/g' /etc/httpd/conf/httpd.conf && \
-    cd /usr/share/zabbix/ && \
+    find /etc/ -name '*.rpmnew' | xargs rm -f && \
+    cd ${ZABBIX_WWW_ROOT}/ && \
    rm -f conf/zabbix.conf.php conf/maintenance.inc.php conf/zabbix.conf.php.example && \
    rm -rf tests && \
    rm -f locale/add_new_language.sh locale/update_po.sh locale/make_mo.sh && \
-    find /usr/share/zabbix/locale -name '*.po' | xargs rm -f && \
-    find /usr/share/zabbix/locale -name '*.sh' | xargs rm -f && \
-    ln -s "${ZABBIX_CONF_DIR}/web/zabbix.conf.php" "/usr/share/zabbix/conf/zabbix.conf.php" && \
-    ln -s "${ZABBIX_CONF_DIR}/web/maintenance.inc.php" "/usr/share/zabbix/conf/maintenance.inc.php" && \
-    cat /usr/share/zabbix/include/locales.inc.php | grep display | grep true | awk '{$1=$1};1' | \
+    find ${ZABBIX_WWW_ROOT}/locale -name '*.po' | xargs rm -f && \
+    find ${ZABBIX_WWW_ROOT}/locale -name '*.sh' | xargs rm -f && \
+    ln -s "${ZABBIX_CONF_DIR}/web/zabbix.conf.php" "${ZABBIX_WWW_ROOT}/conf/zabbix.conf.php" && \
+    ln -s "${ZABBIX_CONF_DIR}/web/maintenance.inc.php" "${ZABBIX_WWW_ROOT}/conf/maintenance.inc.php" && \
+    cat ${ZABBIX_WWW_ROOT}/include/locales.inc.php | grep display | grep true | awk '{$1=$1};1' | \
        cut -d"'" -f 2 | sort | \
        xargs -I '{}' bash -c 'echo "{}" && localedef -c -i {} -f UTF-8 {}.UTF-8 2>/dev/null' && \
-    chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \
-    chgrp -R 0 ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \
-    chmod -R g=u ${ZABBIX_CONF_DIR}/ /usr/share/zabbix/include/defines.inc.php /usr/share/zabbix/modules/ && \
+    chown --quiet -R zabbix:root ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \
+    chgrp -R 0 ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \
+    chmod -R g=u ${ZABBIX_CONF_DIR}/ ${ZABBIX_WWW_ROOT}/include/defines.inc.php ${ZABBIX_WWW_ROOT}/modules/ && \
    chown --quiet -R zabbix:root /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \
    chgrp -R 0 /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \
    chmod -R g=u /etc/httpd/ /etc/php-fpm.d/ /etc/php-fpm.conf && \
@ -125,12 +126,15 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
    chgrp -R 0 /run/httpd/ /var/lib/php/session/ && \
    chmod -R g=u /run/httpd/ /var/lib/php/session/ && \
    microdnf -y remove \
-        findutils \
-        glibc-locale-source
+            findutils \
+            glibc-locale-source
+
+HEALTHCHECK --interval=1m30s --timeout=3s --retries=3 --start-period=40s --start-interval=5s \
+    CMD curl -f http://localhost:8080/ping || exit 1

 EXPOSE 8080/TCP 8443/TCP

-WORKDIR /usr/share/zabbix
+WORKDIR ${ZABBIX_WWW_ROOT}

 COPY ["docker-entrypoint.sh", "/usr/bin/"]

--- a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/99-zabbix.conf
+++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/99-zabbix.conf
@ -1,3 +0,0 @@
-<IfModule !mpm_netware_module>
-    PidFile "/tmp/httpd.pid"
-</IfModule>
--- a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/mime.conf
+++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf.d/mime.conf
@ -0,0 +1,9 @@
+<IfModule mime_module>
+    TypesConfig /etc/mime.types
+
+    AddType application/x-compress .Z
+    AddType application/x-gzip .gz .tgz
+</IfModule>
+<IfModule mime_magic_module>
+    MIMEMagicFile conf/magic
+</IfModule>
--- a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf/httpd.conf
+++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/conf/httpd.conf
@ -0,0 +1,75 @@
+ServerRoot /etc/httpd/
+ServerRoot /var/www
+DefaultRuntimeDir /tmp/httpd/
+PidFile /tmp/httpd.pid
+
+ServerName 127.0.0.1
+
+IncludeOptional /etc/httpd/includes.conf
+
+Timeout 300
+KeepAlive On
+MaxKeepAliveRequests 100
+KeepAliveTimeout 5
+
+<IfModule unixd_module>
+    User ${APACHE_RUN_USER}
+    Group ${APACHE_RUN_GROUP}
+</IfModule>
+
+HostnameLookups Off
+
+LogLevel warn
+
+<IfModule log_config_module>
+    SetEnvIf Request_URI "^/(robots\.txt|favicon\.ico|status|ping|apache-status)$" exclude_from_logs
+
+    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+    LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %O" common
+    LogFormat "%{Referer}i -> %U" referer
+    LogFormat "%{User-agent}i" agent
+
+    CustomLog ${APACHE_CUSTOM_LOG} vhost_combined env=!exclude_from_logs
+</IfModule>
+
+ErrorLog /proc/self/fd/2
+
+LogLevel warn
+
+<IfModule mpm_event_module>
+    StartServers            2
+    MinSpareThreads         25
+    MaxSpareThreads         75
+    ThreadLimit             64
+    ThreadsPerChild         25
+    MaxRequestWorkers       150
+    MaxConnectionsPerChild  0
+</IfModule>
+
+# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
+<FilesMatch "^\.">
+    Require all denied
+</FilesMatch>
+
+ServerTokens ${APACHE_SERVER_TOKENS}
+
+ServerSignature ${APACHE_SERVER_SIGNATURE}
+
+TraceEnable Off
+
+AddDefaultCharset UTF-8
+
+<IfModule status_module>
+    <Location /apache-status>
+        SetHandler server-status
+        Require local
+    </Location>
+
+    ExtendedStatus On
+
+    <IfModule mod_proxy.c>
+        ProxyStatus On
+    </IfModule>
+</IfModule>
--- a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/includes.conf
+++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/includes.conf
@ -0,0 +1,3 @@
+IncludeOptional /etc/httpd/modules.conf
+
+IncludeOptional /etc/httpd/conf.d/*.conf
--- a/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/modules.conf
+++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/httpd/modules.conf
@ -0,0 +1,24 @@
+LoadModule logio_module /usr/lib64/httpd/modules/mod_logio.so
+LoadModule unixd_module /usr/lib64/httpd/modules/mod_unixd.so
+LoadModule log_config_module /usr/lib64/httpd/modules/mod_log_config.so
+LoadModule access_compat_module /usr/lib64/httpd/modules/mod_access_compat.so
+LoadModule auth_basic_module /usr/lib64/httpd/modules/mod_auth_basic.so
+LoadModule authn_core_module /usr/lib64/httpd/modules/mod_authn_core.so
+LoadModule authn_file_module /usr/lib64/httpd/modules/mod_authn_file.so
+LoadModule authz_core_module /usr/lib64/httpd/modules/mod_authz_core.so
+LoadModule authz_host_module /usr/lib64/httpd/modules/mod_authz_host.so
+LoadModule authz_user_module /usr/lib64/httpd/modules/mod_authz_user.so
+LoadModule dir_module /usr/lib64/httpd/modules/mod_dir.so
+LoadModule env_module /usr/lib64/httpd/modules/mod_env.so
+LoadModule filter_module /usr/lib64/httpd/modules/mod_filter.so
+LoadModule mime_module /usr/lib64/httpd/modules/mod_mime.so
+LoadModule mpm_event_module /usr/lib64/httpd/modules/mod_mpm_event.so
+LoadModule negotiation_module /usr/lib64/httpd/modules/mod_negotiation.so
+LoadModule reqtimeout_module /usr/lib64/httpd/modules/mod_reqtimeout.so
+LoadModule setenvif_module /usr/lib64/httpd/modules/mod_setenvif.so
+LoadModule status_module /usr/lib64/httpd/modules/mod_status.so
+
+LoadModule proxy_module /usr/lib64/httpd/modules/mod_proxy.so
+LoadModule proxy_fcgi_module /usr/lib64/httpd/modules/mod_proxy_fcgi.so
+LoadModule expires_module /usr/lib64/httpd/modules/mod_expires.so
+LoadModule headers_module /usr/lib64/httpd/modules/mod_headers.so
--- a/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache.conf
+++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache.conf
@ -1,10 +1,17 @@
+Listen 8080
+
 <VirtualHost *:8080>
    DocumentRoot /usr/share/zabbix/
+
    ServerName zabbix
-    DirectoryIndex {HTTP_INDEX_FILE}
+
+    DirectoryIndex ${HTTP_INDEX_FILE}
+
    AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
    AddType application/x-httpd-php-source .phps

+    SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
+
    <LocationMatch "/(ping|status)">
        Order Allow,Deny
        Allow from all
@ -20,6 +27,18 @@
        <FilesMatch \.(php|phar)$>
            SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
        </FilesMatch>
+
+        <filesMatch "\.(ico)$">
+            ExpiresActive On
+            ExpiresDefault "access plus 1 year"
+            Header append Cache-Control "public"
+        </filesMatch>
+
+        <filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
+            ExpiresActive On
+            ExpiresDefault "access plus 14 day"
+            Header append Cache-Control "public"
+        </filesMatch>
    </Directory>

    <Directory "/usr/share/zabbix/conf">
--- a/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache_ssl.conf
+++ b/Dockerfiles/web-apache-mysql/centos/conf/etc/zabbix/apache_ssl.conf
@ -1,97 +1,113 @@
-LoadModule ssl_module modules/mod_ssl.so
-LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
+LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so
+LoadModule socache_shmcb_module /usr/lib64/httpd/modules/mod_socache_shmcb.so

 Listen 8443

-    <VirtualHost *:8443>
-        DocumentRoot /usr/share/zabbix/
-        ServerName zabbix
-        DirectoryIndex {HTTP_INDEX_FILE}
+<VirtualHost *:8443>
+    DocumentRoot /usr/share/zabbix/

-        AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
-        AddType application/x-httpd-php-source .phps
+    ServerName zabbix

-        # Enable/Disable SSL for this virtual host.
-        SSLEngine on
+    DirectoryIndex ${HTTP_INDEX_FILE}

-        # intermediate configuration
-        SSLProtocol             -all +TLSv1.2 +TLSv1.3
-        SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
-        SSLHonorCipherOrder     off
-        SSLSessionTickets       off
+    AddType application/x-httpd-php .php .php3 .php4 .php5 .phtml
+    AddType application/x-httpd-php-source .phps

-        SSLCertificateFile /etc/ssl/apache2/ssl.crt
-        SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
-        # SSLCACertificatePath /etc/ssl/apache2/chain/
+    SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1

-        # enable HTTP/2, if available
-        Protocols h2 http/1.1
+    # Enable/Disable SSL for this virtual host.
+    SSLEngine on

-        # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
-        Header always set Strict-Transport-Security "max-age=63072000"
+    # intermediate configuration
+    SSLProtocol             -all +TLSv1.2 +TLSv1.3
+    SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
+    SSLHonorCipherOrder     off
+    SSLSessionTickets       off

-        <LocationMatch "/(ping|status)">
-            Order Allow,Deny
-            Allow from all
+    SSLCertificateFile /etc/ssl/apache2/ssl.crt
+    SSLCertificateKeyFile /etc/ssl/apache2/ssl.key
+    # SSLCACertificatePath /etc/ssl/apache2/chain/

+    # enable HTTP/2, if available
+    Protocols h2 http/1.1
+
+    # HTTP Strict Transport Security (mod_headers is required) (63072000 seconds)
+    Header always set Strict-Transport-Security "max-age=63072000"
+
+    <LocationMatch "/(ping|status)">
+        Order Allow,Deny
+        Allow from all
+
+        SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
+    </LocationMatch>
+
+    <Directory "/usr/share/zabbix">
+        Options FollowSymLinks
+        AllowOverride None
+        Require all granted
+
+        <FilesMatch \.(php|phar)$>
            SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
-        </LocationMatch>
+        </FilesMatch>

-        <Directory "/usr/share/zabbix">
-            Options FollowSymLinks
-            AllowOverride None
-            Require all granted
+        <filesMatch "\.(ico)$">
+            ExpiresActive On
+            ExpiresDefault "access plus 1 year"
+            Header append Cache-Control "public"
+        </filesMatch>

-            <FilesMatch \.(php|phar)$>
-                SetHandler "proxy:unix:/tmp/php-fpm.sock|fcgi://localhost"
-            </FilesMatch>
-        </Directory>
+        <filesMatch "\.(js|css|png|jpg|jpeg|gif|xml|txt)$">
+            ExpiresActive On
+            ExpiresDefault "access plus 14 day"
+            Header append Cache-Control "public"
+        </filesMatch>
+    </Directory>

-        <Directory "/usr/share/zabbix/conf">
-            Require all denied
-            <files *.php>
-                Order deny,allow
-                Deny from all
-            </files>
-        </Directory>
+    <Directory "/usr/share/zabbix/conf">
+        Require all denied
+        <files *.php>
+            Order deny,allow
+            Deny from all
+        </files>
+    </Directory>

-        <Directory "/usr/share/zabbix/app">
-            Require all denied
-            <files *.php>
-                Order deny,allow
-                Deny from all
-            </files>
-        </Directory>
+    <Directory "/usr/share/zabbix/app">
+        Require all denied
+        <files *.php>
+            Order deny,allow
+            Deny from all
+        </files>
+    </Directory>

-        <Directory "/usr/share/zabbix/include">
-            Require all denied
-            <files *.php>
-                Order deny,allow
-                Deny from all
-            </files>
-        </Directory>
+    <Directory "/usr/share/zabbix/include">
+        Require all denied
+        <files *.php>
+            Order deny,allow
+            Deny from all
+        </files>
+    </Directory>

-        <Directory "/usr/share/zabbix/local">
-            Require all denied
-            <files *.php>
-                Order deny,allow
-                Deny from all
-            </files>
-        </Directory>
+    <Directory "/usr/share/zabbix/local">
+        Require all denied
+        <files *.php>
+            Order deny,allow
+            Deny from all
+        </files>
+    </Directory>

-        <Directory "/usr/share/zabbix/locale">
-            Require all denied
-            <files *.php>
-                Order deny,allow
-                Deny from all
-            </files>
-        </Directory>
+    <Directory "/usr/share/zabbix/locale">
+        Require all denied
+        <files *.php>
+            Order deny,allow
+            Deny from all
+        </files>
+    </Directory>

-        <Directory "/usr/share/zabbix/vendor">
-            Require all denied
-            <files *.php>
-                Order deny,allow
-                Deny from all
-            </files>
-        </Directory>
-    </VirtualHost>
+    <Directory "/usr/share/zabbix/vendor">
+        Require all denied
+        <files *.php>
+            Order deny,allow
+            Deny from all
+        </files>
+    </Directory>
+</VirtualHost>
--- a/Dockerfiles/web-apache-mysql/centos/docker-entrypoint.sh
+++ b/Dockerfiles/web-apache-mysql/centos/docker-entrypoint.sh
@ -18,11 +18,19 @@ fi
 # Default timezone for web interface
 : ${PHP_TZ:="Europe/Riga"}

+# Default user settings
+: ${DAEMON_USER:="apache"}
+: ${DAEMON_GROUP:="apache"}
+
 # Default directories
-# Web interface www-root directory
-ZABBIX_WWW_ROOT="/usr/share/zabbix"
 # Apache main configuration file
 HTTPD_CONF_FILE="/etc/httpd/conf/httpd.conf"
+# Apache additional configuration files directory
+APACHE_SITES_DIR="/etc/httpd/conf.d"
+# Directory with SSL certificate files for Apache
+APACHE_SSL_CONFIG_DIR="/etc/ssl/apache2"
+# PHP-FPM configuration file
+PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf"

 # usage: file_env VAR [DEFAULT]
 # as example: file_env 'MYSQL_PASSWORD' 'zabbix'
@ -131,7 +139,12 @@ check_db_connect() {
 }

 prepare_web_server() {
-    APACHE_SITES_DIR=/etc/httpd/conf.d
+    if [ "$(id -u)" == '0' ]; then
+        export APACHE_RUN_USER=${DAEMON_USER}
+    else
+        export APACHE_RUN_USER=$(id -n -u)
+    fi
+    export APACHE_RUN_GROUP=${DAEMON_GROUP}

    echo "** Adding Zabbix virtual host (HTTP)"
    if [ -f "$ZABBIX_CONF_DIR/apache.conf" ]; then
@ -140,7 +153,7 @@ prepare_web_server() {
        echo "**** Impossible to enable HTTP virtual host"
    fi

-    if [ -f "/etc/ssl/apache2/ssl.crt" ] && [ -f "/etc/ssl/apache2/ssl.key" ]; then
+    if [ -f "$APACHE_SSL_CONFIG_DIR/ssl.crt" ] && [ -f "$APACHE_SSL_CONFIG_DIR/ssl.key" ]; then
        echo "** Adding Zabbix virtual host (HTTPS)"
        if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then
            ln -sfT "$ZABBIX_CONF_DIR/apache_ssl.conf" "$APACHE_SITES_DIR/zabbix_ssl.conf"
@ -150,12 +163,28 @@ prepare_web_server() {
    else
        echo "**** Impossible to enable SSL support for Apache2. Certificates are missed."
    fi
+
+    export HTTP_INDEX_FILE=${HTTP_INDEX_FILE:="index.php"}
+
+    : ${ENABLE_WEB_ACCESS_LOG:="true"}
+    export APACHE_CUSTOM_LOG="/proc/self/fd/1"
+    if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then
+        export APACHE_CUSTOM_LOG="/dev/null"
+    fi
+
+    : ${EXPOSE_WEB_SERVER_INFO:="on"}
+    export APACHE_SERVER_TOKENS="OS"
+    export APACHE_SERVER_SIGNATURE="On"
+    if [ "${EXPOSE_WEB_SERVER_INFO}" == "off" ]; then
+        export APACHE_SERVER_TOKENS="Prod"
+        export APACHE_SERVER_SIGNATURE="Off"
+    fi
+
+    mkdir -p /tmp/httpd
 }

-prepare_zbx_web_config() {
-    echo "** Preparing Zabbix frontend configuration file"
-
-    PHP_CONFIG_FILE="/etc/php-fpm.d/zabbix.conf"
+prepare_zbx_php_config() {
+    echo "** Preparing PHP configuration"

    export PHP_FPM_PM=${PHP_FPM_PM:-"dynamic"}
    export PHP_FPM_PM_MAX_CHILDREN=${PHP_FPM_PM_MAX_CHILDREN:-"50"}
@ -165,10 +194,10 @@ prepare_zbx_web_config() {
    export PHP_FPM_PM_MAX_REQUESTS=${PHP_FPM_PM_MAX_REQUESTS:-"0"}

    if [ "$(id -u)" == '0' ]; then
-        echo "user = zabbix" >> "$PHP_CONFIG_FILE"
-        echo "group = zabbix" >> "$PHP_CONFIG_FILE"
-        echo "listen.owner = nginx" >> "$PHP_CONFIG_FILE"
-        echo "listen.group = nginx" >> "$PHP_CONFIG_FILE"
+        echo "user = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE"
+        echo "group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE"
+        echo "listen.owner = ${DAEMON_USER}" >> "$PHP_CONFIG_FILE"
+        echo "listen.group = ${DAEMON_GROUP}" >> "$PHP_CONFIG_FILE"
    fi

    : ${ZBX_DENY_GUI_ACCESS:="false"}
@ -216,45 +245,14 @@ prepare_zbx_web_config() {
    export ZBX_SSO_SP_KEY=${ZBX_SSO_SP_KEY}
    export ZBX_SSO_SP_CERT=${ZBX_SSO_SP_CERT}
    export ZBX_SSO_IDP_CERT=${ZBX_SSO_IDP_CERT}
+}

+prepare_zbx_config() {
    if [ -n "${ZBX_SESSION_NAME}" ]; then
        cp "$ZABBIX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp"
        sed "/ZBX_SESSION_NAME/s/'[^']*'/'${ZBX_SESSION_NAME}'/2" "/tmp/defines.inc.php_tmp" > "$ZABBIX_WWW_ROOT/include/defines.inc.php"
        rm -f "/tmp/defines.inc.php_tmp"
    fi
-
-    : ${HTTP_INDEX_FILE:="index.php"}
-    sed -i \
-        -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \
-    "$ZABBIX_CONF_DIR/apache.conf"
-
-    if [ -f "$ZABBIX_CONF_DIR/apache_ssl.conf" ]; then
-        sed -i \
-            -e "s/{HTTP_INDEX_FILE}/${HTTP_INDEX_FILE}/g" \
-        "$ZABBIX_CONF_DIR/apache_ssl.conf"
-    fi
-
-    : ${ENABLE_WEB_ACCESS_LOG:="true"}
-
-    if [ "${ENABLE_WEB_ACCESS_LOG,,}" == "false" ]; then
-        sed -ri \
-            -e 's!^(\s*CustomLog)\s+\S+!\1 /dev/null!g' \
-            "$HTTPD_CONF_FILE"
-    fi
-
-    : ${EXPOSE_WEB_SERVER_INFO:="on"}
-    if [ "${EXPOSE_WEB_SERVER_INFO}" = "off" ]; then
-        sed -i \
-            -e "s/^\(\s*ServerTokens\).*\$/\1 Prod/g" \
-        "$HTTPD_CONF_FILE"
-    else
-        EXPOSE_WEB_SERVER_INFO="on"
-    fi
-
-    export EXPOSE_WEB_SERVER_INFO=${EXPOSE_WEB_SERVER_INFO}
-    sed -i \
-        -e "s/^\(\s*ServerSignature\).*\$/\1 ${EXPOSE_WEB_SERVER_INFO^}/g" \
-    "$HTTPD_CONF_FILE"
 }

 #################################################
@ -263,8 +261,9 @@ echo "** Deploying Zabbix web-interface (Apache) with MySQL database"

 check_variables
 check_db_connect
+prepare_zbx_php_config
 prepare_web_server
-prepare_zbx_web_config
+prepare_zbx_config

 echo "########################################################"