Use env variables in Zabbix web images

web-apache-mysql/alpine/Dockerfile

@@ -19,6 +19,7 @@ RUN set -eux && \
         zabbix && \
     mkdir -p /etc/zabbix && \
     mkdir -p /etc/zabbix/web && \
+    mkdir -p /etc/zabbix/web/certs && \
     apk add --clean-protected --no-cache \
             apache2 \
             bash \

web-apache-mysql/alpine/conf/etc/php7/conf.d/99-zabbix.ini

@@ -1,8 +1,8 @@
-max_execution_time=300
-memory_limit=128M
-post_max_size=16M
-upload_max_filesize=2M
-max_input_time=300
+max_execution_time = ${ZBX_MAXEXECUTIONTIME}
+memory_limit = ${ZBX_MEMORYLIMIT}
+post_max_size = ${ZBX_POSTMAXSIZE}
+upload_max_filesize = ${ZBX_UPLOADMAXFILESIZE}
+max_input_time = ${ZBX_MAXINPUTTIME}
 ; always_populate_raw_post_data=-1
-max_input_vars=10000
-; date.timezone=Europe/Riga
+max_input_vars = 10000
+date.timezone = ${PHP_TZ}

web-apache-mysql/alpine/conf/etc/zabbix/web/zabbix.conf.php

@@ -2,37 +2,49 @@
 // Zabbix GUI configuration file.
 global $DB, $HISTORY;
 
-$DB['TYPE']     = 'MYSQL';
-$DB['SERVER']   = '{DB_SERVER_HOST}';
-$DB['PORT']     = '{DB_SERVER_PORT}';
-$DB['DATABASE'] = '{DB_SERVER_DBNAME}';
-$DB['USER']     = '{DB_SERVER_USER}';
-$DB['PASSWORD'] = '{DB_SERVER_PASS}';
+$DB['TYPE']     = getenv('DB_SERVER_TYPE');
+$DB['SERVER']   = getenv('DB_SERVER_HOST');
+$DB['PORT']     = getenv('DB_SERVER_PORT');
+$DB['DATABASE'] = getenv('DB_SERVER_DBNAME');
+$DB['USER']     = getenv('DB_SERVER_USER');
+$DB['PASSWORD'] = getenv('DB_SERVER_PASS');
 
 // Schema name. Used for IBM DB2 and PostgreSQL.
-$DB['SCHEMA'] = '{DB_SERVER_SCHEMA}';
+$DB['SCHEMA'] = getenv('DB_SERVER_SCHEMA');
 
-$ZBX_SERVER      = '{ZBX_SERVER_HOST}';
-$ZBX_SERVER_PORT = '{ZBX_SERVER_PORT}';
-$ZBX_SERVER_NAME = '{ZBX_SERVER_NAME}';
+$ZBX_SERVER      = getenv('ZBX_SERVER_HOST');
+$ZBX_SERVER_PORT = getenv('ZBX_SERVER_PORT');
+$ZBX_SERVER_NAME = getenv('ZBX_SERVER_NAME');
 
 // Used for TLS connection.
-$DB['ENCRYPTION']		= {ZBX_DB_ENCRYPTION};
-$DB['KEY_FILE']			= '{ZBX_DB_KEY_FILE}';
-$DB['CERT_FILE']		= '{ZBX_DB_CERT_FILE}';
-$DB['CA_FILE']			= '{ZBX_DB_CA_FILE}';
-$DB['VERIFY_HOST']		= {ZBX_DB_VERIFY_HOST};
-$DB['CIPHER_LIST']		= '{ZBX_DB_CIPHER_LIST}';
+$DB['ENCRYPTION']		= getenv('ZBX_DB_ENCRYPTION') == 'true' ? true: false;
+$DB['KEY_FILE']			= getenv('ZBX_DB_KEY_FILE');
+$DB['CERT_FILE']		= getenv('ZBX_DB_CERT_FILE');
+$DB['CA_FILE']			= getenv('ZBX_DB_CA_FILE');
+$DB['VERIFY_HOST']		= getenv('ZBX_DB_VERIFY_HOST') == 'true' ? true: false;
+$DB['CIPHER_LIST']		= getenv('ZBX_DB_CIPHER_LIST') ? getenv('ZBX_DB_CIPHER_LIST') : '';
 
 // Use IEEE754 compatible value range for 64-bit Numeric (float) history values.
 // This option is enabled by default for new Zabbix installations.
 // For upgraded installations, please read database upgrade notes before enabling this option.
-$DB['DOUBLE_IEEE754']	= {DB_DOUBLE_IEEE754};
+$DB['DOUBLE_IEEE754']	= getenv('DB_DOUBLE_IEEE754') == 'true' ? true: false;
 
 
 $IMAGE_FORMAT_DEFAULT	= IMAGE_FORMAT_PNG;
 
 // Elasticsearch url (can be string if same url is used for all types).
-$HISTORY['url']   = '{ZBX_HISTORYSTORAGEURL}';
+$history_url = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGEURL'));
+$HISTORY['url']   = (json_decode($history_url)) ? json_decode($history_url) : $history_url;
 // Value types stored in Elasticsearch.
-$HISTORY['types'] = {ZBX_HISTORYSTORAGETYPES};
+$storage_types = str_replace("'","\"",getenv('ZBX_HISTORYSTORAGETYPES'));
+
+$HISTORY['types'] = (json_decode($storage_types)) ? json_decode($storage_types) : array();
+
+// Used for SAML authentication.
+// Uncomment to override the default paths to SP private key, SP and IdP X.509 certificates, and to set extra settings.
+$SSO['SP_KEY']			= file_exists('/etc/zabbix/web/certs/sp.key') ? '/etc/zabbix/web/certs/sp.key' : '';
+$SSO['SP_CERT']			= file_exists('/etc/zabbix/web/certs/sp.crt') ? '/etc/zabbix/web/certs/sp.crt' : '';
+$SSO['IDP_CERT']		= file_exists('/etc/zabbix/web/certs/idp.crt') ? '/etc/zabbix/web/certs/idp.crt' : '';
+
+$sso_settings = str_replace("'","\"",getenv('ZBX_SSO_SETTINGS'));
+$SSO['SETTINGS']		= (json_decode($sso_settings)) ? json_decode($sso_settings) : array();

web-apache-mysql/alpine/docker-entrypoint.sh

@@ -57,67 +57,6 @@ file_env() {
     unset "$fileVar"
 }
 
-escape_spec_char() {
-    local var_value=$1
-
-    var_value="${var_value//\\/\\\\}"
-    var_value="${var_value//[$'\n']/}"
-    var_value="${var_value//\//\\/}"
-    var_value="${var_value//./\\.}"
-    var_value="${var_value//\*/\\*}"
-    var_value="${var_value//^/\\^}"
-    var_value="${var_value//\$/\\\$}"
-    var_value="${var_value//\&/\\\&}"
-    var_value="${var_value//\[/\\[}"
-    var_value="${var_value//\]/\\]}"
-
-    echo "$var_value"
-}
-
-update_config_var() {
-    local config_path=$1
-    local var_name=$2
-    local var_value=$3
-    local is_multiple=$4
-
-    if [ ! -f "$config_path" ]; then
-        echo "**** Configuration file '$config_path' does not exist"
-        return
-    fi
-
-    echo -n "** Updating '$config_path' parameter \"$var_name\": '$var_value'... "
-
-    # Remove configuration parameter definition in case of unset parameter value
-    if [ -z "$var_value" ]; then
-        sed -i -e "/^$var_name=/d" "$config_path"
-        echo "removed"
-        return
-    fi
-
-    # Remove value from configuration parameter in case of double quoted parameter value
-    if [ "$var_value" == '""' ]; then
-        sed -i -e "/^$var_name=/s/=.*/=/" "$config_path"
-        echo "undefined"
-        return
-    fi
-
-    # Escaping characters in parameter value and name
-    var_value=$(escape_spec_char "$var_value")
-    var_name=$(escape_spec_char "$var_name")
-
-    if [ "$(grep -E "^$var_name=" $config_path)" ] && [ "$is_multiple" != "true" ]; then
-        sed -i -e "/^$var_name=/s/=.*/=$var_value/" "$config_path"
-        echo "updated"
-    elif [ "$(grep -Ec "^# $var_name=" $config_path)" -gt 1 ]; then
-        sed -i -e  "/^[#;] $var_name=$/i\\$var_name=$var_value" "$config_path"
-        echo "added first occurrence"
-    else
-        sed -i -e "/^[#;] $var_name=/s/.*/&\n$var_name=$var_value/" "$config_path"
-        echo "added"
-    fi
-
-}
-
 # Check prerequisites for MySQL database
 check_variables() {
     : ${DB_SERVER_HOST:="mysql-server"}
@@ -229,54 +168,38 @@ prepare_web_server() {
 }
 
 prepare_zbx_web_config() {
-    local server_name=""
-
     echo "** Preparing Zabbix frontend configuration file"
 
-    ZBX_WWW_ROOT="/usr/share/zabbix"
-    ZBX_WEB_CONFIG="$ZABBIX_ETC_DIR/web/zabbix.conf.php"
-    PHP_CONFIG_FILE="/etc/php7/conf.d/99-zabbix.ini"
+    export ZBX_MAXEXECUTIONTIME=${ZBX_MAXEXECUTIONTIME:-"600"}
+    export ZBX_MEMORYLIMIT=${ZBX_MEMORYLIMIT:-"128M"}
+    export ZBX_POSTMAXSIZE=${ZBX_POSTMAXSIZE:-"16M"}
+    export ZBX_UPLOADMAXFILESIZE=${ZBX_UPLOADMAXFILESIZE:-"2M"}
+    export ZBX_MAXINPUTTIME=${ZBX_MAXINPUTTIME:-"300"}
+    export PHP_TZ=${PHP_TZ:-"Europe/Riga"}
 
-    update_config_var "$PHP_CONFIG_FILE" "max_execution_time" "${ZBX_MAXEXECUTIONTIME:-"600"}"
-    update_config_var "$PHP_CONFIG_FILE" "memory_limit" "${ZBX_MEMORYLIMIT:-"128M"}" 
-    update_config_var "$PHP_CONFIG_FILE" "post_max_size" "${ZBX_POSTMAXSIZE:-"16M"}"
-    update_config_var "$PHP_CONFIG_FILE" "upload_max_filesize" "${ZBX_UPLOADMAXFILESIZE:-"2M"}"
-    update_config_var "$PHP_CONFIG_FILE" "max_input_time" "${ZBX_MAXINPUTTIME:-"300"}"
-    update_config_var "$PHP_CONFIG_FILE" "date.timezone" "${PHP_TZ}"
+    export DB_SERVER_TYPE="MYSQL"
+    export DB_SERVER_HOST=${DB_SERVER_HOST}
+    export DB_SERVER_PORT=${DB_SERVER_PORT}
+    export DB_SERVER_DBNAME=${DB_SERVER_DBNAME}
+    export DB_SERVER_SCHEMA=${DB_SERVER_SCHEMA}
+    export DB_SERVER_USER=${DB_SERVER_ZBX_USER}
+    export DB_SERVER_PASS=${DB_SERVER_ZBX_PASS}
+    export ZBX_SERVER_HOST=${ZBX_SERVER_HOST}
+    export ZBX_SERVER_PORT=${ZBX_SERVER_PORT:-"10051"}
+    export ZBX_SERVER_NAME=${ZBX_SERVER_NAME}
 
-    ZBX_HISTORYSTORAGETYPES=${ZBX_HISTORYSTORAGETYPES:-"[]"}
+    export ZBX_DB_ENCRYPTION=${ZBX_DB_ENCRYPTION:-"false"}
+    export ZBX_DB_KEY_FILE=${ZBX_DB_KEY_FILE}
+    export ZBX_DB_CERT_FILE=${ZBX_DB_CERT_FILE}
+    export ZBX_DB_CA_FILE=${ZBX_DB_CA_FILE}
+    export ZBX_DB_VERIFY_HOST=${ZBX_DB_VERIFY_HOST-"false"}
 
-    # Escaping characters in parameter value
-    server_name=$(escape_spec_char "${ZBX_SERVER_NAME}")
-    server_user=$(escape_spec_char "${DB_SERVER_ZBX_USER}")
-    server_pass=$(escape_spec_char "${DB_SERVER_ZBX_PASS}")
-    history_storage_url=$(escape_spec_char "${ZBX_HISTORYSTORAGEURL}")
-    history_storage_types=$(escape_spec_char "${ZBX_HISTORYSTORAGETYPES}")
+    export DB_DOUBLE_IEEE754=${DB_DOUBLE_IEEE754:-"true"}
 
-    ZBX_DB_KEY_FILE=$(escape_spec_char "${ZBX_DB_KEY_FILE}")
-    ZBX_DB_CERT_FILE=$(escape_spec_char "${ZBX_DB_CERT_FILE}")
-    ZBX_DB_CA_FILE=$(escape_spec_char "${ZBX_DB_CA_FILE}")
+    export ZBX_HISTORYSTORAGEURL=${ZBX_HISTORYSTORAGEURL}
+    export ZBX_HISTORYSTORAGETYPES=${ZBX_HISTORYSTORAGETYPES:-"[]"}
 
-    sed -i \
-        -e "s/{DB_SERVER_HOST}/${DB_SERVER_HOST}/g" \
-        -e "s/{DB_SERVER_PORT}/${DB_SERVER_PORT}/g" \
-        -e "s/{DB_SERVER_DBNAME}/${DB_SERVER_DBNAME}/g" \
-        -e "s/{DB_SERVER_SCHEMA}/${DB_SERVER_SCHEMA}/g" \
-        -e "s/{DB_SERVER_USER}/$server_user/g" \
-        -e "s/{DB_SERVER_PASS}/$server_pass/g" \
-        -e "s/{ZBX_SERVER_HOST}/${ZBX_SERVER_HOST}/g" \
-        -e "s/{ZBX_SERVER_PORT}/${ZBX_SERVER_PORT}/g" \
-        -e "s/{ZBX_SERVER_NAME}/$server_name/g" \
-        -e "s/{ZBX_DB_ENCRYPTION}/${ZBX_DB_ENCRYPTION:-"false"}/g" \
-        -e "s/{ZBX_DB_KEY_FILE}/${ZBX_DB_KEY_FILE}/g" \
-        -e "s/{ZBX_DB_CERT_FILE}/${ZBX_DB_CERT_FILE}/g" \
-        -e "s/{ZBX_DB_CA_FILE}/${ZBX_DB_CA_FILE}/g" \
-        -e "s/{ZBX_DB_VERIFY_HOST}/${ZBX_DB_VERIFY_HOST:-"false"}/g" \
-        -e "s/{ZBX_DB_CIPHER_LIST}/${ZBX_DB_CIPHER_LIST}/g" \
-        -e "s/{DB_DOUBLE_IEEE754}/${DB_DOUBLE_IEEE754:-"true"}/g" \
-        -e "s/{ZBX_HISTORYSTORAGEURL}/$history_storage_url/g" \
-        -e "s/{ZBX_HISTORYSTORAGETYPES}/$history_storage_types/g" \
-    "$ZBX_WEB_CONFIG"
+    export ZBX_SSO_SETTINGS=${ZBX_SSO_SETTINGS:-""}
 
     if [ -n "${ZBX_SESSION_NAME}" ]; then
         cp "$ZBX_WWW_ROOT/include/defines.inc.php" "/tmp/defines.inc.php_tmp"