diff:
@@ -338,6 +338,15 @@ zabbix::template { 'Template App MySQL':
}
```
+`zabbix::template` class accepts `zabbix_version` parameter, by default is set to module's default Zabbix version.
+Please override if you are using a different version.
+```ruby
+zabbix::template { 'Template App MySQL':
+ templ_source => 'puppet:///modules/zabbix/MySQL.xml',
+ zabbix_version => '5.2'
+}
+```
+
## Zabbix Upgrades
It is possible to do upgrades via this module. An example for the zabbix agent:
@@ -502,6 +511,7 @@ There are some zabbix specific parameters, please check them by opening the mani
* `templ_name`: The name of the template. This name will be found in the Web interface.
* `templ_source`: The location of the XML file wich needs to be imported.
+* `zabbix_version`: The Zabbix version on which the template will be installed on.
## Limitations

diff:
@@ -43,7 +43,7 @@ Puppet::Type.type(:zabbix_template).provide(:ruby, parent: Puppet::Provider::Zab
createMissing: true,
updateExisting: true
},
- templateScreens: {
+ (@resource[:zabbix_version] =~ %r{5\.[^0]} ? :templateDashboards : :templateScreens) => {
createMissing: true,
updateExisting: true
},

diff:
@@ -35,5 +35,9 @@ Puppet::Type.newtype(:zabbix_template) do
desc 'Template source file.'
end
+ newparam(:zabbix_version) do
+ desc 'Zabbix version that the template will be installed on.'
+ end
+
autorequire(:file) { '/etc/zabbix/api.conf' }
end

diff:
@@ -17,6 +17,7 @@ define zabbix::resources::template (
$template_dir = $zabbix::params::zabbix_template_dir,
$template_name = $title,
$template_source = '',
+ $zabbix_version = $zabbix::params::zabbix_version,
) {
file { "${template_dir}/${template_name}.xml":
ensure => file,
@@ -28,6 +29,7 @@ define zabbix::resources::template (
@@zabbix_template { $template_name:
#template_source => $template_source,
template_source => "${template_dir}/${template_name}.xml",
+ zabbix_version => $zabbix_version,
require => File["${template_dir}/${template_name}.xml"],
}
}

diff:
# [*templ_source*]
# The location of the XML file wich needs to be imported.
#
+# [*zabbix_version*]
+# The Zabbix version on which the template will be installed on.
+#
# === Example
#
# zabbix::template { 'Template App MySQL':
define zabbix::template (
$templ_name = $title,
$templ_source = '',
+ String[1] $zabbix_version = $zabbix::params::zabbix_version,
) {
zabbix::resources::template { $templ_name:
template_name => $templ_name,
template_source => $templ_source,
+ zabbix_version => $zabbix_version,
}
}

diff:
@@ -52,6 +52,7 @@ describe 'zabbix_template_host type', unless: default[:platform] =~ %r{(ubuntu-1
zabbix_template { 'TestTemplate1':
template_source => '/root/TestTemplate1.xml',
+ zabbix_version => "#{zabbix_version}",
}
zabbix_template_host{ "TestTemplate1@test1.example.com": }

diff:
@@ -35,6 +35,7 @@ describe 'zabbix_template type', unless: default[:platform] =~ %r{(ubuntu-16.04|
pp2 = <<-EOS
zabbix_template { 'TestTemplate1':
template_source => '/root/TestTemplate1.xml',
+ zabbix_version => "#{zabbix_version}",
}
EOS

original_message:
Adjust for new option in configurations.

templateDashboards is replacing templateScreens option in 5.2+

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add Ubuntu 18.04 and 20.04 support

change_type: MODIFY

diff:
@@ -10,8 +10,10 @@ describe 'zabbix_application type', unless: default[:platform] =~ %r{(ubuntu-16.
template = case zabbix_version
when '4.0'
'Template OS Linux'
- else
+ when '5.0'
'Template OS Linux by Zabbix agent'
+ else
+ 'Linux by Zabbix agent'
end
context "create zabbix_application resources with zabbix version #{zabbix_version}" do

diff:
@@ -12,9 +12,11 @@ describe 'zabbix_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debi
template = case zabbix_version
when '4.0'
- 'Template OS Linux'
+ ['Template OS Linux', 'Template Module ICMP Ping']
+ when '5.0'
+ ['Template OS Linux by Zabbix agent', 'Template Module ICMP Ping']
else
- 'Template OS Linux by Zabbix agent'
+ ['Linux by Zabbix agent', 'ICMP Ping']
end
pp1 = <<-EOS
@@ -65,7 +67,7 @@ describe 'zabbix_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debi
port => 10050,
groups => ['TestgroupOne'],
group_create => true,
- templates => [ "#{template}", ],
+ templates => #{template},
macros => [],
}
@@ -74,7 +76,7 @@ describe 'zabbix_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debi
use_ip => false,
port => 1050,
groups => ['Virtual machines'],
- templates => [ "#{template}", 'Template Module ICMP Ping', ],
+ templates => #{template},
macros => [],
}
EOS
@@ -120,7 +122,7 @@ describe 'zabbix_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debi
expect(test1['interfaces'][0]['useip']).to eq('1')
end
it 'has templates attached' do
- expect(test1['parentTemplates'].map { |t| t['host'] }.sort).to eq([template])
+ expect(test1['parentTemplates'].map { |t| t['host'] }.sort).to eq(template.sort)
end
end
@@ -152,7 +154,7 @@ describe 'zabbix_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debi
expect(test2['interfaces'][0]['useip']).to eq('0')
end
it 'has templates attached' do
- expect(test2['parentTemplates'].map { |t| t['host'] }.sort).to eq(['Template Module ICMP Ping', template])
+ expect(test2['parentTemplates'].map { |t| t['host'] }.sort).to eq(template.sort)
end
end
end

diff:
@@ -10,8 +10,10 @@ describe 'zabbix_template_host type', unless: default[:platform] =~ %r{(ubuntu-1
template = case zabbix_version
when '4.0'
'Template OS Linux'
- else
+ when '5.0'
'Template OS Linux by Zabbix agent'
+ else
+ 'Linux by Zabbix agent'
end

diff:
@@ -7,8 +7,15 @@ def prepare_host
shell('sed -i "/nodocs/d" /etc/yum.conf')
end
end
+
+ if fact('os.family') == 'Debian'
+ shell('rm -f /etc/dpkg/dpkg.cfg.d/excludes')
+ end
+
cleanup_script = <<-SHELL
/opt/puppetlabs/bin/puppet resource service zabbix-server ensure=stopped
+ /opt/puppetlabs/bin/puppet resource service apache2 ensure=stopped
+ /opt/puppetlabs/bin/puppet resource service httpd ensure=stopped
/opt/puppetlabs/bin/puppet resource package zabbix-server-pgsql ensure=purged
/opt/puppetlabs/bin/puppet resource package zabbix-server-pgsql-scl ensure=purged
/opt/puppetlabs/bin/puppet resource package zabbix-server-mysql ensure=purged

license: Apache License 2.0

repo: voxpupuli/puppet-zabbix

original_message:
Add Ubuntu 18.04 and 20.04 support

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Enable Debian 10 acceptance tests

diff:
@@ -2,7 +2,7 @@ require 'spec_helper_acceptance'
require 'serverspec_type_zabbixapi'
# rubocop:disable RSpec/LetBeforeExamples
-describe 'zabbix_application type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9|debian-10)-amd64} do
+describe 'zabbix_application type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9)-amd64} do
%w[4.0 5.0 5.2].each do |zabbix_version|
# 5.2 server packages are not available for RHEL 7
next if zabbix_version == '5.2' and default[:platform] == 'el-7-x86_64'

diff:
@@ -2,7 +2,7 @@ require 'spec_helper_acceptance'
require 'serverspec_type_zabbixapi'
# rubocop:disable RSpec/LetBeforeExamples
-describe 'zabbix_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9|debian-10)-amd64} do
+describe 'zabbix_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9)-amd64} do
%w[4.0 5.0 5.2].each do |zabbix_version|
# 5.2 server packages are not available for RHEL 7
next if zabbix_version == '5.2' and default[:platform] == 'el-7-x86_64'

diff:
@@ -2,7 +2,7 @@ require 'spec_helper_acceptance'
require 'serverspec_type_zabbixapi'
# rubocop:disable RSpec/LetBeforeExamples
-describe 'zabbix_hostgroup type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9|debian-10)-amd64} do
+describe 'zabbix_hostgroup type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9)-amd64} do
%w[4.0 5.0 5.2].each do |zabbix_version|
# 5.2 server packages are not available for RHEL 7
next if zabbix_version == '5.2' and default[:platform] == 'el-7-x86_64'

diff:
@@ -2,7 +2,7 @@ require 'spec_helper_acceptance'
require 'serverspec_type_zabbixapi'
# rubocop:disable RSpec/LetBeforeExamples
-describe 'zabbix_proxy type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9|debian-10)-amd64} do
+describe 'zabbix_proxy type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9)-amd64} do
%w[4.0 5.0 5.2].each do |zabbix_version|
# 5.2 server packages are not available for RHEL 7
next if zabbix_version == '5.2' and default[:platform] == 'el-7-x86_64'

diff:
@@ -2,7 +2,7 @@ require 'spec_helper_acceptance'
require 'serverspec_type_zabbixapi'
# rubocop:disable RSpec/LetBeforeExamples
-describe 'zabbix_template_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9|debian-10)-amd64} do
+describe 'zabbix_template_host type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9)-amd64} do
%w[4.0 5.0 5.2].each do |zabbix_version|
# 5.2 server packages are not available for RHEL 7
next if zabbix_version == '5.2' and default[:platform] == 'el-7-x86_64'

diff:
@@ -2,7 +2,7 @@ require 'spec_helper_acceptance'
require 'serverspec_type_zabbixapi'
# rubocop:disable RSpec/LetBeforeExamples
-describe 'zabbix_template type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9|debian-10)-amd64} do
+describe 'zabbix_template type', unless: default[:platform] =~ %r{(ubuntu-16.04|debian-9)-amd64} do
%w[4.0 5.0 5.2].each do |zabbix_version|
# 5.2 server packages are not available for RHEL 7
next if zabbix_version == '5.2' and default[:platform] == 'el-7-x86_64'

diff:
@@ -8,10 +8,18 @@ def prepare_host
end
end
- if fact('os.family') == 'Debian'
+ # The Ubuntu 18.04+ docker image has a dpkg config that won't install docs, to keep used space low
+ # zabbix packages their SQL file as doc, we need that for bootstrapping the database
+ if fact('os.distro.id') == 'Ubuntu'
shell('rm -f /etc/dpkg/dpkg.cfg.d/excludes')
end
+ # On Debian it seems that make is searching for mkdir in /usr/bin/ but mkdir
+ # does not exist. Symlink it from /bin/mkdir to make it work.
+ if fact('os.distro.id') == 'Debian'
+ shell('ln -sf /bin/mkdir /usr/bin/mkdir')
+ end
+
cleanup_script = <<-SHELL
/opt/puppetlabs/bin/puppet resource service zabbix-server ensure=stopped
/opt/puppetlabs/bin/puppet resource service apache2 ensure=stopped

original_message:
Enable Debian 10 acceptance tests

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


diff:
# This class will be called from zabbix::server or zabbix::proxy.
# No need for calling this class manually.
#
+# === Parameters
+#
+# [*database_port*]
+# Database port to be used for the import process.
+#
# === Authors
#
# Author Name: ikben@werner-dijkerman.nl
@@ -23,6 +28,7 @@ class zabbix::database::mysql (
$database_user = '',
$database_password = '',
$database_host = '',
+ Optional[Stdlib::Port::Unprivileged] $database_port = undef,
$database_path = $zabbix::params::database_path,
) inherits zabbix::params {
assert_private()
@@ -34,12 +40,18 @@ class zabbix::database::mysql (
$schema_path = $database_schema_path
}
+ if $database_port != undef {
+ $port = "-P ${database_port} "
+ } else {
+ $port = ''
+ }
+
case $zabbix_type {
'proxy': {
- $zabbix_proxy_create_sql = "cd ${schema_path} && if [ -f schema.sql.gz ]; then gunzip -f schema.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p'${database_password}' -D '${database_name}' < schema.sql && touch /etc/zabbix/.schema.done"
+ $zabbix_proxy_create_sql = "cd ${schema_path} && if [ -f schema.sql.gz ]; then gunzip -f schema.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p'${database_password}' ${port}-D '${database_name}' < schema.sql && touch /etc/zabbix/.schema.done"
}
default: {
- $zabbix_server_create_sql = "cd ${schema_path} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p'${database_password}' -D '${database_name}' < create.sql && touch /etc/zabbix/.schema.done"
+ $zabbix_server_create_sql = "cd ${schema_path} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && mysql -h '${database_host}' -u '${database_user}' -p'${database_password}' ${port}-D '${database_name}' < create.sql && touch /etc/zabbix/.schema.done"
$zabbix_server_images_sql = 'touch /etc/zabbix/.images.done'
$zabbix_server_data_sql = 'touch /etc/zabbix/.data.done'
}

diff:
# This class will be called from zabbix::server or zabbix::proxy.
# No need for calling this class manually.
#
+# === Parameters
+#
+# [*database_port*]
+# Database port to be used for the import process.
+#
# === Authors
#
# Author Name: ikben@werner-dijkerman.nl
@@ -23,6 +28,7 @@ class zabbix::database::postgresql (
$database_user = '',
$database_password = '',
$database_host = '',
+ Optional[Stdlib::Port::Unprivileged] $database_port = undef,
$database_path = $zabbix::params::database_path,
) inherits zabbix::params {
assert_private()
@@ -40,12 +46,18 @@ class zabbix::database::postgresql (
$schema_path = $database_schema_path
}
+ if $database_port != undef {
+ $port = "-p ${database_port} "
+ } else {
+ $port = ''
+ }
+
case $zabbix_type {
'proxy': {
- $zabbix_proxy_create_sql = "cd ${schema_path} && if [ -f schema.sql.gz ]; then gunzip -f schema.sql.gz ; fi && psql -h '${database_host}' -U '${database_user}' -d '${database_name}' -f schema.sql && touch /etc/zabbix/.schema.done"
+ $zabbix_proxy_create_sql = "cd ${schema_path} && if [ -f schema.sql.gz ]; then gunzip -f schema.sql.gz ; fi && psql -h '${database_host}' -U '${database_user}' ${port}-d '${database_name}' -f schema.sql && touch /etc/zabbix/.schema.done"
}
default: {
- $zabbix_server_create_sql = "cd ${schema_path} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && psql -h '${database_host}' -U '${database_user}' -d '${database_name}' -f create.sql && touch /etc/zabbix/.schema.done"
+ $zabbix_server_create_sql = "cd ${schema_path} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && psql -h '${database_host}' -U '${database_user}' ${port}-d '${database_name}' -f create.sql && touch /etc/zabbix/.schema.done"
$zabbix_server_images_sql = 'touch /etc/zabbix/.images.done'
$zabbix_server_data_sql = 'touch /etc/zabbix/.data.done'
}

diff:
@@ -493,6 +493,7 @@ class zabbix::proxy (
database_user => $database_user,
database_password => $database_password,
database_host => $database_host,
+ database_port => $database_port,
database_path => $database_path,
require => Package["zabbix-proxy-${db}"],
}
@@ -507,6 +508,7 @@ class zabbix::proxy (
database_user => $database_user,
database_password => $database_password,
database_host => $database_host,
+ database_port => $database_port,
database_path => $database_path,
require => Package["zabbix-proxy-${db}"],
}

diff:
@@ -307,7 +307,7 @@ class zabbix::server (
$database_user = $zabbix::params::server_database_user,
$database_password = $zabbix::params::server_database_password,
$database_socket = $zabbix::params::server_database_socket,
- $database_port = $zabbix::params::server_database_port,
+ Optional[Stdlib::Port::Unprivileged] $database_port = $zabbix::params::server_database_port,
$startpollers = $zabbix::params::server_startpollers,
$startipmipollers = $zabbix::params::server_startipmipollers,
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,
@@ -399,6 +399,7 @@ class zabbix::server (
database_user => $database_user,
database_password => $database_password,
database_host => $database_host,
+ database_port => $database_port,
database_path => $database_path,
require => Package["zabbix-server-${db}"],
}
@@ -417,6 +418,7 @@ class zabbix::server (
database_user => $database_user,
database_password => $database_password,
database_host => $database_host,
+ database_port => $database_port,
database_path => $database_path,
require => Package["zabbix-server-${db}"],
}

diff:
@@ -26,6 +26,27 @@ describe 'zabbix::database::mysql' do
%w[4.0 5.0 5.2].each do |zabbix_version|
context "when zabbix_type is server and zabbix version is #{zabbix_version}" do
+ describe 'and database_port is defined' do
+ let :params do
+ {
+ database_name: 'zabbix-server',
+ database_user: 'zabbix-server',
+ database_password: 'zabbix-server',
+ database_host: 'rspec.puppet.com',
+ database_port: 3306,
+ zabbix_type: 'server',
+ zabbix_version: zabbix_version
+ }
+ end
+
+ it { is_expected.to contain_class('zabbix::database::mysql') }
+ it { is_expected.to compile.with_all_deps }
+ it { is_expected.to contain_exec('zabbix_server_create.sql').with_command("cd #{path} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && mysql -h 'rspec.puppet.com' -u 'zabbix-server' -p'zabbix-server' -P 3306 -D 'zabbix-server' < create.sql && touch /etc/zabbix/.schema.done") }
+ it { is_expected.to contain_exec('zabbix_server_images.sql').with_command('touch /etc/zabbix/.images.done') }
+ it { is_expected.to contain_exec('zabbix_server_data.sql').with_command('touch /etc/zabbix/.data.done') }
+ end
+
+ describe 'and no database_port is defined' do
let :params do
{
database_name: 'zabbix-server',
@@ -42,8 +63,29 @@ describe 'zabbix::database::mysql' do
it { is_expected.to contain_exec('zabbix_server_create.sql').with_command("cd #{path} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && mysql -h 'rspec.puppet.com' -u 'zabbix-server' -p'zabbix-server' -D 'zabbix-server' < create.sql && touch /etc/zabbix/.schema.done") }
it { is_expected.to contain_exec('zabbix_server_images.sql').with_command('touch /etc/zabbix/.images.done') }
it { is_expected.to contain_exec('zabbix_server_data.sql').with_command('touch /etc/zabbix/.data.done') }
+ end
+ end
+
+ context "when zabbix_type is server and zabbix version is #{zabbix_version}" do
+ describe "and database_port is defined" do
+ let :params do
+ {
+ database_name: 'zabbix-proxy',
+ database_user: 'zabbix-proxy',
+ database_password: 'zabbix-proxy',
+ database_host: 'rspec.puppet.com',
+ database_port: 3306,
+ zabbix_type: 'proxy',
+ zabbix_version: zabbix_version
+ }
+ end
+
+ it { is_expected.to contain_class('zabbix::database::mysql') }
+ it { is_expected.to compile.with_all_deps }
+ it { is_expected.to contain_exec('zabbix_proxy_create.sql').with_command("cd #{path} && if [ -f schema.sql.gz ]; then gunzip -f schema.sql.gz ; fi && mysql -h 'rspec.puppet.com' -u 'zabbix-proxy' -p'zabbix-proxy' -P 3306 -D 'zabbix-proxy' < schema.sql && touch /etc/zabbix/.schema.done") }
+ end
- describe "when zabbix_type is proxy and zabbix version is #{zabbix_version}" do
+ describe "and no database_port is defined" do
let :params do
{
database_name: 'zabbix-proxy',

diff:
@@ -36,6 +36,28 @@ describe 'zabbix::database::postgresql' do
end
describe "when zabbix_type is server and version is #{zabbix_version}" do
+ let :params do
+ {
+ database_name: 'zabbix-server',
+ database_user: 'zabbix-server',
+ database_password: 'zabbix-server',
+ database_host: 'node01.example.com',
+ database_port: 5432,
+ zabbix_type: 'server',
+ zabbix_version: zabbix_version
+ }
+ end
+
+ it { is_expected.to compile.with_all_deps }
+ it { is_expected.to contain_exec('update_pgpass').with_command('echo node01.example.com:5432:zabbix-server:zabbix-server:zabbix-server >> /root/.pgpass') }
+ it { is_expected.to contain_exec('zabbix_server_create.sql').with_command("cd #{path_for3_and_up} && if [ -f create.sql.gz ]; then gunzip -f create.sql.gz ; fi && psql -h 'node01.example.com' -U 'zabbix-server' -p 5432 -d 'zabbix-server' -f create.sql && touch /etc/zabbix/.schema.done") }
+ it { is_expected.to contain_exec('zabbix_server_images.sql').with_command('touch /etc/zabbix/.images.done') }
+ it { is_expected.to contain_exec('zabbix_server_data.sql').with_command('touch /etc/zabbix/.data.done') }
+ it { is_expected.to contain_file('/root/.pgpass') }
+ it { is_expected.to contain_class('zabbix::params') }
+ end
+
+ describe "when zabbix_type is server and version is #{zabbix_version} and no port is defined" do
let :params do
{
database_name: 'zabbix-server',
@@ -57,6 +79,25 @@ describe 'zabbix::database::postgresql' do
end
describe "when zabbix_type is proxy and version is #{zabbix_version}" do
+ let :params do
+ {
+ database_name: 'zabbix-proxy',
+ database_user: 'zabbix-proxy',
+ database_password: 'zabbix-proxy',
+ database_host: 'node01.example.com',
+ database_port: 5432,
+ zabbix_type: 'proxy',
+ zabbix_version: zabbix_version
+ }
+ end
+
+ it { is_expected.to compile.with_all_deps }
+ it { is_expected.to contain_exec('update_pgpass').with_command('echo node01.example.com:5432:zabbix-proxy:zabbix-proxy:zabbix-proxy >> /root/.pgpass') }
+ it { is_expected.to contain_exec('zabbix_proxy_create.sql').with_command("cd #{path_for3_and_up} && if [ -f schema.sql.gz ]; then gunzip -f schema.sql.gz ; fi && psql -h 'node01.example.com' -U 'zabbix-proxy' -p 5432 -d 'zabbix-proxy' -f schema.sql && touch /etc/zabbix/.schema.done") }
+ it { is_expected.to contain_class('zabbix::params') }
+ end
+
+ describe "when zabbix_type is proxy and version is #{zabbix_version} and no port is defined" do
let :params do
{
database_name: 'zabbix-proxy',

diff:
@@ -204,7 +204,7 @@ describe 'zabbix::server' do
database_host: 'localhost',
database_name: 'zabbix-server',
database_password: 'zabbix-server',
- database_port: '3306',
+ database_port: 3306,
database_schema: 'zabbix-server',
database_socket: '/tmp/socket.db',
database_user: 'zabbix-server',

original_message:
Allow non-default port database importing

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add {Allow,Deny}Key options

diff:
@@ -459,6 +459,8 @@ There are some more zabbix specific parameters, please check them by opening the
### Reference zabbix-agent
* `server`: This is the ipaddress of the zabbix-server or zabbix-proxy.
+* `allowkey`: Allows execution of item keys matching pattern.
+* `denykey`: Deny execution of items keys matching pattern.
* `tlsaccept`: What incoming connections to accept from Zabbix server. Used for a passive proxy, ignored on an active proxy.
* `tlscafile`: Full pathname of a file containing the top-level CA(s) certificates for peer certificate verification.
* `tlscertfile`: Full pathname of a file containing the proxy certificate or certificate chain.

diff:
# [*sourceip*]
# Source ip address for outgoing connections.
#
+# [*allowkey*]
+# Allow execution of item keys matching pattern.
+#
+# [*denykey*]
+# Deny execution of items keys matching pattern.
+#
# [*enableremotecommands*]
# Whether remote commands from zabbix server are allowed.
#
@@ -271,6 +277,8 @@ class zabbix::agent (
$logfilesize = $zabbix::params::agent_logfilesize,
$debuglevel = $zabbix::params::agent_debuglevel,
$sourceip = $zabbix::params::agent_sourceip,
+ Optional[String[1]] $allowkey = $zabbix::params::agent_allowkey,
+ Optional[String[1]] $denykey = $zabbix::params::agent_denykey,
$enableremotecommands = $zabbix::params::agent_enableremotecommands,
$logremotecommands = $zabbix::params::agent_logremotecommands,
$server = $zabbix::params::agent_server,

diff:
@@ -290,6 +290,8 @@ class zabbix::params {
$agent_buffersend = '5'
$agent_buffersize = '100'
$agent_debuglevel = '3'
+ $agent_allowkey = undef
+ $agent_denykey = 'system.run[*]'
$agent_enableremotecommands = '0'
$agent_hostmetadata = undef
$agent_hostmetadataitem = undef

diff:
@@ -260,6 +260,8 @@ describe 'zabbix::agent' do
buffersend: '5',
buffersize: '100',
debuglevel: '4',
+ allowkey: 'system.run[*]',
+ denykey: 'system.run[*]',
enableremotecommands: '1',
hostname: '10050',
include_dir: '/etc/zabbix/zabbix_agentd.d',
@@ -294,6 +296,8 @@ describe 'zabbix::agent' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^BufferSend=5$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^BufferSize=100$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^DebugLevel=4$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^AllowKey=system.run\[\*\]$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^DenyKey=system.run\[\*\]$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^Hostname=10050$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^Include=/etc/zabbix/zabbix_agentd.d$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^ListenPort=10050$} }

diff:
@@ -48,6 +48,32 @@ DebugLevel=<%= @debuglevel %>
#
<% if @sourceip %>SourceIP=<%= @sourceip %><% end %>
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: AllowKey
+# Allow execution of item keys matching pattern.
+# Multiple keys matching rules may be defined in combination with DenyKey.
+# Key pattern is wildcard expression, which support "*" character to match any number of any characters in certain position.
+# It might be used in both key name and key arguments.
+# Parameters are processed one by one according their appearance order.
+# If no AllowKey or DenyKey rules defined, all keys are allowed.
+#
+# Mandatory: no
+<% if @allowkey %>AllowKey=<%= @allowkey -%><% end %>
+
+### Option: DenyKey
+# Deny execution of items keys matching pattern.
+# Multiple keys matching rules may be defined in combination with AllowKey.
+# Key pattern is wildcard expression, which support "*" character to match any number of any characters in certain position.
+# It might be used in both key name and key arguments.
+# Parameters are processed one by one according their appearance order.
+# If no AllowKey or DenyKey rules defined, all keys are allowed.
+# Unless another system.run[*] rule is specified DenyKey=system.run[*] is added by default.
+#
+# Mandatory: no
+# Default:
+<% if @denykey %>DenyKey=<%= @denykey -%><% end %>
+<% end %>
+
<% if @zabbix_version.to_f < 5.0 %>
### Option: EnableRemoteCommands
# Whether remote commands from Zabbix server are allowed.

original_message:
Add {Allow,Deny}Key options

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add {TLSCipher}* options for agent

diff:
# [*tlspskidentity*]
# Unique, case sensitive string used to identify the pre-shared key.
#
+# [*tlscipherall*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for certificate- and PSK-based encryption.
+#
+# [*tlscipherall13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for certificate- and PSK-based encryption.
+#
+# [*tlsciphercert*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for certificate-based encryption.
+#
+# [*tlsciphercert13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for certificate-based encryption.
+#
+# [*tlscipherpsk*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for PSK-based encryption.
+#
+# [*tlscipherpsk13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for PSK-based encryption.
+#
# [*tlsservercertissuer*]
# Allowed server certificate issuer.
#
@@ -311,6 +335,12 @@ class zabbix::agent (
$tlsaccept = $zabbix::params::agent_tlsaccept,
$tlscafile = $zabbix::params::agent_tlscafile,
$tlscertfile = $zabbix::params::agent_tlscertfile,
+ Optional[String[1]] $tlscipherall = $zabbix::params::agent_tlscipherall,
+ Optional[String[1]] $tlscipherall13 = $zabbix::params::agent_tlscipherall13,
+ Optional[String[1]] $tlsciphercert = $zabbix::params::agent_tlsciphercert,
+ Optional[String[1]] $tlsciphercert13 = $zabbix::params::agent_tlsciphercert13,
+ Optional[String[1]] $tlscipherpsk = $zabbix::params::agent_tlscipherpsk,
+ Optional[String[1]] $tlscipherpsk13 = $zabbix::params::agent_tlscipherpsk13,
$tlsconnect = $zabbix::params::agent_tlsconnect,
$tlscrlfile = $zabbix::params::agent_tlscrlfile,
$tlskeyfile = $zabbix::params::agent_tlskeyfile,

diff:
@@ -316,6 +316,12 @@ class zabbix::params {
$agent_tlsaccept = undef
$agent_tlscafile = undef
$agent_tlscertfile = undef
+ $agent_tlscipherall = undef
+ $agent_tlscipherall13 = undef
+ $agent_tlsciphercert = undef
+ $agent_tlsciphercert13 = undef
+ $agent_tlscipherpsk = undef
+ $agent_tlscipherpsk13 = undef
$agent_tlsconnect = undef
$agent_tlscrlfile = undef
$agent_tlskeyfile = undef

diff:
@@ -288,7 +288,13 @@ describe 'zabbix::agent' do
tlscertfile: '/etc/zabbix/keys/tls.crt',
tlskeyfile: '/etc/zabbix/keys/tls.key',
tlspskidentity: '/etc/zabbix/keys/tlspskidentity.id',
- tlspskfile: '/etc/zabbix/keys/tlspskfile.key'
+ tlspskfile: '/etc/zabbix/keys/tlspskfile.key',
+ tlsciphercert: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlsciphercert13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlscipherpsk: 'kECDHEPSK+AES128:kPSK+AES128',
+ tlscipherpsk13: 'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128'
}
end
@@ -324,6 +330,12 @@ describe 'zabbix::agent' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSKeyFile=/etc/zabbix/keys/tls.key$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSPSKIdentity=/etc/zabbix/keys/tlspskidentity.id$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSPSKFile=/etc/zabbix/keys/tlspskfile.key$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherCert=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherCert13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherPSK=kECDHEPSK\+AES128:kPSK\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherAll=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_agentd.conf').with_content %r{^TLSCipherAll13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128:kECDHEPSK\+AES128:kPSK\+AES128$} }
end
end

diff:
@@ -374,3 +374,70 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
# TLSPSKFile=
<% if @tlspskfile %>TLSPSKFile=<%= @tlspskfile %><% end %>
+
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: TLSCipherCert13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+#
+# Mandatory: no
+# Default:
+<% if @tlsciphercert13 %>TLSCipherCert13=<%= @tlsciphercert13 %><% end %>
+
+### Option: TLSCipherCert
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128
+#
+# Mandatory: no
+# Default:
+<% if @tlsciphercert %>TLSCipherCert=<%= @tlsciphercert %><% end %>
+
+### Option: TLSCipherPSK13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example:
+# TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+<% if @tlscipherpsk13 %>TLSCipherPSK13=<%= @tlscipherpsk13 %><% end %>
+
+### Option: TLSCipherPSK
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL
+# Example for OpenSSL:
+# kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+<% if @tlscipherpsk %>TLSCipherPSK=<%= @tlscipherpsk %><% end %>
+
+### Option: TLSCipherAll13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example:
+# TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+<% if @tlscipherall13 %>TLSCipherAll13=<%= @tlscipherall13 %><% end %>
+
+### Option: TLSCipherAll
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
+
+<% end %>

original_message:
Add {TLSCipher}* options for agent

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add DBTLS options

diff:
@@ -127,6 +127,8 @@ class zabbix (
$database_charset = $zabbix::params::server_database_charset,
$database_collate = $zabbix::params::server_database_collate,
$database_tablespace = $zabbix::params::server_database_tablespace,
+ Optional[Enum['required', 'verify_ca', 'verify_full']] $database_tlsconnect = $zabbix::params::server_database_tlsconnect,
+ Optional[Stdlib::Absolutepath] $database_tlscafile = $zabbix::params::server_database_tlscafile,
$startpollers = $zabbix::params::server_startpollers,
$startipmipollers = $zabbix::params::server_startipmipollers,
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,
@@ -259,6 +261,8 @@ class zabbix (
database_password => $database_password,
database_socket => $database_socket,
database_port => $database_port,
+ database_tlsconnect => $database_tlsconnect,
+ database_tlscafile => $database_tlscafile,
startpollers => $startpollers,
startipmipollers => $startipmipollers,
startpollersunreachable => $startpollersunreachable,

diff:
@@ -269,6 +269,12 @@ class zabbix::params {
$server_starttrappers = '5'
$server_startvmwarecollectors = '0'
$server_timeout = '3'
+ $server_database_tlsconnect = undef
+ $server_database_tlscafile = undef
+ $server_database_tlscertfile = undef
+ $server_database_tlskeyfile = undef
+ $server_database_tlscipher = undef
+ $server_database_tlscipher13 = undef
$server_tlscafile = undef
$server_tlscertfile = undef
$server_tlscrlfile = undef
@@ -421,6 +427,12 @@ class zabbix::params {
$proxy_starttrappers = '5'
$proxy_startvmwarecollectors = '0'
$proxy_timeout = '3'
+ $proxy_database_tlsconnect = undef
+ $proxy_database_tlscafile = undef
+ $proxy_database_tlscertfile = undef
+ $proxy_database_tlskeyfile = undef
+ $proxy_database_tlscipher = undef
+ $proxy_database_tlscipher13 = undef
$proxy_tlsaccept = undef
$proxy_tlscafile = undef
$proxy_tlscertfile = undef

diff:
@@ -387,6 +387,12 @@ class zabbix::proxy (
$database_password = $zabbix::params::proxy_database_password,
$database_socket = $zabbix::params::proxy_database_socket,
$database_port = $zabbix::params::proxy_database_port,
+ Optional[Enum['required', 'verify_ca', 'verify_full']] $database_tlsconnect = $zabbix::params::proxy_database_tlsconnect,
+ Optional[Stdlib::Absolutepath] $database_tlscafile = $zabbix::params::proxy_database_tlscafile,
+ Optional[Stdlib::Absolutepath] $database_tlscertfile = $zabbix::params::proxy_database_tlscertfile,
+ Optional[Stdlib::Absolutepath] $database_tlskeyfile = $zabbix::params::proxy_database_tlskeyfile,
+ Optional[String[1]] $database_tlscipher = $zabbix::params::proxy_database_tlscipher,
+ Optional[String[1]] $database_tlscipher13 = $zabbix::params::proxy_database_tlscipher13,
$localbuffer = $zabbix::params::proxy_localbuffer,
$offlinebuffer = $zabbix::params::proxy_offlinebuffer,
$heartbeatfrequency = $zabbix::params::proxy_heartbeatfrequency,

diff:
# [*database_port*]
# Database port when not using local socket. Ignored for sqlite.
#
+# [*database_tlsconnect*]
+# Available options:
+# * required - connect using TLS
+# * verify_ca - connect using TLS and verify certificate
+# * verify_full - connect using TLS, verify certificate and verify that database identity specified by DBHost matches its certificate
+#
+# [*database_tlscafile*]
+# Full pathname of a file containing the top-level CA(s) certificates for database certificate verification.
+#
+# [*database_tlscertfile*]
+# Full pathname of file containing Zabbix server certificate for authenticating to database.
+#
+# [*database_tlskeyfile*]
+# Full pathname of file containing the private key for authenticating to database.
+#
+# [*database_tlscipher*]
+# The list of encryption ciphers that Zabbix server permits for TLS protocols up through TLSv1.2.
+#
+# [*database_tlscipher13*]
+# The list of encryption ciphersuites that Zabbix server permits for TLSv1.3 protocol.
+#
# [*startpollers*]
# Number of pre-forked instances of pollers.
#
@@ -314,6 +335,12 @@ class zabbix::server (
$database_password = $zabbix::params::server_database_password,
$database_socket = $zabbix::params::server_database_socket,
Optional[Stdlib::Port::Unprivileged] $database_port = $zabbix::params::server_database_port,
+ Optional[Enum['required', 'verify_ca', 'verify_full']] $database_tlsconnect = $zabbix::params::server_database_tlsconnect,
+ Optional[Stdlib::Absolutepath] $database_tlscafile = $zabbix::params::server_database_tlscafile,
+ Optional[Stdlib::Absolutepath] $database_tlscertfile = $zabbix::params::server_database_tlscertfile,
+ Optional[Stdlib::Absolutepath] $database_tlskeyfile = $zabbix::params::server_database_tlskeyfile,
+ Optional[String[1]] $database_tlscipher = $zabbix::params::server_database_tlscipher,
+ Optional[String[1]] $database_tlscipher13 = $zabbix::params::server_database_tlscipher13,
$startpollers = $zabbix::params::server_startpollers,
$startipmipollers = $zabbix::params::server_startipmipollers,
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,

diff:
@@ -218,6 +218,12 @@ describe 'zabbix::proxy' do
database_password: 'zabbix-proxy',
database_schema: 'zabbix-proxy',
database_user: 'zabbix-proxy',
+ database_tlsconnect: 'verify_ca',
+ database_tlscafile: '/etc/zabbix/ssl/ca.cert',
+ database_tlscertfile: '/etc/zabbix/ssl/cert.cert',
+ database_tlskeyfile: '/etc/zabbix/ssl/key.key',
+ database_tlscipher: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ database_tlscipher13: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
datasenderfrequency: '1',
debuglevel: '4',
externalscripts: '/usr/lib/zabbix/externalscripts',
@@ -288,6 +294,12 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBSchema=zabbix-proxy$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBUser=zabbix-proxy$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBPassword=zabbix-proxy$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSConnect=verify_ca} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSCAFile=/etc/zabbix/ssl/ca.cert} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSCertFile=/etc/zabbix/ssl/cert.cert} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSKeyFile=/etc/zabbix/ssl/key.key} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSCipher=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSCipher13=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^ProxyLocalBuffer=0$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^ProxyOfflineBuffer=1$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^HeartbeatFrequency=60$} }

diff:
@@ -208,6 +208,12 @@ describe 'zabbix::server' do
database_schema: 'zabbix-server',
database_socket: '/tmp/socket.db',
database_user: 'zabbix-server',
+ database_tlsconnect: 'verify_ca',
+ database_tlscafile: '/etc/zabbix/ssl/ca.cert',
+ database_tlscertfile: '/etc/zabbix/ssl/cert.cert',
+ database_tlskeyfile: '/etc/zabbix/ssl/key.key',
+ database_tlscipher: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ database_tlscipher13: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
debuglevel: '3',
externalscripts: '/usr/lib/zabbix/externalscripts0',
fping6location: '/usr/sbin/fping6',
@@ -268,6 +274,12 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBPort=3306} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBSchema=zabbix-server} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBSocket=/tmp/socket.db} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSConnect=verify_ca} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSCAFile=/etc/zabbix/ssl/ca.cert} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSCertFile=/etc/zabbix/ssl/cert.cert} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSKeyFile=/etc/zabbix/ssl/key.key} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSCipher=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSCipher13=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBUser=zabbix-server} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DebugLevel=3} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^ExternalScripts=/usr/lib/zabbix/externalscripts} }

diff:
@@ -504,3 +504,62 @@ LoadModulePath=<%= @loadmodulepath %>
# Full pathname of a file containing the pre-shared key.
#
<% if @tlspskfile %>TLSPSKFile=<%= @tlspskfile %><% end %>
+
+####### For advanced users - TLS ciphersuite selection criteria #######
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: DBTLSConnect
+# Setting this option enforces to use TLS connection to database.
+# required - connect using TLS
+# verify_ca - connect using TLS and verify certificate
+# verify_full - connect using TLS, verify certificate and verify that database identity specified by DBHost
+# matches its certificate
+# On MySQL starting from 5.7.11 and PostgreSQL following values are supported: "required", "verify_ca" and
+# "verify_full".
+# On MariaDB starting from version 10.2.6 "required" and "verify_full" values are supported.
+# Default is not to set any option and behavior depends on database configuration
+#
+# Mandatory: no
+# Default:
+<% if @database_tlsconnect %>DBTLSConnect=<%= @database_tlsconnect %><% end %>
+
+### Option: DBTLSCAFile
+# Full pathname of a file containing the top-level CA(s) certificates for database certificate verification.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# (yes, if DBTLSConnect set to one of: verify_ca, verify_full)
+# Default:
+<% if @database_tlscafile %>DBTLSCAFile=<%= @database_tlscafile %><% end %>
+
+### Option: DBTLSCertFile
+# Full pathname of file containing Zabbix server certificate for authenticating to database.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# Default:
+<% if @database_tlscertfile %>DBTLSCertFile=<%= @database_tlscertfile %><% end %>
+
+### Option: DBTLSKeyFile
+# Full pathname of file containing the private key for authenticating to database.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# Default:
+<% if @database_tlskeyfile %>DBTLSKeyFile=<%= @database_tlskeyfile %><% end %>
+
+### Option: DBTLSCipher
+# The list of encryption ciphers that Zabbix server permits for TLS protocols up through TLSv1.2
+# Supported only for MySQL
+#
+# Mandatory no
+# Default:
+<% if @database_tlscipher %>DBTLSCipher=<%= @database_tlscipher %><% end %>
+
+### Option: DBTLSCipher13
+# The list of encryption ciphersuites that Zabbix server permits for TLSv1.3 protocol
+# Supported only for MySQL, starting from version 8.0.16
+#
+# Mandatory no
+# Default:
+<% if @database_tlscipher13 %>DBTLSCipher13=<%= @database_tlscipher13 %><% end %>
+<% end %>

diff:
@@ -457,3 +457,62 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
# TLSKeyFile=
<% if @tlskeyfile %>TLSKeyFile=<%= @tlskeyfile %><% end %>
+
+####### For advanced users - TLS ciphersuite selection criteria #######
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: DBTLSConnect
+# Setting this option enforces to use TLS connection to database.
+# required - connect using TLS
+# verify_ca - connect using TLS and verify certificate
+# verify_full - connect using TLS, verify certificate and verify that database identity specified by DBHost
+# matches its certificate
+# On MySQL starting from 5.7.11 and PostgreSQL following values are supported: "required", "verify_ca" and
+# "verify_full".
+# On MariaDB starting from version 10.2.6 "required" and "verify_full" values are supported.
+# Default is not to set any option and behavior depends on database configuration
+#
+# Mandatory: no
+# Default:
+<% if @database_tlsconnect %>DBTLSConnect=<%= @database_tlsconnect %><% end %>
+
+### Option: DBTLSCAFile
+# Full pathname of a file containing the top-level CA(s) certificates for database certificate verification.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# (yes, if DBTLSConnect set to one of: verify_ca, verify_full)
+# Default:
+<% if @database_tlscafile %>DBTLSCAFile=<%= @database_tlscafile %><% end %>
+
+### Option: DBTLSCertFile
+# Full pathname of file containing Zabbix server certificate for authenticating to database.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# Default:
+<% if @database_tlscertfile %>DBTLSCertFile=<%= @database_tlscertfile %><% end %>
+
+### Option: DBTLSKeyFile
+# Full pathname of file containing the private key for authenticating to database.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# Default:
+<% if @database_tlskeyfile %>DBTLSKeyFile=<%= @database_tlskeyfile %><% end %>
+
+### Option: DBTLSCipher
+# The list of encryption ciphers that Zabbix server permits for TLS protocols up through TLSv1.2
+# Supported only for MySQL
+#
+# Mandatory no
+# Default:
+<% if @database_tlscipher %>DBTLSCipher=<%= @database_tlscipher %><% end %>
+
+### Option: DBTLSCipher13
+# The list of encryption ciphersuites that Zabbix server permits for TLSv1.3 protocol
+# Supported only for MySQL, starting from version 8.0.16
+#
+# Mandatory no
+# Default:
+<% if @database_tlscipher13 %>DBTLSCipher13=<%= @database_tlscipher13 %><% end %>
+<% end %>

original_message:
Add DBTLS options

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add {TLSCipher}* options for proxy/server

diff:
@@ -161,6 +161,12 @@ class zabbix (
$tlscertfile = $zabbix::params::server_tlscertfile,
$tlscrlfile = $zabbix::params::server_tlscrlfile,
$tlskeyfile = $zabbix::params::server_tlskeyfile,
+ $tlscipherall = $zabbix::params::server_tlscipherall,
+ $tlscipherall13 = $zabbix::params::server_tlscipherall13,
+ $tlsciphercert = $zabbix::params::server_tlsciphercert,
+ $tlsciphercert13 = $zabbix::params::server_tlsciphercert13,
+ $tlscipherpsk = $zabbix::params::server_tlscipherpsk,
+ $tlscipherpsk13 = $zabbix::params::server_tlscipherpsk13,
$trappertimeout = $zabbix::params::server_trappertimeout,
$unreachableperiod = $zabbix::params::server_unreachableperiod,
$unavailabledelay = $zabbix::params::server_unavailabledelay,
@@ -295,6 +301,12 @@ class zabbix (
tlscertfile => $tlscertfile,
tlscrlfile => $tlscrlfile,
tlskeyfile => $tlskeyfile,
+ tlscipherall => $tlscipherall,
+ tlscipherall13 => $tlscipherall13,
+ tlsciphercert => $tlsciphercert,
+ tlsciphercert13 => $tlsciphercert13,
+ tlscipherpsk => $tlscipherpsk,
+ tlscipherpsk13 => $tlscipherpsk13,
trappertimeout => $trappertimeout,
unreachableperiod => $unreachableperiod,
unavailabledelay => $unavailabledelay,

diff:
@@ -279,6 +279,12 @@ class zabbix::params {
$server_tlscertfile = undef
$server_tlscrlfile = undef
$server_tlskeyfile = undef
+ $server_tlscipherall = undef
+ $server_tlscipherall13 = undef
+ $server_tlsciphercert = undef
+ $server_tlsciphercert13 = undef
+ $server_tlscipherpsk = undef
+ $server_tlscipherpsk13 = undef
$server_tmpdir = '/tmp'
$server_trappertimeout = '300'
$server_trendcachesize = '4M'
@@ -322,16 +328,16 @@ class zabbix::params {
$agent_tlsaccept = undef
$agent_tlscafile = undef
$agent_tlscertfile = undef
+ $agent_tlsconnect = undef
+ $agent_tlscrlfile = undef
+ $agent_tlskeyfile = undef
+ $agent_tlspskfile = undef
$agent_tlscipherall = undef
$agent_tlscipherall13 = undef
$agent_tlsciphercert = undef
$agent_tlsciphercert13 = undef
$agent_tlscipherpsk = undef
$agent_tlscipherpsk13 = undef
- $agent_tlsconnect = undef
- $agent_tlscrlfile = undef
- $agent_tlskeyfile = undef
- $agent_tlspskfile = undef
$agent_tlspskidentity = undef
$agent_tlsservercertissuer = undef
$agent_tlsservercertsubject = undef
@@ -440,6 +446,12 @@ class zabbix::params {
$proxy_tlscrlfile = undef
$proxy_tlskeyfile = undef
$proxy_tlspskfile = undef
+ $proxy_tlscipherall = undef
+ $proxy_tlscipherall13 = undef
+ $proxy_tlsciphercert = undef
+ $proxy_tlsciphercert13 = undef
+ $proxy_tlscipherpsk = undef
+ $proxy_tlscipherpsk13 = undef
$proxy_tlspskidentity = undef
$proxy_tlsservercertissuer = undef
$proxy_tlsservercertsubject = undef

diff:
@@ -432,6 +432,12 @@ class zabbix::proxy (
$tlskeyfile = $zabbix::params::proxy_tlskeyfile,
$tlspskfile = $zabbix::params::proxy_tlspskfile,
$tlspskidentity = $zabbix::params::proxy_tlspskidentity,
+ Optional[String[1]] $tlscipherall = $zabbix::params::proxy_tlscipherall,
+ Optional[String[1]] $tlscipherall13 = $zabbix::params::proxy_tlscipherall13,
+ Optional[String[1]] $tlsciphercert = $zabbix::params::proxy_tlsciphercert,
+ Optional[String[1]] $tlsciphercert13 = $zabbix::params::proxy_tlsciphercert13,
+ Optional[String[1]] $tlscipherpsk = $zabbix::params::proxy_tlscipherpsk,
+ Optional[String[1]] $tlscipherpsk13 = $zabbix::params::proxy_tlscipherpsk13,
$tlsservercertissuer = $zabbix::params::proxy_tlsservercertissuer,
$tlsservercertsubject = $zabbix::params::proxy_tlsservercertsubject,
$trappertimeout = $zabbix::params::proxy_trappertimeout,

diff:
# [*tlskeyfile*]
# Full pathname of a file containing the server private key.
#
+# [*tlscipherall*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for certificate- and PSK-based encryption.
+#
+# [*tlscipherall13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for certificate- and PSK-based encryption.
+#
+# [*tlsciphercert*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for certificate-based encryption.
+#
+# [*tlsciphercert13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for certificate-based encryption.
+#
+# [*tlscipherpsk*]
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string. Override the default ciphersuite selection criteria
+# for PSK-based encryption.
+#
+# [*tlscipherpsk13*]
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3. Override the default ciphersuite selection criteria
+# for PSK-based encryption.
+#
# [*trappertimeout*]
# Specifies how many seconds trapper may spend processing new data.
#
@@ -373,6 +397,12 @@ class zabbix::server (
$tlscertfile = $zabbix::params::server_tlscertfile,
$tlscrlfile = $zabbix::params::server_tlscrlfile,
$tlskeyfile = $zabbix::params::server_tlskeyfile,
+ Optional[String[1]] $tlscipherall = $zabbix::params::server_tlscipherall,
+ Optional[String[1]] $tlscipherall13 = $zabbix::params::server_tlscipherall13,
+ Optional[String[1]] $tlsciphercert = $zabbix::params::server_tlsciphercert,
+ Optional[String[1]] $tlsciphercert13 = $zabbix::params::server_tlsciphercert13,
+ Optional[String[1]] $tlscipherpsk = $zabbix::params::server_tlscipherpsk,
+ Optional[String[1]] $tlscipherpsk13 = $zabbix::params::server_tlscipherpsk13,
$trappertimeout = $zabbix::params::server_trappertimeout,
$unreachableperiod = $zabbix::params::server_unreachableperiod,
$unavailabledelay = $zabbix::params::server_unavailabledelay,

diff:
@@ -275,7 +275,13 @@ describe 'zabbix::proxy' do
vmwarefrequency: '60',
zabbix_server_host: '192.168.1.1',
zabbix_server_port: '10051',
- zabbix_version: '5.0'
+ zabbix_version: '5.0',
+ tlsciphercert: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlsciphercert13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlscipherpsk: 'kECDHEPSK+AES128:kPSK+AES128',
+ tlscipherpsk13: 'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128'
}
end
@@ -343,6 +349,12 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^SSLCALocation=/usr/lib/zabbix/ssl/certs} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^LoadModulePath=\$\{libdir\}/modules$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^LoadModule=pizza$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherCert=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherCert13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherPSK=kECDHEPSK\+AES128:kPSK\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherAll=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^TLSCipherAll13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128:kECDHEPSK\+AES128:kPSK\+AES128$} }
end
context 'with zabbix_proxy.conf and version 4.0' do

diff:
@@ -260,7 +260,13 @@ describe 'zabbix::server' do
valuecachesize: '4M',
vmwarecachesize: '8M',
vmwarefrequency: '60',
- zabbix_version: '5.0'
+ zabbix_version: '5.0',
+ tlsciphercert: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlsciphercert13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128',
+ tlscipherpsk: 'kECDHEPSK+AES128:kPSK+AES128',
+ tlscipherpsk13: 'TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ tlscipherall13: 'EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128'
}
end
@@ -327,6 +333,12 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^ValueCacheSize=4M} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VMwareCacheSize=8M} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VMwareFrequency=60} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherCert=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherCert13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherPSK=kECDHEPSK\+AES128:kPSK\+AES128$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherPSK13=TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherAll=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^TLSCipherAll13=EECDH\+aRSA\+AES128:RSA\+aRSA\+AES128:kECDHEPSK\+AES128:kPSK\+AES128$} }
end
context 'with zabbix_server.conf and version 5.0' do

diff:
@@ -563,3 +563,77 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
<% if @database_tlscipher13 %>DBTLSCipher13=<%= @database_tlscipher13 %><% end %>
<% end %>
+
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: TLSCipherCert13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+#
+# Mandatory: no
+# Default:
+# TLSCipherCert13=
+<% if @tlsciphercert13 %>TLSCipherCert13=<%= @tlsciphercert13 %><% end %>
+
+### Option: TLSCipherCert
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherCert=
+<% if @tlsciphercert %>TLSCipherCert=<%= @tlsciphercert %><% end %>
+
+### Option: TLSCipherPSK13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example:
+# TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+# TLSCipherPSK13=
+<% if @tlscipherpsk13 %>TLSCipherPSK13=<%= @tlscipherpsk13 %><% end %>
+
+### Option: TLSCipherPSK
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL
+# Example for OpenSSL:
+# kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherPSK=
+<% if @tlscipherpsk %>TLSCipherPSK=<%= @tlscipherpsk %><% end %>
+
+### Option: TLSCipherAll13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example:
+# TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+# TLSCipherAll13=
+<% if @tlscipherall13 %>TLSCipherAll13=<%= @tlscipherall13 %><% end %>
+
+### Option: TLSCipherAll
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherAll13=
+<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
+
+<% end %>
+

diff:
@@ -516,3 +516,76 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
<% if @database_tlscipher13 %>DBTLSCipher13=<%= @database_tlscipher13 %><% end %>
<% end %>
+
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: TLSCipherCert13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+#
+# Mandatory: no
+# Default:
+# TLSCipherCert13=
+<% if @tlsciphercert13 %>TLSCipherCert13=<%= @tlsciphercert13 %><% end %>
+
+### Option: TLSCipherCert
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherCert=
+<% if @tlsciphercert %>TLSCipherCert=<%= @tlsciphercert %><% end %>
+
+### Option: TLSCipherPSK13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example:
+# TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+# TLSCipherPSK13=
+<% if @tlscipherpsk13 %>TLSCipherPSK13=<%= @tlscipherpsk13 %><% end %>
+
+### Option: TLSCipherPSK
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL
+# Example for OpenSSL:
+# kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherPSK=
+<% if @tlscipherpsk %>TLSCipherPSK=<%= @tlscipherpsk %><% end %>
+
+### Option: TLSCipherAll13
+# Cipher string for OpenSSL 1.1.1 or newer in TLS 1.3.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example:
+# TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
+#
+# Mandatory: no
+# Default:
+# TLSCipherAll13=
+<% if @tlscipherall13 %>TLSCipherAll13=<%= @tlscipherall13 %><% end %>
+
+### Option: TLSCipherAll
+# GnuTLS priority string or OpenSSL (TLS 1.2) cipher string.
+# Override the default ciphersuite selection criteria for certificate- and PSK-based encryption.
+# Example for GnuTLS:
+# NONE:+VERS-TLS1.2:+ECDHE-RSA:+RSA:+ECDHE-PSK:+PSK:+AES-128-GCM:+AES-128-CBC:+AEAD:+SHA256:+SHA1:+CURVE-ALL:+COMP-NULL:+SIGN-ALL:+CTYPE-X.509
+# Example for OpenSSL:
+# EECDH+aRSA+AES128:RSA+aRSA+AES128:kECDHEPSK+AES128:kPSK+AES128
+#
+# Mandatory: no
+# Default:
+# TLSCipherAll13=
+<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
+
+<% end %>


message: Add StartAlerters option

diff:
@@ -134,6 +134,7 @@ class zabbix (
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,
$starttrappers = $zabbix::params::server_starttrappers,
$startpingers = $zabbix::params::server_startpingers,
+ Integer[1, 100] $startalerters = $zabbix::params::server_startalerters,
$startdiscoverers = $zabbix::params::server_startdiscoverers,
$starthttppollers = $zabbix::params::server_starthttppollers,
$starttimers = $zabbix::params::server_starttimers,
@@ -274,6 +275,7 @@ class zabbix (
startpollersunreachable => $startpollersunreachable,
starttrappers => $starttrappers,
startpingers => $startpingers,
+ startalerters => $startalerters,
startdiscoverers => $startdiscoverers,
starthttppollers => $starthttppollers,
starttimers => $starttimers,

diff:
@@ -256,6 +256,7 @@ class zabbix::params {
$server_sslcertlocation = '/usr/lib/zabbix/ssl/certs'
$server_sslkeylocation = '/usr/lib/zabbix/ssl/keys'
$server_startdbsyncers = '4'
+ $server_startalerters = 3
$server_startdiscoverers = '1'
$server_starthttppollers = '1'
$server_startipmipollers = '0'

diff:
# [*startpingers*]
# Number of pre-forked instances of icmp pingers.
#
+# [*startalerters*]
+# Number of pre-forked instances of alerters.
+#
# [*startdiscoverers*]
# Number of pre-forked instances of discoverers.
#
@@ -370,6 +373,7 @@ class zabbix::server (
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,
$starttrappers = $zabbix::params::server_starttrappers,
$startpingers = $zabbix::params::server_startpingers,
+ Integer[1, 100] $startalerters = $zabbix::params::server_startalerters,
$startdiscoverers = $zabbix::params::server_startdiscoverers,
$starthttppollers = $zabbix::params::server_starthttppollers,
$starttimers = $zabbix::params::server_starttimers,

diff:
@@ -239,6 +239,7 @@ describe 'zabbix::server' do
sourceip: '192.168.1.1',
sshkeylocation: '/home/zabbix',
startdbsyncers: '4',
+ startalerters: 10,
startdiscoverers: '1',
starthttppollers: '1',
startipmipollers: '12',
@@ -312,6 +313,7 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^SourceIP=192.168.1.1} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^SSHKeyLocation=/home/zabbix} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartDBSyncers=4} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartAlerters=10} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartDiscoverers=1} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartHTTPPollers=1} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartIPMIPollers=12} }

diff:
@@ -158,6 +158,16 @@ StartTimers=<%= @starttimers %>
#
<% if @startescalators %>StartEscalators=<%= @startescalators %><% end %>
+### Option: StartAlerters
+# Number of pre-forked instances of alerters.
+# Alerters send the notifications created by action operations.
+#
+# Mandatory: no
+# Range: 0-100
+# Default:
+# StartAlerters=3
+<% if @startalerters %>StartAlerters=<%= @startalerters %><% end %>
+
<% if @javagateway %>
### Option: JavaGateway
# IP address (or hostname) of Zabbix Java gateway.

original_message:
Add StartAlerters option

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add StartEscalators option

diff:
@@ -136,6 +136,7 @@ class zabbix (
$startpingers = $zabbix::params::server_startpingers,
Integer[1, 100] $startalerters = $zabbix::params::server_startalerters,
$startdiscoverers = $zabbix::params::server_startdiscoverers,
+ Integer[1, 100] $startescalators = $zabbix::params::server_startescalators,
$starthttppollers = $zabbix::params::server_starthttppollers,
$starttimers = $zabbix::params::server_starttimers,
$javagateway = $zabbix::params::server_javagateway,
@@ -277,6 +278,7 @@ class zabbix (
startpingers => $startpingers,
startalerters => $startalerters,
startdiscoverers => $startdiscoverers,
+ startescalators => $startescalators,
starthttppollers => $starthttppollers,
starttimers => $starttimers,
javagateway => $javagateway,

diff:
@@ -258,6 +258,7 @@ class zabbix::params {
$server_startdbsyncers = '4'
$server_startalerters = 3
$server_startdiscoverers = '1'
+ $server_startescalators = 1
$server_starthttppollers = '1'
$server_startipmipollers = '0'
$server_startjavapollers = '5'

diff:
# [*startdiscoverers*]
# Number of pre-forked instances of discoverers.
#
+# [*startescalators*]
+# Number of pre-forked instances of escalators.
+#
# [*starthttppollers*]
# Number of pre-forked instances of http pollers.
#
@@ -375,6 +378,7 @@ class zabbix::server (
$startpingers = $zabbix::params::server_startpingers,
Integer[1, 100] $startalerters = $zabbix::params::server_startalerters,
$startdiscoverers = $zabbix::params::server_startdiscoverers,
+ Integer[1, 100] $startescalators = $zabbix::params::server_startescalators,
$starthttppollers = $zabbix::params::server_starthttppollers,
$starttimers = $zabbix::params::server_starttimers,
$javagateway = $zabbix::params::server_javagateway,

diff:
@@ -241,6 +241,7 @@ describe 'zabbix::server' do
startdbsyncers: '4',
startalerters: 10,
startdiscoverers: '1',
+ startescalators: 10,
starthttppollers: '1',
startipmipollers: '12',
startpingers: '1',
@@ -315,6 +316,7 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartDBSyncers=4} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartAlerters=10} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartDiscoverers=1} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartEscalators=10} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartHTTPPollers=1} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartIPMIPollers=12} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartPingers=1} }

original_message:
Add StartEscalators option

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add StartLLDProcessors option

diff:
@@ -142,6 +142,7 @@ class zabbix (
$javagateway = $zabbix::params::server_javagateway,
$javagatewayport = $zabbix::params::server_javagatewayport,
$startjavapollers = $zabbix::params::server_startjavapollers,
+ Integer[1, 100] $startlldprocessors = $zabbix::params::server_startlldprocessors,
$startvmwarecollectors = $zabbix::params::server_startvmwarecollectors,
$vmwarefrequency = $zabbix::params::server_vmwarefrequency,
$vmwarecachesize = $zabbix::params::server_vmwarecachesize,
@@ -284,6 +285,7 @@ class zabbix (
javagateway => $javagateway,
javagatewayport => $javagatewayport,
startjavapollers => $startjavapollers,
+ startlldprocessors => $startlldprocessors,
startvmwarecollectors => $startvmwarecollectors,
vmwarefrequency => $vmwarefrequency,
vmwarecachesize => $vmwarecachesize,

diff:
@@ -262,6 +262,7 @@ class zabbix::params {
$server_starthttppollers = '1'
$server_startipmipollers = '0'
$server_startjavapollers = '5'
+ $server_startlldprocessors = 2
$server_startpingers = '1'
$server_startpollers = '5'
$server_startpollersunreachable = '1'

diff:
# [*startjavapollers*]
# Number of pre-forked instances of java pollers.
#
+# [*startlldprocessors*]
+# Number of pre-forked instances of low-level discovery (LLD) workers.
+#
# [*startvmwarecollectors*]
# Number of pre-forked vmware collector instances.
#
@@ -384,6 +387,7 @@ class zabbix::server (
$javagateway = $zabbix::params::server_javagateway,
$javagatewayport = $zabbix::params::server_javagatewayport,
$startjavapollers = $zabbix::params::server_startjavapollers,
+ Integer[1, 100] $startlldprocessors = $zabbix::params::server_startlldprocessors,
$startvmwarecollectors = $zabbix::params::server_startvmwarecollectors,
$vmwarefrequency = $zabbix::params::server_vmwarefrequency,
$vmwarecachesize = $zabbix::params::server_vmwarecachesize,

diff:
@@ -251,6 +251,7 @@ describe 'zabbix::server' do
startsnmptrapper: '1',
starttimers: '1',
starttrappers: '5',
+ startlldprocessors: 5,
startvmwarecollectors: '5',
timeout: '3',
tmpdir: '/tmp',
@@ -310,6 +311,7 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^PidFile=/var/run/zabbix/zabbix_server.pid} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^ProxyConfigFrequency=3600} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^ProxyDataFrequency=1} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartLLDProcessors=5} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^SNMPTrapperFile=/tmp/zabbix_traps.tmp} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^SourceIP=192.168.1.1} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^SSHKeyLocation=/home/zabbix} }

diff:
@@ -374,6 +374,17 @@ ProxyConfigFrequency=<%= @proxyconfigfrequency %>
#
ProxyDataFrequency=<%= @proxydatafrequency %>
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: StartLLDProcessors
+# Number of pre-forked instances of low level discovery processors.
+#
+# Mandatory: no
+# Range: 1-100
+# Default:
+# StartLLDProcessors=2
+<% if @startlldprocessors %>StartLLDProcessors=<%= @startlldprocessors -%><% end %>
+<% end %>
+
### Option: AllowRoot
# Allow the server to run as 'root'. If disabled and the server is started by 'root', the server
# will try to switch to the user specified by the User configuration option instead.

original_message:
Add StartLLDProcessors option

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add StartPreprocessors option

diff:
@@ -132,6 +132,7 @@ class zabbix (
$startpollers = $zabbix::params::server_startpollers,
$startipmipollers = $zabbix::params::server_startipmipollers,
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,
+ Integer[1, 1000] $startpreprocessors = $zabbix::params::server_startpreprocessors,
$starttrappers = $zabbix::params::server_starttrappers,
$startpingers = $zabbix::params::server_startpingers,
Integer[1, 100] $startalerters = $zabbix::params::server_startalerters,
@@ -275,6 +276,7 @@ class zabbix (
startpollers => $startpollers,
startipmipollers => $startipmipollers,
startpollersunreachable => $startpollersunreachable,
+ startpreprocessors => $startpreprocessors,
starttrappers => $starttrappers,
startpingers => $startpingers,
startalerters => $startalerters,

diff:
@@ -266,6 +266,7 @@ class zabbix::params {
$server_startpingers = '1'
$server_startpollers = '5'
$server_startpollersunreachable = '1'
+ $server_startpreprocessors = 3
$server_startproxypollers = '1'
$server_startsnmptrapper = '0'
$server_starttimers = '1'
@@ -433,6 +434,7 @@ class zabbix::params {
$proxy_startpingers = '1'
$proxy_startpollers = '5'
$proxy_startpollersunreachable = '1'
+ $proxy_startpreprocessors = 3
$proxy_starttrappers = '5'
$proxy_startvmwarecollectors = '0'
$proxy_timeout = '3'

diff:
# [*startpollers*]
# Number of pre-forked instances of pollers.
#
+# [*startpreprocessors*]
+# Number of pre-forked instances of preprocessing workers
+#
# [*startipmipollers*]
# Number of pre-forked instances of ipmi pollers.
#
@@ -401,6 +404,7 @@ class zabbix::proxy (
$startpollers = $zabbix::params::proxy_startpollers,
$startipmipollers = $zabbix::params::proxy_startipmipollers,
$startpollersunreachable = $zabbix::params::proxy_startpollersunreachable,
+ Integer[1, 1000] $startpreprocessors = $zabbix::params::proxy_startpreprocessors,
$starttrappers = $zabbix::params::proxy_starttrappers,
$startpingers = $zabbix::params::proxy_startpingers,
$startdiscoverers = $zabbix::params::proxy_startdiscoverers,

diff:
# [*startpollers*]
# Number of pre-forked instances of pollers.
#
+# [*startpreprocessors*]
+# Number of pre-forked instances of preprocessing workers
+#
# [*startipmipollers*]
# Number of pre-forked instances of ipmi pollers.
#
@@ -377,6 +380,7 @@ class zabbix::server (
$startpollers = $zabbix::params::server_startpollers,
$startipmipollers = $zabbix::params::server_startipmipollers,
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,
+ Integer[1, 1000] $startpreprocessors = $zabbix::params::server_startpreprocessors,
$starttrappers = $zabbix::params::server_starttrappers,
$startpingers = $zabbix::params::server_startpingers,
Integer[1, 100] $startalerters = $zabbix::params::server_startalerters,

diff:
@@ -263,6 +263,7 @@ describe 'zabbix::proxy' do
startpingers: '15',
startpollers: '15',
startpollersunreachable: '15',
+ startpreprocessors: 10,
starttrappers: '15',
startvmwarecollectors: '0',
timeout: '20',
@@ -313,6 +314,7 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DataSenderFrequency=1$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^StartPollers=15$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^StartIPMIPollers=15$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^StartPreprocessors=10$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^StartPollersUnreachable=15$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^StartTrappers=15$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^StartPingers=15$} }

diff:
@@ -247,6 +247,7 @@ describe 'zabbix::server' do
startpingers: '1',
startpollers: '12',
startpollersunreachable: '1',
+ startpreprocessors: 10,
startproxypollers: '1',
startsnmptrapper: '1',
starttimers: '1',
@@ -324,6 +325,7 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartPingers=1} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartPollers=12} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartPollersUnreachable=1} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartPreprocessors=10} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartProxyPollers=1} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartSNMPTrapper=1} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^StartTimers=1} }

diff:
@@ -203,6 +203,16 @@ StartIPMIPollers=<%= @startipmipollers %>
#
StartPollersUnreachable=<%= @startpollersunreachable %>
+### Option: StartPreprocessors
+# Number of pre-forked instances of preprocessing workers.
+# The preprocessing manager process is automatically started when preprocessor worker is started.
+#
+# Mandatory: no
+# Range: 1-1000
+# Default:
+# StartPreprocessors=3
+<% if @startpreprocessors %>StartPreprocessors=<%= @startpreprocessors -%><% end %>
+
### Option: StartTrappers
# Number of pre-forked instances of trappers.
# Trappers accept incoming connections from Zabbix sender and active agents.

diff:
@@ -116,6 +116,16 @@ StartPollers=<%= @startpollers %>
#
StartIPMIPollers=<%= @startipmipollers %>
+### Option: StartPreprocessors
+# Number of pre-forked instances of preprocessing workers.
+# The preprocessing manager process is automatically started when preprocessor worker is started.
+#
+# Mandatory: no
+# Range: 1-1000
+# Default:
+# StartPreprocessors=3
+<% if @startpreprocessors %>StartPreprocessors=<%= @startpreprocessors -%><% end %>
+
### Option: StartPollersUnreachable
# Number of pre-forked instances of pollers for unreachable hosts (including IPMI and Java).
# At least one poller for unreachable hosts must be running if regular, IPMI or Java pollers

original_message:
Add StartPreprocessors option

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Optimize acceptance tests

diff:
@@ -18,19 +18,27 @@ def prepare_host
# does not exist. Symlink it from /bin/mkdir to make it work.
shell('ln -sf /bin/mkdir /usr/bin/mkdir') if fact('os.distro.id') == 'Debian'
- cleanup_script = <<-SHELL
+ cleanup_script_debian = <<-SHELL
/opt/puppetlabs/bin/puppet resource service zabbix-server ensure=stopped
/opt/puppetlabs/bin/puppet resource service apache2 ensure=stopped
+ /opt/puppetlabs/bin/puppet resource package zabbix-server-pgsql ensure=purged
+ /opt/puppetlabs/bin/puppet resource package zabbix-web-pgsql ensure=purged
+ /opt/puppetlabs/bin/puppet resource package zabbix-frontend-php ensure=purged
+ /opt/puppetlabs/puppet/bin/gem uninstall zabbixapi -a
+ rm -f /etc/zabbix/.*done
+ if id postgres > /dev/null 2>&1; then
+ su - postgres -c "psql -c 'drop database if exists zabbix_server;'"
+ fi
+ SHELL
+
+ cleanup_script_redhat = <<-SHELL
+ /opt/puppetlabs/bin/puppet resource service zabbix-server ensure=stopped
/opt/puppetlabs/bin/puppet resource service httpd ensure=stopped
/opt/puppetlabs/bin/puppet resource package zabbix-server-pgsql ensure=purged
/opt/puppetlabs/bin/puppet resource package zabbix-server-pgsql-scl ensure=purged
- /opt/puppetlabs/bin/puppet resource package zabbix-server-mysql ensure=purged
- /opt/puppetlabs/bin/puppet resource package zabbix-server-mysql-scl ensure=purged
/opt/puppetlabs/bin/puppet resource package zabbix-web ensure=purged
/opt/puppetlabs/bin/puppet resource package zabbix-web-pgsql ensure=purged
- /opt/puppetlabs/bin/puppet resource package zabbix-web-mysql ensure=purged
/opt/puppetlabs/bin/puppet resource package zabbix-web-pgsql-scl ensure=purged
- /opt/puppetlabs/bin/puppet resource package zabbix-web-mysql-scl ensure=purged
/opt/puppetlabs/bin/puppet resource package zabbix-frontend-php ensure=purged
/opt/puppetlabs/puppet/bin/gem uninstall zabbixapi -a
rm -f /etc/zabbix/.*done
@@ -38,7 +46,10 @@ def prepare_host
su - postgres -c "psql -c 'drop database if exists zabbix_server;'"
fi
SHELL
- shell(cleanup_script)
+
+ shell(cleanup_script_debian) if fact('os.family') == 'Debian'
+ shell(cleanup_script_redhat) if fact('os.family') == 'RedHat'
+
install_deps = <<-SHELL
$compile_packages = $facts['os']['family'] ? {
'RedHat' => [ 'make', 'gcc-c++', 'rubygems', 'ruby'],

original_message:
Optimize acceptance tests

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add Vault parameters to server

diff:
@@ -145,6 +145,9 @@ class zabbix (
$startjavapollers = $zabbix::params::server_startjavapollers,
Integer[1, 100] $startlldprocessors = $zabbix::params::server_startlldprocessors,
$startvmwarecollectors = $zabbix::params::server_startvmwarecollectors,
+ Optional[String[1]] $vaultdbpath = $zabbix::params::server_vaultdbpath,
+ Optional[String[1]] $vaulttoken = $zabbix::params::server_vaulttoken,
+ Stdlib::HTTPSUrl $vaulturl = $zabbix::params::server_vaulturl,
$vmwarefrequency = $zabbix::params::server_vmwarefrequency,
$vmwarecachesize = $zabbix::params::server_vmwarecachesize,
$vmwaretimeout = $zabbix::params::server_vmwaretimeout,
@@ -289,6 +292,9 @@ class zabbix (
startjavapollers => $startjavapollers,
startlldprocessors => $startlldprocessors,
startvmwarecollectors => $startvmwarecollectors,
+ vaultdbpath => $vaultdbpath,
+ vaulttoken => $vaulttoken,
+ vaulturl => $vaulturl,
vmwarefrequency => $vmwarefrequency,
vmwarecachesize => $vmwarecachesize,
vmwaretimeout => $vmwaretimeout,

diff:
@@ -296,6 +296,9 @@ class zabbix::params {
$server_unreachabledelay = '15'
$server_unreachableperiod = '45'
$server_valuecachesize = '8M'
+ $server_vaultdbpath = undef
+ $server_vaulttoken = undef
+ $server_vaulturl = 'https://127.0.0.1:8200'
$server_vmwarecachesize = '8M'
$server_vmwarefrequency = '60'
$server_vmwaretimeout = undef

diff:
# [*vmwarefrequency*]
# How often zabbix will connect to vmware service to obtain a new datan.
#
+# [*vaultdbpath*]
+# Vault path from where credentials for database will be retrieved by keys 'password' and 'username'.
+#
+# [*vaulttoken*]
+# Vault authentication token that should have been generated exclusively for Zabbix proxy with read-only
+# permission to the path specified in the optional VaultDBPath configuration parameter.
+#
+# [*vaulturl*]
+# Vault server HTTP[S] URL. System-wide CA certificates directory will be used if SSLCALocation is not specified.
+#
# [*vmwarecachesize*]
# Size of vmware cache, in bytes.
#
@@ -393,6 +403,9 @@ class zabbix::server (
$startjavapollers = $zabbix::params::server_startjavapollers,
Integer[1, 100] $startlldprocessors = $zabbix::params::server_startlldprocessors,
$startvmwarecollectors = $zabbix::params::server_startvmwarecollectors,
+ Optional[String[1]] $vaultdbpath = $zabbix::params::server_vaultdbpath,
+ Optional[String[1]] $vaulttoken = $zabbix::params::server_vaulttoken,
+ Stdlib::HTTPSUrl $vaulturl = $zabbix::params::server_vaulturl,
$vmwarefrequency = $zabbix::params::server_vmwarefrequency,
$vmwarecachesize = $zabbix::params::server_vmwarecachesize,
$vmwaretimeout = $zabbix::params::server_vmwaretimeout,

diff:
@@ -385,6 +385,24 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').without_content %r{^LogFileSize=} }
end
end
+
+ # Zabbix Server 5.2 is not supported on RedHat family
+ if facts[:osfamily] != 'RedHat'
+ describe 'with zabbix_version 5.2 and Vault parameters defined' do
+ let :params do
+ {
+ zabbix_version: '5.2',
+ vaultdbpath: 'secret/zabbix/database',
+ vaulttoken: 'FKTYPEGL156DK',
+ vaulturl: 'https://127.0.0.1:8200',
+ }
+ end
+
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VaultDBPath=secret/zabbix/database$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VaultToken=FKTYPEGL156DK$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VaultURL=https://127.0.0.1:8200$} }
+ end
+ end
end
end
end

diff:
@@ -618,5 +618,35 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
# TLSCipherAll13=
<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
+<% end %>
+
+<% if @zabbix_version.to_f >= 5.2 %>
+### Option: VaultToken
+# Vault authentication token that should have been generated exclusively for Zabbix server with read only permission
+# to paths specified in Vault macros and read only permission to path specified in optional VaultDBPath
+# configuration parameter.
+# It is an error if VaultToken and VAULT_TOKEN environment variable are defined at the same time.
+#
+# Mandatory: no
+# Default:
+# VaultToken=
+<% if @vaulttoken %>VaultToken=<%= @vaulttoken -%><% end %>
+
+### Option: VaultURL
+# Vault server HTTP[S] URL. System-wide CA certificates directory will be used if SSLCALocation is not specified.
+#
+# Mandatory: no
+# Default:
+# VaultURL=https://127.0.0.1:8200
+<% if @vaulturl %>VaultURL=<%= @vaulturl -%><% end %>
+### Option: VaultDBPath
+# Vault path from where credentials for database will be retrieved by keys 'password' and 'username'.
+# Example: secret/zabbix/database
+# This option can only be used if DBUser and DBPassword are not specified.
+#
+# Mandatory: no
+# Default:
+# VaultDBPath=
+<% if @vaultdbpath %>VaultDBPath=<%= @vaultdbpath -%><% end %>
<% end %>

original_message:
Add Vault parameters to server

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


message: Add Vault parameters to proxy

diff:
@@ -469,6 +469,9 @@ class zabbix::params {
$proxy_unreachabedelay = '15'
$proxy_unreachableperiod = '45'
$proxy_use_ip = true
+ $proxy_vaultdbpath = undef
+ $proxy_vaulttoken = undef
+ $proxy_vaulturl = 'https://127.0.0.1:8200'
$proxy_vmwarecachesize = '8M'
$proxy_vmwarefrequency = '60'
$proxy_vmwareperffrequency = undef

diff:
# [*vmwarecachesize*]
# Size of vmware cache, in bytes.
#
+# [*vaultdbpath*]
+# Vault path from where credentials for database will be retrieved by keys 'password' and 'username'.
+#
+# [*vaulttoken*]
+# Vault authentication token that should have been generated exclusively for Zabbix proxy with read-only
+# permission to the path specified in the optional VaultDBPath configuration parameter.
+#
+# [*vaulturl*]
+# Vault server HTTP[S] URL. System-wide CA certificates directory will be used if SSLCALocation is not specified.
+#
# [*snmptrapperfile*]
# Temporary file used for passing data from snmp trap daemon to the server.
#
@@ -413,6 +423,9 @@ class zabbix::proxy (
$javagatewayport = $zabbix::params::proxy_javagatewayport,
$startjavapollers = $zabbix::params::proxy_startjavapollers,
$startvmwarecollectors = $zabbix::params::proxy_startvmwarecollectors,
+ Optional[String[1]] $vaultdbpath = $zabbix::params::proxy_vaultdbpath,
+ Optional[String[1]] $vaulttoken = $zabbix::params::proxy_vaulttoken,
+ Stdlib::HTTPSUrl $vaulturl = $zabbix::params::proxy_vaulturl,
$vmwarefrequency = $zabbix::params::proxy_vmwarefrequency,
$vmwareperffrequency = $zabbix::params::proxy_vmwareperffrequency,
$vmwarecachesize = $zabbix::params::proxy_vmwarecachesize,

diff:
@@ -422,6 +422,21 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').without_content %r{^LogFileSize=} }
end
end
+
+ describe 'with zabbix_version 5.2 and Vault parameters defined' do
+ let :params do
+ {
+ zabbix_version: '5.2',
+ vaultdbpath: 'secret/zabbix/database',
+ vaulttoken: 'FKTYPEGL156DK',
+ vaulturl: 'https://127.0.0.1:8200',
+ }
+ end
+
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^VaultDBPath=secret/zabbix/database$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^VaultToken=FKTYPEGL156DK$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^VaultURL=https://127.0.0.1:8200$} }
+ end
end
end
end

diff:
@@ -644,6 +644,35 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
# TLSCipherAll13=
<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
-
<% end %>
+<% if @zabbix_version.to_f >= 5.2 %>
+### Option: VaultToken
+# Vault authentication token that should have been generated exclusively for Zabbix server with read only permission
+# to paths specified in Vault macros and read only permission to path specified in optional VaultDBPath
+# configuration parameter.
+# It is an error if VaultToken and VAULT_TOKEN environment variable are defined at the same time.
+#
+# Mandatory: no
+# Default:
+# VaultToken=
+<% if @vaulttoken %>VaultToken=<%= @vaulttoken -%><% end %>
+
+### Option: VaultURL
+# Vault server HTTP[S] URL. System-wide CA certificates directory will be used if SSLCALocation is not specified.
+#
+# Mandatory: no
+# Default:
+# VaultURL=https://127.0.0.1:8200
+<% if @vaulturl %>VaultURL=<%= @vaulturl -%><% end %>
+
+### Option: VaultDBPath
+# Vault path from where credentials for database will be retrieved by keys 'password' and 'username'.
+# Example: secret/zabbix/database
+# This option can only be used if DBUser and DBPassword are not specified.
+#
+# Mandatory: no
+# Default:
+# VaultDBPath=
+<% if @vaultdbpath %>VaultDBPath=<%= @vaultdbpath -%><% end %>
+<% end %>

original_message:
Add Vault parameters to proxy

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


diff:
@@ -6,7 +6,8 @@ Puppet::Type.type(:zabbix_template).provide(:ruby, parent: Puppet::Provider::Zab
zbx.configurations.import(
format: 'xml',
rules: {
- applications: {
+ # application parameter was removed on Zabbix 5.4
+ (@resource[:zabbix_version] =~ %r{[45]\.[02]} ? :applications : nil) => {
createMissing: true
},
discoveryRules: {
@@ -32,7 +33,8 @@ Puppet::Type.type(:zabbix_template).provide(:ruby, parent: Puppet::Provider::Zab
createMissing: true,
updateExisting: true
},
- screens: {
+ # screens parameter was removed on Zabbix 5.4
+ (@resource[:zabbix_version] =~ %r{[45]\.[02]} ? :screens : nil) => {
createMissing: true,
updateExisting: true
},
@@ -43,7 +45,8 @@ Puppet::Type.type(:zabbix_template).provide(:ruby, parent: Puppet::Provider::Zab
createMissing: true,
updateExisting: true
},
- (@resource[:zabbix_version] =~ %r{5\.[^0]} ? :templateDashboards : :templateScreens) => {
+ # templateDashboards was renamed to templateScreen on Zabbix >= 5.2
+ (@resource[:zabbix_version] =~ %r{5\.[24]} ? :templateDashboards : :templateScreens) => {
createMissing: true,
updateExisting: true
},
@@ -51,7 +54,7 @@ Puppet::Type.type(:zabbix_template).provide(:ruby, parent: Puppet::Provider::Zab
createMissing: true,
updateExisting: true
}
- },
+ }.delete_if { |key, _| key.nil? },
source: template_contents
)
end

diff:
@@ -4,6 +4,8 @@ describe 'zabbix_application type', unless: default[:platform] =~ %r{(ubuntu-16.
%w[4.0 5.0 5.2].each do |zabbix_version|
# 5.2 server packages are not available for RHEL 7
next if zabbix_version == '5.2' && default[:platform] == 'el-7-x86_64'
+ # Application API was removed in Zabbix 5.4
+ next if zabbix_version == '5.4'
template = case zabbix_version
when '4.0'

diff:
@@ -57,7 +57,12 @@ describe 'zabbix_template type', unless: default[:platform] =~ %r{(ubuntu-16.04|
end
let(:result_templates) do
+ # selectApplications parameter was removed in Zabbix 5.4
+ if zabbix_version =~ %r{5\.[^4]}
zabbixapi('localhost', 'Admin', 'zabbix', 'template.get', selectApplications: ['name'], output: ['host']).result
+ else
+ zabbixapi('localhost', 'Admin', 'zabbix', 'template.get', output: ['host']).result
+ end
end
context 'TestTemplate1' do

original_message:
Drop zabbix_application support for zabbix 5.4

* Zabbix applications were replaced with Item tags in version 5.4
* applications and screens parameters were removed from configurations.import
* selectApplications parameter was removed from templates.get in version 5.4

Source: https://www.zabbix.com/documentation/5.4/manual/api/changes_5.2_-_5.4

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>


diff:
@@ -232,16 +232,14 @@ class zabbix::params {
$server_listenport = '10051'
$server_loadmodule = undef
$server_loadmodulepath = '/usr/lib/modules'
- # provided by camptocamp/systemd
+ # provided by puppet/systemd
if $facts['systemd'] {
$server_logtype = 'system'
- $server_logfile = undef
- $server_logfilesize = undef
} else {
$server_logtype = 'file'
+ }
$server_logfile = '/var/log/zabbix/zabbix_server.log'
$server_logfilesize = '10'
- }
$server_logslowqueries = '0'
$server_maxhousekeeperdelete = '500'
$server_pidfile = '/var/run/zabbix/zabbix_server.pid'
@@ -355,11 +353,11 @@ class zabbix::params {
$agent_zbx_templates = ['Template OS Linux', 'Template App SSH Service']
$apache_status = false
$monitored_by_proxy = undef
- # provided by camptocamp/systemd
+ # provided by puppet/systemd
if $facts['systemd'] {
$agent_logtype = 'system'
- $agent_logfile = undef
- $agent_logfilesize = undef
+ $agent_logfile = '/var/log/zabbix/zabbix_agentd.log'
+ $agent_logfilesize = '100'
}
elsif $facts['kernel'] == 'windows' {
$agent_logtype = 'file'
@@ -402,16 +400,14 @@ class zabbix::params {
$proxy_loadmodule = undef
$proxy_loadmodulepath = '/usr/lib/modules'
$proxy_localbuffer = '0'
- # provided by camptocamp/systemd
+ # provided by puppet/systemd
if $facts['systemd'] {
$proxy_logtype = 'system'
- $proxy_logfile = undef
- $proxy_logfilesize = undef
} else {
$proxy_logtype = 'file'
+ }
$proxy_logfile = '/var/log/zabbix/zabbix_proxy.log'
$proxy_logfilesize = '10'
- }
$proxy_logremotecommands = 0
$proxy_logslowqueries = '0'
$proxy_mode = '0'

diff:
@@ -28,6 +28,13 @@ describe 'zabbix::agent' do
else
'/etc/zabbix/zabbix_agentd.conf'
end
+
+ log_path = case facts[:operatingsystem]
+ when 'windows'
+ 'C:/ProgramData/zabbix/zabbix_agentd.log'
+ else
+ '/var/log/zabbix/zabbix_agentd.log'
+ end
include_dir = case facts[:operatingsystem]
when 'windows'
'C:/ProgramData/zabbix/zabbix_agentd.d'
@@ -365,8 +372,8 @@ describe 'zabbix::agent' do
end
end
- context 'with zabbix_agentd.conf and logtype is declared' do
- context 'declare logtype as system' do
+ context 'with zabbix_agentd.conf and logtype declared' do
+ describe 'as system' do
let :params do
{
logtype: 'system'
@@ -378,7 +385,7 @@ describe 'zabbix::agent' do
it { is_expected.to contain_file(config_path).without_content %r{^LogFileSize=} }
end
- context 'declare logtype as console' do
+ describe 'as console' do
let :params do
{
logtype: 'console'
@@ -389,6 +396,18 @@ describe 'zabbix::agent' do
it { is_expected.to contain_file(config_path).without_content %r{^LogFile=} }
it { is_expected.to contain_file(config_path).without_content %r{^LogFileSize=} }
end
+
+ describe 'as file' do
+ let :params do
+ {
+ logtype: 'file'
+ }
+ end
+
+ it { is_expected.to contain_file(config_path).with_content %r{^LogType=file$} }
+ it { is_expected.to contain_file(config_path).with_content %r{^LogFile=#{log_path}$} }
+ it { is_expected.to contain_file(config_path).with_content %r{^LogFileSize=100$} }
+ end
end
end
end

diff:
@@ -397,8 +397,8 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^SocketDir=/var/run/zabbix} }
end
- context 'with zabbix_proxy.conf and logtype' do
- context 'declared as system' do
+ context 'with zabbix_proxy.conf and logtype declared' do
+ describe 'as system' do
let :params do
{
logtype: 'system'
@@ -410,7 +410,7 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').without_content %r{^LogFileSize=} }
end
- context 'declared as console' do
+ describe 'as console' do
let :params do
{
logtype: 'console'
@@ -421,6 +421,18 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').without_content %r{^LogFile=} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').without_content %r{^LogFileSize=} }
end
+
+ describe 'as file' do
+ let :params do
+ {
+ logtype: 'file'
+ }
+ end
+
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^LogType=file$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^LogFile=/var/log/zabbix/zabbix_proxy.log$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^LogFileSize=10$} }
+ end
end
end
end

diff:
@@ -360,8 +360,8 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^SocketDir=/var/run/zabbix} }
end
- context 'with zabbix_server.conf and logtype' do
- context 'declared as system' do
+ context 'with zabbix_server.conf and logtype declared' do
+ describe 'as system' do
let :params do
{
logtype: 'system'
@@ -373,7 +373,7 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').without_content %r{^LogFileSize=} }
end
- context 'declared as console' do
+ describe 'as console' do
let :params do
{
logtype: 'console'
@@ -384,6 +384,18 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').without_content %r{^LogFile=} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').without_content %r{^LogFileSize=} }
end
+
+ describe 'as file' do
+ let :params do
+ {
+ logtype: 'file'
+ }
+ end
+
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^LogType=file$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^LogFile=/var/log/zabbix/zabbix_server.log$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^LogFileSize=10$} }
+ end
end
end
end

original_message:
Ensure correct logfile/logfilesize values when defaulting logtype to system

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>