Puppet Class: zabbix::web

Inherits:

zabbix::params

Defined in:

manifests/web.pp

Summary

This will install the zabbix-web package and install an virtual host.

Overview

Examples:

For multiple host setup:

node 'wdpuppet02.dj-wasabi.local' {
  class { 'apache':
      mpm_module => 'prefork',
  }
  class { 'zabbix::web':
    zabbix_url    => 'zabbix.dj-wasabi.nl',
    zabbix_server => 'wdpuppet03.dj-wasabi.local',
    database_host => 'wdpuppet04.dj-wasabi.local',
    database_type => 'mysql',
    puppetgem     => 'gem',
  }
}

Parameters:

• zabbix_url (Any) (defaults to: $zabbix::params::zabbix_url) —

  Url on which zabbix needs to be available. Will create an vhost in apache. Only needed when manage_vhost is set to true. Example: zabbix.example.com

• database_type (Any) (defaults to: $zabbix::params::database_type) —

  Type of database. Can use the following 2 databases:

  • postgresql

  • mysql

• manage_repo (Any) (defaults to: $zabbix::params::manage_repo) —

  When true, it will create repository for installing the webinterface.

• zabbix_version (Any) (defaults to: $zabbix::params::zabbix_version) —

  This is the zabbix version.

• zabbix_timezone (Any) (defaults to: $zabbix::params::zabbix_timezone) —

  The current timezone for vhost configuration needed for the php timezone. Example: Europe/Amsterdam

• zabbix_template_dir (Any) (defaults to: $zabbix::params::zabbix_template_dir) —

  The directory where all templates are stored before uploading via API

• zabbix_package_state (Any) (defaults to: $zabbix::params::zabbix_package_state) —

  The state of the package that needs to be installed: present or latest.

• web_config_owner (Any) (defaults to: $zabbix::params::web_config_owner) —

  Which user should own the web interface configuration file.

• web_config_group (Any) (defaults to: $zabbix::params::web_config_group) —

  Which group should own the web interface configuration file.

• manage_vhost (Any) (defaults to: $zabbix::params::manage_vhost) —

  When true, it will create an vhost for apache. The parameter zabbix_url has to be set.

• default_vhost (Any) (defaults to: $zabbix::params::default_vhost) —

  When true priority of 15 is passed to zabbix vhost which would end up with marking zabbix vhost as default one, when false priority is set to 25

• manage_resources (Any) (defaults to: $zabbix::params::manage_resources) —

  When true, it will export resources to something like puppetdb. When set to true, you’ll need to configure ‘storeconfigs’ to make this happen. Default is set to false, as not everyone has this enabled.

• apache_use_ssl (Any) (defaults to: $zabbix::params::apache_use_ssl) —

  Will create an ssl vhost. Also nonssl vhost will be created for redirect nonssl to ssl vhost.

• apache_ssl_cert (Any) (defaults to: $zabbix::params::apache_ssl_cert) —

  The location of the ssl certificate file. You’ll need to make sure this file is present on the system, this module will not install this file.

• apache_ssl_key (Any) (defaults to: $zabbix::params::apache_ssl_key) —

  The location of the ssl key file. You’ll need to make sure this file is present on the system, this module will not install this file.

• apache_ssl_cipher (Any) (defaults to: $zabbix::params::apache_ssl_cipher) —

  The ssl cipher used. Cipher is used from this website: wiki.mozilla.org/Security/Server_Side_TLS

• apache_ssl_chain (Any) (defaults to: $zabbix::params::apache_ssl_chain) —

  The ssl chain file.

• apache_listen_ip (Any) (defaults to: $zabbix::params::apache_listen_ip) —

  The IP the apache service should listen on.

• apache_listenport (Variant[Array[Stdlib::Port], Stdlib::Port]) (defaults to: $zabbix::params::apache_listenport) —

  The port for the apache vhost.

• apache_listenport_ssl (Variant[Array[Stdlib::Port], Stdlib::Port]) (defaults to: $zabbix::params::apache_listenport_ssl) —

  The port for the apache SSL vhost.

• zabbix_api_user (Any) (defaults to: $zabbix::params::server_api_user) —

  Name of the user which the api should connect to. Default: Admin

• zabbix_api_pass (Any) (defaults to: $zabbix::params::server_api_pass) —

  Password of the user which connects to the api. Default: zabbix

• zabbix_api_access (Optional[Array[Stdlib::Host,1]]) (defaults to: $zabbix::params::server_api_access) —

  Which host has access to the api. Default: no restriction

• database_host (Any) (defaults to: $zabbix::params::server_database_host) —

  Database host name.

• database_name (Any) (defaults to: $zabbix::params::server_database_name) —

  Database name.

• database_schema (Any) (defaults to: $zabbix::params::server_database_schema) —

  Schema name. used for ibm db2.

• database_double_ieee754 (Boolean) (defaults to: $zabbix::params::server_database_double_ieee754) —

  Enable extended range of float values for new installs of Zabbix >= 5.0 and after patching upgraded installs to 5.0 or greater. www.zabbix.com/documentation/5.0/manual/installation/upgrade_notes_500#enabling_extended_range_of_numeric_float_values

• database_user (Any) (defaults to: $zabbix::params::server_database_user) —

  Database user. ignored for sqlite.

• database_password (Any) (defaults to: $zabbix::params::server_database_password) —

  Database password. ignored for sqlite.

• database_socket (Any) (defaults to: $zabbix::params::server_database_socket) —

  Path to mysql socket.

• database_port (Any) (defaults to: $zabbix::params::server_database_port) —

  Database port when not using local socket. Ignored for sqlite.

• zabbix_server (Any) (defaults to: $zabbix::params::zabbix_server) —

  The fqdn name of the host running the zabbix-server. When single node: localhost

• zabbix_server_name (Optional[String]) (defaults to: $zabbix::params::zabbix_server) —

  The fqdn name of the host running the zabbix-server. When single node: localhost This can also be used to upave a different name such as “Zabbix DEV”

• zabbix_listenport (Any) (defaults to: $zabbix::params::server_listenport) —

  The port on which the zabbix-server is listening. Default: 10051

• apache_php_max_execution_time (Any) (defaults to: $zabbix::params::apache_php_max_execution_time) —

  Max execution time for php. Default: 300

• apache_php_memory_limit (Any) (defaults to: $zabbix::params::apache_php_memory_limit) —

  PHP memory size limit. Default: 128M

• apache_php_post_max_size (Any) (defaults to: $zabbix::params::apache_php_post_max_size) —

  PHP maximum post size data. Default: 16M

• apache_php_upload_max_filesize (Any) (defaults to: $zabbix::params::apache_php_upload_max_filesize) —

  PHP maximum upload filesize. Default: 2M

• apache_php_max_input_time (Any) (defaults to: $zabbix::params::apache_php_max_input_time) —

  Max input time for php. Default: 300

• apache_php_always_populate_raw_post_data (Any) (defaults to: $zabbix::params::apache_php_always_populate_raw_post_data) —

  Default: -1

• apache_php_max_input_vars (Any) (defaults to: $zabbix::params::apache_php_max_input_vars) —

  Max amount of vars for GET/POST requests

• ldap_cacert (Optional[Stdlib::Absolutepath]) (defaults to: $zabbix::params::ldap_cacert) —

  Set location of ca_cert used by LDAP authentication.

• ldap_clientcert (Optional[Stdlib::Absolutepath]) (defaults to: $zabbix::params::ldap_clientcert) —

  Set location of client cert used by LDAP authentication.

• ldap_clientkey (Optional[Stdlib::Absolutepath]) (defaults to: $zabbix::params::ldap_clientkey) —

  Set location of client key used by LDAP authentication.

• ldap_reqcert (Optional[Enum['never','allow','try','demand','hard']]) (defaults to: $zabbix::params::ldap_reqcert) —

  Specifies what checks to perform on a server certificate

• saml_sp_key (Optional[Stdlib::Absolutepath]) (defaults to: $zabbix::params::saml_sp_key) —

  The location of the SAML Service Provider Key file.

• saml_sp_cert (Optional[Stdlib::Absolutepath]) (defaults to: $zabbix::params::saml_sp_cert) —

  The location of the SAML Service Provider Certificate.

• saml_idp_cert (Optional[Stdlib::Absolutepath]) (defaults to: $zabbix::params::saml_idp_cert) —

  The location of the SAML Identity Provider Certificate.

• saml_settings (Hash[String[1], Variant[ScalarData, Hash]]) (defaults to: $zabbix::params::saml_settings) —

  A hash of additional SAML SSO settings.

• puppetgem (Any) (defaults to: $zabbix::params::puppetgem) —

  Provider for the zabbixapi gem package.

• manage_selinux (Boolean) (defaults to: $zabbix::params::manage_selinux) —

  Whether we should manage SELinux rules.

• apache_vhost_custom_params (Hash[String[1], Any]) (defaults to: {}) —

  Additional parameters to pass to apache::vhost.

Author:

• Werner Dijkerman <ikben@werner-dijkerman.nl>

# File 'manifests/web.pp', line 95

class zabbix::web (
  $zabbix_url                                                         = $zabbix::params::zabbix_url,
  $database_type                                                      = $zabbix::params::database_type,
  $manage_repo                                                        = $zabbix::params::manage_repo,
  $zabbix_version                                                     = $zabbix::params::zabbix_version,
  $zabbix_timezone                                                    = $zabbix::params::zabbix_timezone,
  $zabbix_package_state                                               = $zabbix::params::zabbix_package_state,
  $zabbix_template_dir                                                = $zabbix::params::zabbix_template_dir,
  $web_config_owner                                                   = $zabbix::params::web_config_owner,
  $web_config_group                                                   = $zabbix::params::web_config_group,
  $manage_vhost                                                       = $zabbix::params::manage_vhost,
  $default_vhost                                                      = $zabbix::params::default_vhost,
  $manage_resources                                                   = $zabbix::params::manage_resources,
  $apache_use_ssl                                                     = $zabbix::params::apache_use_ssl,
  $apache_ssl_cert                                                    = $zabbix::params::apache_ssl_cert,
  $apache_ssl_key                                                     = $zabbix::params::apache_ssl_key,
  $apache_ssl_cipher                                                  = $zabbix::params::apache_ssl_cipher,
  $apache_ssl_chain                                                   = $zabbix::params::apache_ssl_chain,
  $apache_listen_ip                                                   = $zabbix::params::apache_listen_ip,
  Variant[Array[Stdlib::Port], Stdlib::Port] $apache_listenport       = $zabbix::params::apache_listenport,
  Variant[Array[Stdlib::Port], Stdlib::Port] $apache_listenport_ssl   = $zabbix::params::apache_listenport_ssl,
  $zabbix_api_user                                                    = $zabbix::params::server_api_user,
  $zabbix_api_pass                                                    = $zabbix::params::server_api_pass,
  Optional[Array[Stdlib::Host,1]] $zabbix_api_access                  = $zabbix::params::server_api_access,
  $database_host                                                      = $zabbix::params::server_database_host,
  $database_name                                                      = $zabbix::params::server_database_name,
  $database_schema                                                    = $zabbix::params::server_database_schema,
  Boolean $database_double_ieee754                                    = $zabbix::params::server_database_double_ieee754,
  $database_user                                                      = $zabbix::params::server_database_user,
  $database_password                                                  = $zabbix::params::server_database_password,
  $database_socket                                                    = $zabbix::params::server_database_socket,
  $database_port                                                      = $zabbix::params::server_database_port,
  $zabbix_server                                                      = $zabbix::params::zabbix_server,
  Optional[String] $zabbix_server_name                                = $zabbix::params::zabbix_server,
  $zabbix_listenport                                                  = $zabbix::params::server_listenport,
  $apache_php_max_execution_time                                      = $zabbix::params::apache_php_max_execution_time,
  $apache_php_memory_limit                                            = $zabbix::params::apache_php_memory_limit,
  $apache_php_post_max_size                                           = $zabbix::params::apache_php_post_max_size,
  $apache_php_upload_max_filesize                                     = $zabbix::params::apache_php_upload_max_filesize,
  $apache_php_max_input_time                                          = $zabbix::params::apache_php_max_input_time,
  $apache_php_always_populate_raw_post_data                           = $zabbix::params::apache_php_always_populate_raw_post_data,
  $apache_php_max_input_vars                                          = $zabbix::params::apache_php_max_input_vars,
  Optional[Stdlib::Absolutepath] $ldap_cacert                         = $zabbix::params::ldap_cacert,
  Optional[Stdlib::Absolutepath] $ldap_clientcert                     = $zabbix::params::ldap_clientcert,
  Optional[Stdlib::Absolutepath] $ldap_clientkey                      = $zabbix::params::ldap_clientkey,
  Optional[Enum['never','allow','try','demand','hard']] $ldap_reqcert = $zabbix::params::ldap_reqcert,
  Optional[Stdlib::Absolutepath] $saml_sp_key                         = $zabbix::params::saml_sp_key,
  Optional[Stdlib::Absolutepath] $saml_sp_cert                        = $zabbix::params::saml_sp_cert,
  Optional[Stdlib::Absolutepath] $saml_idp_cert                       = $zabbix::params::saml_idp_cert,
  Hash[String[1], Variant[ScalarData, Hash]] $saml_settings           = $zabbix::params::saml_settings,
  $puppetgem                                                          = $zabbix::params::puppetgem,
  Boolean $manage_selinux                                             = $zabbix::params::manage_selinux,
  Hash[String[1], Any] $apache_vhost_custom_params                    = {},
) inherits zabbix::params {
  # check osfamily, Arch is currently not supported for web
  if $facts['os']['family'] in ['Archlinux', 'Gentoo',] {
    fail("${facts['os']['family']} is currently not supported for zabbix::web")
  }

  # Only include the repo class if it has not yet been included
  unless defined(Class['Zabbix::Repo']) {
    class { 'zabbix::repo':
      manage_repo    => $manage_repo,
      zabbix_version => $zabbix_version,
    }
  }

  # use the correct db.
  case $database_type {
    'postgresql': {
      $db = 'pgsql'
      $db_port = '5432'
    }
    'mysql': {
      $db = 'mysql'
      $db_port = '3306'
    }
    default: {
      fail('unrecognized database type for server.')
    }
  }

  # So if manage_resources is set to true, we can send some data
  # to the puppetdb. We will include an class, otherwise when it
  # is set to false, you'll get warnings like this:
  # "Warning: You cannot collect without storeconfigs being set"
  if $manage_resources {
    file { $zabbix_template_dir:
      ensure => directory,
      owner  => 'zabbix',
      group  => 'zabbix',
      mode   => '0755',
    }
    -> class { 'zabbix::zabbixapi':
      zabbix_version => $zabbix_version,
      puppetgem      => $puppetgem,
    }
    -> class { 'zabbix::resources::web':
      zabbix_url     => $zabbix_url,
      zabbix_user    => $zabbix_api_user,
      zabbix_pass    => $zabbix_api_pass,
      apache_use_ssl => $apache_use_ssl,
    }
  }

  case $facts['os']['family'] {
    'Debian': {
      $zabbix_web_package = 'zabbix-frontend-php'
      $php_db_package = "php-${db}"

      package { $php_db_package:
        ensure => $zabbix_package_state,
        before => [
          Package[$zabbix_web_package],
          File['/etc/zabbix/web/zabbix.conf.php'],
        ],
      }
    }
    'RedHat': {
      $zabbix_web_package = 'zabbix-web'
      if ($facts['os']['release']['major'] == '7') {
        package { "zabbix-web-${db}-scl":
          ensure  => $zabbix_package_state,
          before  => Package[$zabbix_web_package],
          require => Class['zabbix::repo'],
          tag     => 'zabbix',
        }
      } else {
        package { "zabbix-web-${db}":
          ensure  => $zabbix_package_state,
          before  => Package[$zabbix_web_package],
          require => Class['zabbix::repo'],
          tag     => 'zabbix',
        }
      }
    }
    default: {
      $zabbix_web_package = 'zabbix-web'

      package { "zabbix-web-${db}":
        ensure  => $zabbix_package_state,
        before  => Package[$zabbix_web_package],
        require => Class['zabbix::repo'],
        tag     => 'zabbix',
      }
    }
  } # END case $facts['os']['family']

  file { '/etc/zabbix/web':
    ensure  => directory,
    owner   => 'zabbix',
    group   => 'zabbix',
    mode    => '0755',
    require => Package[$zabbix_web_package],
  }

  package { $zabbix_web_package:
    ensure  => $zabbix_package_state,
    before  => File['/etc/zabbix/web/zabbix.conf.php'],
    require => Class['zabbix::repo'],
    tag     => 'zabbix',
  }

  # Webinterface config file
  file { '/etc/zabbix/web/zabbix.conf.php':
    ensure  => file,
    owner   => $web_config_owner,
    group   => $web_config_group,
    mode    => '0640',
    replace => true,
    content => template('zabbix/web/zabbix.conf.php.erb'),
  }

  # For API to work on Zabbix 5.x zabbix.conf.php needs to be in the root folder.
  file { '/etc/zabbix/zabbix.conf.php':
    ensure => link,
    target => '/etc/zabbix/web/zabbix.conf.php',
    owner  => $web_config_owner,
    group  => $web_config_group,
    mode   => '0640',
  }

  # Is set to true, it will create the apache vhost.
  if $manage_vhost {
    include apache
    include apache::mod::dir
    if $facts['os']['family'] == 'RedHat' {
      if $facts['os']['release']['major'] == '7' {
        $fpm_service = 'rh-php72-php-fpm'
        # PHP parameters are moved to /etc/opt/rh/rh-php72/php-fpm.d/zabbix.conf per package zabbix-web-deps-scl
        $fpm_scl_prefix = '/opt/rh/rh-php72'
      } else {
        $fpm_service = 'php-fpm'
        $fpm_scl_prefix = ''
      }
      include apache::mod::proxy
      include apache::mod::proxy_fcgi
      $apache_vhost_custom_fragment = ''

      service { $fpm_service:
        ensure => 'running',
        enable => true,
      }

      file { "/etc${fpm_scl_prefix}/php-fpm.d/zabbix.conf":
        ensure  => file,
        notify  => Service[$fpm_service],
        content => epp('zabbix/web/php-fpm.d.zabbix.conf.epp'),
      }

      $fcgi_filematch = {
        path     => '/usr/share/zabbix',
        provider => 'directory',
        addhandlers => [
          {
            extensions => [
              'php',
              'phar',
            ],
            handler => "proxy:unix:/var${fpm_scl_prefix}/run/php-fpm/zabbix.sock|fcgi://localhost",
          },
        ],
      }
      $proxy_directory = {
        path => 'fcgi://localhost:9000',
        provider => 'proxy',
      }
    }
    else {
      include apache::mod::php

      $apache_vhost_custom_fragment = "
        php_value max_execution_time ${apache_php_max_execution_time}
        php_value memory_limit ${apache_php_memory_limit}
        php_value post_max_size ${apache_php_post_max_size}
        php_value upload_max_filesize ${apache_php_upload_max_filesize}
        php_value max_input_time ${apache_php_max_input_time}
        php_value always_populate_raw_post_data ${apache_php_always_populate_raw_post_data}
        php_value max_input_vars ${apache_php_max_input_vars}
        # Set correct timezone
        php_value date.timezone ${zabbix_timezone}"
      $fcgi_filematch = {}
      $proxy_directory = {}
    }
    # Check if we use ssl. If so, we also create an non ssl
    # vhost for redirect traffic from non ssl to ssl site.
    if $apache_use_ssl {
      # Listen port
      $apache_listen_port = $apache_listenport_ssl

      # We create nonssl vhost for redirecting non ssl
      # traffic to https.
      apache::vhost { "${zabbix_url}_nonssl":
        docroot        => '/usr/share/zabbix',
        manage_docroot => false,
        default_vhost  => $default_vhost,
        port           => $apache_listenport,
        servername     => $zabbix_url,
        ssl            => false,
        rewrites       => [
          {
            comment      => 'redirect all to https',
            rewrite_cond => ['%{SERVER_PORT} !^443$'],
            rewrite_rule => ["^/(.*)$ https://${zabbix_url}/\$1 [L,R]"],
          }
        ],
      }
    } else {
      # So no ssl, so default port 80
      $apache_listen_port = $apache_listenport
    }

    $location_api_access = $zabbix_api_access ? {
      undef   => 'all granted',
      default => $zabbix_api_access.map |$host| { "host ${host}" },
    }

    apache::vhost { $zabbix_url:
      docroot         => '/usr/share/zabbix',
      ip              => $apache_listen_ip,
      port            => $apache_listen_port,
      default_vhost   => $default_vhost,
      add_listen      => true,
      directories     => [
        merge({
            path     => '/usr/share/zabbix',
            provider => 'directory',
            require  => 'all granted',
          }, $fcgi_filematch
        ),
        {
          path     => '/usr/share/zabbix/conf',
          provider => 'directory',
          require  => 'all denied',
        },
        {
          path     => '/usr/share/zabbix/api',
          provider => 'directory',
          require  => 'all denied',
        },
        {
          path     => '/usr/share/zabbix/include',
          provider => 'directory',
          require  => 'all denied',
        },
        {
          path     => '/usr/share/zabbix/include/classes',
          provider => 'directory',
          require  => 'all denied',
        },
        {
          path     => '/api_jsonrpc.php',
          provider => 'location',
          require  => $location_api_access,
        },
      ],
      custom_fragment => $apache_vhost_custom_fragment,
      rewrites        => [
        {
        rewrite_rule => ['^$ /index.php [L]'] }
      ],
      ssl             => $apache_use_ssl,
      ssl_cert        => $apache_ssl_cert,
      ssl_key         => $apache_ssl_key,
      ssl_cipher      => $apache_ssl_cipher,
      ssl_chain       => $apache_ssl_chain,
      require         => Package[$zabbix_web_package],
      *               => $apache_vhost_custom_params,
    }
  } # END if $manage_vhost

  # check if selinux is active and allow zabbix
  if fact('os.selinux.enabled') == true and $manage_selinux {
    # allow httpd to speak to the zabbix service
    selboolean { 'httpd_can_connect_zabbix':
      persistent => true,
      value      => 'on',
    }
    # allow httpd to speak to the database
    selboolean { 'httpd_can_network_connect_db':
      persistent => true,
      value      => 'on',
    }
  }
}