Merge branch 'master' into 4.2

.MYSQL_PASSWORD

@@ -0,0 +1 @@
+zabbix

.MYSQL_ROOT_PASSWORD

@@ -0,0 +1 @@
+root_pwd

.MYSQL_USER

@@ -0,0 +1 @@
+zabbix

.POSTGRES_PASSWORD

@@ -0,0 +1 @@
+zabbix

.POSTGRES_USER

@@ -0,0 +1 @@
+zabbix

.env_db_mysql

@@ -1,11 +1,14 @@
 # DB_SERVER_HOST=mysql-server
 # DB_SERVER_PORT=3306
 # MYSQL_USER=zabbix
-MYSQL_USER=zabbix
+# MYSQL_USER=zabbix
+MYSQL_USER_FILE=/run/secrets/MYSQL_USER
+# MYSQL_PASSWORD=zabbix
 # MYSQL_PASSWORD=zabbix
-MYSQL_PASSWORD=zabbix
+MYSQL_PASSWORD_FILE=/run/secrets/MYSQL_PASSWORD
 # MYSQL_ROOT_PASSWORD=
-MYSQL_ROOT_PASSWORD=root_pwd
+# MYSQL_ROOT_PASSWORD=root_pwd
+MYSQL_ROOT_PASSWORD_FILE=/run/secrets/MYSQL_ROOT_PASSWORD
 # MYSQL_ALLOW_EMPTY_PASSWORD=false
 # MYSQL_DATABASE=zabbix
 MYSQL_DATABASE=zabbix

.env_db_mysql_proxy

@@ -2,10 +2,13 @@
 # DB_SERVER_PORT=3306
 # MYSQL_USER=zabbix
 MYSQL_USER=zabbix
+# MYSQL_USER_FILE=/run/secrets/MYSQL_USER
 # MYSQL_PASSWORD=zabbix
 MYSQL_PASSWORD=zabbix
+# MYSQL_PASSWORD_FILE=/run/secrets/MYSQL_PASSWORD
 # MYSQL_ROOT_PASSWORD=
 MYSQL_ROOT_PASSWORD=root_pwd
+# MYSQL_ROOT_PASSWORD_FILE=/run/secrets/MYSQL_ROOT_PASSWORD
 # MYSQL_ALLOW_EMPTY_PASSWORD=false
 # MYSQL_DATABASE=zabbix_proxy
 MYSQL_DATABASE=zabbix_proxy

.env_db_pgsql

@@ -2,8 +2,10 @@
 # DB_SERVER_PORT=5432
 # POSTGRES_USER=zabbix
 POSTGRES_USER=zabbix
+# POSTGRES_USER_FILE=/run/secrets/POSTGRES_USER
 # POSTGRES_PASSWORD=zabbix
 POSTGRES_PASSWORD=zabbix
+# POSTGRES_PASSWORD_FILE=/run/secrets/POSTGRES_PASSWORD
 # POSTGRES_DB=zabbix
 POSTGRES_DB=zabbix
 # DB_SERVER_SCHEMA=public

agent/alpine/docker-entrypoint.sh

@@ -41,6 +41,37 @@ ZABBIX_ETC_DIR="/etc/zabbix"
 # Web interface www-root directory
 ZBX_FRONTEND_PATH="/usr/share/zabbix"
 
+# usage: file_env VAR [DEFAULT]
+# as example: file_env 'MYSQL_PASSWORD' 'zabbix'
+#    (will allow for "$MYSQL_PASSWORD_FILE" to fill in the value of "$MYSQL_PASSWORD" from a file)
+# unsets the VAR_FILE afterwards and just leaving VAR
+file_env() {
+    local var="$1"
+    local fileVar="${var}_FILE"
+    local defaultValue="${2:-}"
+
+    if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+        echo "**** Both variables $var and $fileVar are set (but are exclusive)"
+        exit 1
+    fi
+
+    local val="$defaultValue"
+
+    if [ "${!var:-}" ]; then
+        val="${!var}"
+        echo "** Using ${var} variable from ENV"
+    elif [ "${!fileVar:-}" ]; then
+        if [ ! -f "${!fileVar}" ]; then
+            echo "**** Secret file \"${!fileVar}\" is not found"
+            exit 1
+        fi
+        val="$(< "${!fileVar}")"
+        echo "** Using ${var} variable from secret file"
+    fi
+    export "$var"="$val"
+    unset "$fileVar"
+}
+
 configure_db_mysql() {
     [ "${DB_SERVER_HOST}" != "localhost" ] && return
 
@@ -141,7 +172,7 @@ escape_spec_char() {
     var_value="${var_value//\[/\\[}"
     var_value="${var_value//\]/\\]}"
 
-    echo $var_value
+    echo "$var_value"
 }
 
 update_config_var() {
@@ -216,6 +247,12 @@ check_variables_mysql() {
     DB_SERVER_PORT=${DB_SERVER_PORT:-"3306"}
     USE_DB_ROOT_USER=false
     CREATE_ZBX_DB_USER=false
+    file_env MYSQL_USER
+    file_env MYSQL_PASSWORD
+
+    if [ "$type" != "" ]; then
+        file_env MYSQL_ROOT_PASSWORD
+    fi
 
     if [ ! -n "${MYSQL_USER}" ] && [ "${MYSQL_RANDOM_ROOT_PASSWORD}" == "true" ]; then
         echo "**** Impossible to use MySQL server because of unknown Zabbix user and random 'root' password"
@@ -252,6 +289,9 @@ check_variables_mysql() {
 check_variables_postgresql() {
     local type=$1
 
+    file_env POSTGRES_USER
+    file_env POSTGRES_PASSWORD
+
     DB_SERVER_HOST=${DB_SERVER_HOST:-"postgres-server"}
     DB_SERVER_PORT=${DB_SERVER_PORT:-"5432"}
     CREATE_ZBX_DB_USER=${CREATE_ZBX_DB_USER:-"false"}

agent/centos/docker-entrypoint.sh

@@ -41,6 +41,37 @@ ZABBIX_ETC_DIR="/etc/zabbix"
 # Web interface www-root directory
 ZBX_FRONTEND_PATH="/usr/share/zabbix"
 
+# usage: file_env VAR [DEFAULT]
+# as example: file_env 'MYSQL_PASSWORD' 'zabbix'
+#    (will allow for "$MYSQL_PASSWORD_FILE" to fill in the value of "$MYSQL_PASSWORD" from a file)
+# unsets the VAR_FILE afterwards and just leaving VAR
+file_env() {
+    local var="$1"
+    local fileVar="${var}_FILE"
+    local defaultValue="${2:-}"
+
+    if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+        echo "**** Both variables $var and $fileVar are set (but are exclusive)"
+        exit 1
+    fi
+
+    local val="$defaultValue"
+
+    if [ "${!var:-}" ]; then
+        val="${!var}"
+        echo "** Using ${var} variable from ENV"
+    elif [ "${!fileVar:-}" ]; then
+        if [ ! -f "${!fileVar}" ]; then
+            echo "**** Secret file \"${!fileVar}\" is not found"
+            exit 1
+        fi
+        val="$(< "${!fileVar}")"
+        echo "** Using ${var} variable from secret file"
+    fi
+    export "$var"="$val"
+    unset "$fileVar"
+}
+
 configure_db_mysql() {
     [ "${DB_SERVER_HOST}" != "localhost" ] && return
 
@@ -141,7 +172,7 @@ escape_spec_char() {
     var_value="${var_value//\[/\\[}"
     var_value="${var_value//\]/\\]}"
 
-    echo $var_value
+    echo "$var_value"
 }
 
 update_config_var() {
@@ -216,6 +247,12 @@ check_variables_mysql() {
     DB_SERVER_PORT=${DB_SERVER_PORT:-"3306"}
     USE_DB_ROOT_USER=false
     CREATE_ZBX_DB_USER=false
+    file_env MYSQL_USER
+    file_env MYSQL_PASSWORD
+
+    if [ "$type" != "" ]; then
+        file_env MYSQL_ROOT_PASSWORD
+    fi
 
     if [ ! -n "${MYSQL_USER}" ] && [ "${MYSQL_RANDOM_ROOT_PASSWORD}" == "true" ]; then
         echo "**** Impossible to use MySQL server because of unknown Zabbix user and random 'root' password"
@@ -252,6 +289,9 @@ check_variables_mysql() {
 check_variables_postgresql() {
     local type=$1
 
+    file_env POSTGRES_USER
+    file_env POSTGRES_PASSWORD
+
     DB_SERVER_HOST=${DB_SERVER_HOST:-"postgres-server"}
     DB_SERVER_PORT=${DB_SERVER_PORT:-"5432"}
     CREATE_ZBX_DB_USER=${CREATE_ZBX_DB_USER:-"false"}

agent/ubuntu/docker-entrypoint.sh

@@ -41,6 +41,37 @@ ZABBIX_ETC_DIR="/etc/zabbix"
 # Web interface www-root directory
 ZBX_FRONTEND_PATH="/usr/share/zabbix"
 
+# usage: file_env VAR [DEFAULT]
+# as example: file_env 'MYSQL_PASSWORD' 'zabbix'
+#    (will allow for "$MYSQL_PASSWORD_FILE" to fill in the value of "$MYSQL_PASSWORD" from a file)
+# unsets the VAR_FILE afterwards and just leaving VAR
+file_env() {
+    local var="$1"
+    local fileVar="${var}_FILE"
+    local defaultValue="${2:-}"
+
+    if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+        echo "**** Both variables $var and $fileVar are set (but are exclusive)"
+        exit 1
+    fi
+
+    local val="$defaultValue"
+
+    if [ "${!var:-}" ]; then
+        val="${!var}"
+        echo "** Using ${var} variable from ENV"
+    elif [ "${!fileVar:-}" ]; then
+        if [ ! -f "${!fileVar}" ]; then
+            echo "**** Secret file \"${!fileVar}\" is not found"
+            exit 1
+        fi
+        val="$(< "${!fileVar}")"
+        echo "** Using ${var} variable from secret file"
+    fi
+    export "$var"="$val"
+    unset "$fileVar"
+}
+
 configure_db_mysql() {
     [ "${DB_SERVER_HOST}" != "localhost" ] && return
 
@@ -141,7 +172,7 @@ escape_spec_char() {
     var_value="${var_value//\[/\\[}"
     var_value="${var_value//\]/\\]}"
 
-    echo $var_value
+    echo "$var_value"
 }
 
 update_config_var() {
@@ -216,6 +247,12 @@ check_variables_mysql() {
     DB_SERVER_PORT=${DB_SERVER_PORT:-"3306"}
     USE_DB_ROOT_USER=false
     CREATE_ZBX_DB_USER=false
+    file_env MYSQL_USER
+    file_env MYSQL_PASSWORD
+
+    if [ "$type" != "" ]; then
+        file_env MYSQL_ROOT_PASSWORD
+    fi
 
     if [ ! -n "${MYSQL_USER}" ] && [ "${MYSQL_RANDOM_ROOT_PASSWORD}" == "true" ]; then
         echo "**** Impossible to use MySQL server because of unknown Zabbix user and random 'root' password"
@@ -252,6 +289,9 @@ check_variables_mysql() {
 check_variables_postgresql() {
     local type=$1
 
+    file_env POSTGRES_USER
+    file_env POSTGRES_PASSWORD
+
     DB_SERVER_HOST=${DB_SERVER_HOST:-"postgres-server"}
     DB_SERVER_PORT=${DB_SERVER_PORT:-"5432"}
     CREATE_ZBX_DB_USER=${CREATE_ZBX_DB_USER:-"false"}

docker-compose_v3_alpine_mysql_latest.yaml

@@ -33,6 +33,10 @@ services:
   env_file:
    - .env_db_mysql
    - .env_srv
+  secrets:
+   - MYSQL_USER
+   - MYSQL_PASSWORD
+   - MYSQL_ROOT_PASSWORD
   user: root
   depends_on:
    - mysql-server
@@ -56,7 +60,7 @@ services:
    - net.ipv4.conf.all.send_redirects=0
   labels:
    com.zabbix.description: "Zabbix server with MySQL database support"
-   com.zabbix.company: "Zabbix SIA"
+   com.zabbix.company: "Zabbix LLC"
    com.zabbix.component: "zabbix-server"
    com.zabbix.dbtype: "mysql"
    com.zabbix.os: "alpine"
@@ -107,7 +111,7 @@ services:
   stop_grace_period: 30s
   labels:
    com.zabbix.description: "Zabbix proxy with SQLite3 database support"
-   com.zabbix.company: "Zabbix SIA"
+   com.zabbix.company: "Zabbix LLC"
    com.zabbix.component: "zabbix-proxy"
    com.zabbix.dbtype: "sqlite3"
    com.zabbix.os: "alpine"
@@ -160,7 +164,7 @@ services:
   stop_grace_period: 30s
   labels:
    com.zabbix.description: "Zabbix proxy with MySQL database support"
-   com.zabbix.company: "Zabbix SIA"
+   com.zabbix.company: "Zabbix LLC"
    com.zabbix.component: "zabbix-proxy"
    com.zabbix.dbtype: "mysql"
    com.zabbix.os: "alpine"
@@ -188,6 +192,9 @@ services:
   env_file:
    - .env_db_mysql
    - .env_web
+  secrets:
+   - MYSQL_USER
+   - MYSQL_PASSWORD
   user: root
   depends_on:
    - mysql-server
@@ -210,7 +217,7 @@ services:
    - net.core.somaxconn=65535
   labels:
    com.zabbix.description: "Zabbix frontend on Apache web-server with MySQL database support"
-   com.zabbix.company: "Zabbix SIA"
+   com.zabbix.company: "Zabbix LLC"
    com.zabbix.component: "zabbix-frontend"
    com.zabbix.webserver: "apache2"
    com.zabbix.dbtype: "mysql"
@@ -239,6 +246,9 @@ services:
   env_file:
    - .env_db_mysql
    - .env_web
+  secrets:
+   - MYSQL_USER
+   - MYSQL_PASSWORD
   user: root
   depends_on:
    - mysql-server
@@ -261,7 +271,7 @@ services:
    - net.core.somaxconn=65535
   labels:
    com.zabbix.description: "Zabbix frontend on Nginx web-server with MySQL database support"
-   com.zabbix.company: "Zabbix SIA"
+   com.zabbix.company: "Zabbix LLC"
    com.zabbix.component: "zabbix-frontend"
    com.zabbix.webserver: "nginx"
    com.zabbix.dbtype: "mysql"
@@ -303,7 +313,7 @@ services:
   stop_grace_period: 5s
   labels:
    com.zabbix.description: "Zabbix agent"
-   com.zabbix.company: "Zabbix SIA"
+   com.zabbix.company: "Zabbix LLC"
    com.zabbix.component: "zabbix-agentd"
    com.zabbix.os: "alpine"
 
@@ -330,7 +340,7 @@ services:
   stop_grace_period: 5s
   labels:
    com.zabbix.description: "Zabbix Java Gateway"
-   com.zabbix.company: "Zabbix SIA"
+   com.zabbix.company: "Zabbix LLC"
    com.zabbix.component: "java-gateway"
    com.zabbix.os: "alpine"
 
@@ -357,7 +367,7 @@ services:
   stop_grace_period: 5s
   labels:
    com.zabbix.description: "Zabbix snmptraps"
-   com.zabbix.company: "Zabbix SIA"
+   com.zabbix.company: "Zabbix LLC"
    com.zabbix.component: "snmptraps"
    com.zabbix.os: "ubuntu"
 
@@ -368,6 +378,10 @@ services:
    - ./zbx_env/var/lib/mysql:/var/lib/mysql:rw
   env_file:
    - .env_db_mysql
+  secrets:
+   - MYSQL_USER
+   - MYSQL_PASSWORD
+   - MYSQL_ROOT_PASSWORD
   user: root
   stop_grace_period: 1m
   networks:
@@ -410,3 +424,11 @@ networks:
       driver: default
       config:
       - subnet: 172.16.239.0/24
+
+secrets:
+  MYSQL_USER:
+    file: ./.MYSQL_USER
+  MYSQL_PASSWORD:
+    file: ./.MYSQL_PASSWORD
+  MYSQL_ROOT_PASSWORD:
+    file: ./.MYSQL_ROOT_PASSWORD