---
id: TECH-INTEGRATIONS-ZABBIX
type: technical
status: active
title: Integrations - Zabbix
created: 2026-09-09
updated: 2026-09-09
tags:
- technical
- integration
- zabbix
related:
- MOD-003
source_paths:
- roles/monitoring/
- inventory/group_vars/
confidence: confirmed
---

# Integrations - Zabbix

## Agent Side (outbound/inbound to monitored hosts)

- Package source: `repo.zabbix.com` (release package for Zabbix 7.0 on
  Debian, downloaded to `/tmp` and installed).
- Agent: `zabbix-agent2`, listen port 10050, config
  `/etc/zabbix/zabbix_agent2.conf`.
- TLS: PSK only (`tls_connect=psk`, `tls_accept=psk`), identity per host,
  PSK file `/etc/zabbix/zabbix_agent2.psk`.
- Docker monitoring: plugin config `/etc/zabbix/zabbix_agent2.d/plugins.d/
  docker.conf` pointing at `unix:///var/run/docker.sock`, deployed when the
  socket exists.
- Passive/active server lists come from site group_vars
  (`monitoring_zabbix_passive_servers`).

## Controller Side (Zabbix API registration)

- API endpoint per site: `https://mon.cloudlorean.de/api_jsonrpc.php`
  (group_vars); credentials `monitoring_zabbix_api_user: Admin` +
  `monitoring_zabbix_api_password` from `vault.yml`.
- Module: `community.zabbix.zabbix_host` over `httpapi`; connection
  parameters derived from the API URL with `urlsplit` (scheme, port, path).
- Host object: name = `monitoring_zabbix_host_name` (default
  `inventory_hostname`), agent interface IP = `ansible_host`, host groups
  and templates per site, `inventory_mode: manual`, TLS PSK identity/value
  from the deployed PSK, `status: enabled`, `state: present` (idempotent
  register-or-update).
- Optional proxy: when `monitoring_zabbix_proxy` is set, `monitored_by`
  switches to the proxy (`gatekeeper.cloudlorean.de` for cloudlorean,
  `gatekeeper.meyer-kempen.de` for home).

## Site Overrides (observed)

| Site | Passive servers | Proxy | Host groups |
| --- | --- | --- | --- |
| cloudlorean | 192.168.212.1 | gatekeeper.cloudlorean.de (192.168.212.1) | Linux servers, Cloudlorean |
| home | 10.13.37.1 | gatekeeper.meyer-kempen.de (10.13.37.1) | Linux servers, Meyer-Kempen |
| external | 2a01:4f8:1c1e:62dd::1 (see OQ-004) | none | Linux servers, Cloudlorean |

## Other External Services

- `download.docker.com` (docker role apt repository), Debian mirrors
  (`deb.debian.org`, `security.debian.org` default; site-overridable).