DerLinkman
30f3e9a4c6
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
64 lines
2.3 KiB
Markdown
64 lines
2.3 KiB
Markdown
---
|
|
id: TECH-INTEGRATIONS-ZABBIX
|
|
type: technical
|
|
status: active
|
|
title: Integrations - Zabbix
|
|
created: 2026-09-09
|
|
updated: 2026-09-09
|
|
tags:
|
|
- technical
|
|
- integration
|
|
- zabbix
|
|
related:
|
|
- MOD-003
|
|
source_paths:
|
|
- roles/monitoring/
|
|
- inventory/group_vars/
|
|
confidence: confirmed
|
|
---
|
|
|
|
# Integrations - Zabbix
|
|
|
|
## Agent Side (outbound/inbound to monitored hosts)
|
|
|
|
- Package source: `repo.zabbix.com` (release package for Zabbix 7.0 on
|
|
Debian, downloaded to `/tmp` and installed).
|
|
- Agent: `zabbix-agent2`, listen port 10050, config
|
|
`/etc/zabbix/zabbix_agent2.conf`.
|
|
- TLS: PSK only (`tls_connect=psk`, `tls_accept=psk`), identity per host,
|
|
PSK file `/etc/zabbix/zabbix_agent2.psk`.
|
|
- Docker monitoring: plugin config `/etc/zabbix/zabbix_agent2.d/plugins.d/
|
|
docker.conf` pointing at `unix:///var/run/docker.sock`, deployed when the
|
|
socket exists.
|
|
- Passive/active server lists come from site group_vars
|
|
(`monitoring_zabbix_passive_servers`).
|
|
|
|
## Controller Side (Zabbix API registration)
|
|
|
|
- API endpoint per site: `https://mon.cloudlorean.de/api_jsonrpc.php`
|
|
(group_vars); credentials `monitoring_zabbix_api_user: Admin` +
|
|
`monitoring_zabbix_api_password` from `vault.yml`.
|
|
- Module: `community.zabbix.zabbix_host` over `httpapi`; connection
|
|
parameters derived from the API URL with `urlsplit` (scheme, port, path).
|
|
- Host object: name = `monitoring_zabbix_host_name` (default
|
|
`inventory_hostname`), agent interface IP = `ansible_host`, host groups
|
|
and templates per site, `inventory_mode: manual`, TLS PSK identity/value
|
|
from the deployed PSK, `status: enabled`, `state: present` (idempotent
|
|
register-or-update).
|
|
- Optional proxy: when `monitoring_zabbix_proxy` is set, `monitored_by`
|
|
switches to the proxy (`gatekeeper.cloudlorean.de` for cloudlorean,
|
|
`gatekeeper.meyer-kempen.de` for home).
|
|
|
|
## Site Overrides (observed)
|
|
|
|
| Site | Passive servers | Proxy | Host groups |
|
|
| --- | --- | --- | --- |
|
|
| cloudlorean | 192.168.212.1 | gatekeeper.cloudlorean.de (192.168.212.1) | Linux servers, Cloudlorean |
|
|
| home | 10.13.37.1 | gatekeeper.meyer-kempen.de (10.13.37.1) | Linux servers, Meyer-Kempen |
|
|
| external | 2a01:4f8:1c1e:62dd::1 (see OQ-004) | none | Linux servers, Cloudlorean |
|
|
|
|
## Other External Services
|
|
|
|
- `download.docker.com` (docker role apt repository), Debian mirrors
|
|
(`deb.debian.org`, `security.debian.org` default; site-overridable).
|