Refactor zabbix web

molecule/zabbix_proxy/prepare.yml

@@ -60,24 +60,21 @@
       ansible.builtin.shell: "apt-get update && echo exit 0 > /usr/sbin/policy-rc.d"
       register: installation_dependencies
       until: installation_dependencies is succeeded
-      when:
-        - ansible_os_family != 'RedHat'
+      when: ansible_facts['os_family'] == 'Debian'
 
-    - name: "Installing packages on NON-CentOS"
+    - name: "Installing packages on Debian family"
       ansible.builtin.apt:
         name:
           - net-tools
           - apt-utils
           - python3-pip
           - gpg-agent
           - sudo
-          - doc-base
         update_cache: true
         state: present
       register: installation_dependencies
       until: installation_dependencies is succeeded
-      when:
-        - ansible_os_family != 'RedHat'
+      when: ansible_facts['os_family'] == 'Debian'
 
     - name: "Configure SUDO."
       ansible.builtin.lineinfile:

molecule/zabbix_server/prepare.yml

@@ -6,7 +6,7 @@
     - name: "Create MySQL Container"
       docker_container:
         name: "{{ item.name }}-db"
-        image: mysql:8.0.32
+        image: mysql:8.0
         state: started
         recreate: true
         networks:
@@ -56,25 +56,13 @@
       when:
         - ansible_os_family == 'RedHat'
 
-    - name: "Installing packages on CentOS"
-      ansible.builtin.yum:
-        name:
-          - mysql
-        state: present
-      register: installation_dependencies
-      until: installation_dependencies is succeeded
-      when:
-        - ansible_os_family == 'RedHat'
-        - inventory_hostname in groups['mysql']
-
     - name: "Apt update"
       ansible.builtin.shell: "apt-get update && echo exit 0 > /usr/sbin/policy-rc.d"
       register: installation_dependencies
       until: installation_dependencies is succeeded
-      when:
-        - ansible_os_family != 'RedHat'
+      when: ansible_facts['os_family'] == 'Debian'
 
-    - name: "Installing packages on NON-CentOS"
+    - name: "Installing packages on Debian family"
       ansible.builtin.apt:
         name:
           - net-tools
@@ -86,19 +74,10 @@
         state: present
       register: installation_dependencies
       until: installation_dependencies is succeeded
-      when:
-        - ansible_os_family != 'RedHat'
+      when: ansible_facts['os_family'] == 'Debian'
 
     - name: "Configure SUDO."
       ansible.builtin.lineinfile:
         dest: /etc/sudoers
         line: "Defaults    !requiretty"
         state: present
-
-    - name: "Make sure the docs are installed."
-      ansible.builtin.lineinfile:
-        dest: /etc/yum.conf
-        line: "tsflags=nodocs"
-        state: absent
-      when:
-        - ansible_os_family == 'RedHat'

molecule/zabbix_web/molecule.yml

@@ -46,7 +46,6 @@ provisioner:
         zabbix_web_version: 6.0
       mysql:
         zabbix_server_database: mysql
-        zabbix_server_dbport: 3306
         zabbix_server_dbhost: "{{ inventory_hostname }}-db"
         zabbix_server_dbhost_run_install: false
         zabbix_server_privileged_host: "%"
@@ -56,7 +55,6 @@ provisioner:
         zabbix_server_mysql_login_port: 3306
       pgsql:
         zabbix_server_database: pgsql
-        zabbix_server_dbport: 5432
         zabbix_server_dbhost: "{{ inventory_hostname }}-db"
         zabbix_server_dbhost_run_install: false
         zabbix_server_pgsql_login_host: "{{ inventory_hostname }}-db"

molecule/zabbix_web/prepare.yml

@@ -56,25 +56,13 @@
       when:
         - ansible_os_family == 'RedHat'
 
-    - name: "Installing MySQL on CentOS"
-      ansible.builtin.yum:
-        name:
-          - mysql
-        state: present
-      register: installation_dependencies
-      until: installation_dependencies is succeeded
-      when:
-        - ansible_os_family == 'RedHat'
-        - inventory_hostname in groups['mysql']
-
     - name: "Apt update"
       ansible.builtin.shell: "apt-get update"
       register: installation_dependencies
       until: installation_dependencies is succeeded
-      when:
-        - ansible_os_family != 'RedHat'
+      when: ansible_facts['os_family'] == 'Debian'
 
-    - name: "Installing packages on NON-CentOS"
+    - name: "Installing packages on Debian family"
       ansible.builtin.apt:
         name:
           - net-tools
@@ -87,46 +75,17 @@
         state: present
       register: installation_dependencies
       until: installation_dependencies is succeeded
-      when:
-        - ansible_os_family != 'RedHat'
+      when: ansible_facts['os_family'] == 'Debian'
 
     - name: "Configure SUDO."
       ansible.builtin.lineinfile:
         dest: /etc/sudoers
         line: "Defaults    !requiretty"
         state: present
 
-    - name: "Make sure the docs are installed."
-      ansible.builtin.lineinfile:
-        dest: /etc/yum.conf
-        line: "tsflags=nodocs"
-        state: absent
-      when:
-        - ansible_os_family == 'RedHat'
-
-    - name: PyMySQL
-      ansible.builtin.pip:
-        name: PyMySQL
-      register: installation_dependencies
-      until: installation_dependencies is succeeded
-      when:
-        - inventory_hostname in groups['mysql']
-
-    - name: Enabeling PHP 8.0
-      block:
-        - name: Add epel
-          ansible.builtin.include_role:
-            name: geerlingguy.repo-epel
-
-        - name: Add remi
-          ansible.builtin.include_role:
-            name: geerlingguy.repo-remi
-
-        - name: Reset dnf library
-          ansible.builtin.shell: dnf module reset php
-
-        - name: Set php Version
-          ansible.builtin.shell: dnf module enable -y php:remi-8.0
+    - name: Enabling PHP 8.0
+      ansible.builtin.dnf:
+        name: "@php:8.0/common"
       when:
         - ansible_os_family == 'RedHat'
         - ansible_distribution_major_version == "8"
@@ -148,43 +107,34 @@
           - php-pecl-apcu
           - php-xml
       when:
-        - ansible_distribution_major_version >= '8'
         - ansible_os_family == "RedHat"
 
-    - name: Set PHP Version (Ubuntu 2204)
-      ansible.builtin.set_fact:
-        __php_default_version_debian: "8.1"
-      when:
-        - ansible_distribution_major_version >= '22'
-        - ansible_os_family == "Debian"
-
-    - name: Set PHP Version (Ubuntu 2404)
-      ansible.builtin.set_fact:
-        __php_default_version_debian: "8.3"
+    - name: Workaround for geerlingguy.php missing ubuntu-24.04 support
       when:
-        - ansible_distribution_major_version >= '24'
-        - ansible_os_family == "Debian"
-
-    - name: Set PHP packages (Ubuntu 2204 & 2404)
-      ansible.builtin.set_fact:
-        __php_packages:
-          - php{{ __php_default_version_debian }}-common
-          - php{{ __php_default_version_debian }}-cli
-          - php{{ __php_default_version_debian }}-dev
-          - php{{ __php_default_version_debian }}-fpm
-          - libpcre3-dev
-          - php{{ __php_default_version_debian }}-gd
-          - php{{ __php_default_version_debian }}-curl
-          - php{{ __php_default_version_debian }}-imap
-          - php-json
-          - php{{ __php_default_version_debian }}-opcache
-          - php{{ __php_default_version_debian }}-xml
-          - php{{ __php_default_version_debian }}-mbstring
-          - php{{ __php_default_version_debian }}-apcu
-          - php{{ __php_default_version_debian }}-sqlite3
-      when:
-        - ansible_distribution_major_version >= '22'
-        - ansible_os_family == "Debian"
+        - ansible_facts['distribution'] == "Ubuntu"
+        - ansible_facts['distribution_major_version'] >= '24'
+      block:
+        - name: Set PHP Version
+          ansible.builtin.set_fact:
+            __php_default_version_debian: "8.3"
+
+        - name: Set PHP packages
+          ansible.builtin.set_fact:
+            __php_packages:
+              - php{{ __php_default_version_debian }}-common
+              - php{{ __php_default_version_debian }}-cli
+              - php{{ __php_default_version_debian }}-dev
+              - php{{ __php_default_version_debian }}-fpm
+              - libpcre3-dev
+              - php{{ __php_default_version_debian }}-gd
+              - php{{ __php_default_version_debian }}-curl
+              - php{{ __php_default_version_debian }}-imap
+              - php-json
+              - php{{ __php_default_version_debian }}-opcache
+              - php{{ __php_default_version_debian }}-xml
+              - php{{ __php_default_version_debian }}-mbstring
+              - php{{ __php_default_version_debian }}-apcu
+              - php{{ __php_default_version_debian }}-sqlite3
 
   roles:
     - role: geerlingguy.apache

molecule/zabbix_web/requirements.yml

@@ -1,6 +1,6 @@
 ---
-- src: geerlingguy.apache
-- src: geerlingguy.nginx
-- src: geerlingguy.php
-- src: geerlingguy.repo-epel
-- src: geerlingguy.repo-remi
+roles:
+  - src: geerlingguy.apache
+  - src: geerlingguy.nginx
+  - src: geerlingguy.php
+    version: '5.0.1'

roles/zabbix_proxy/tasks/initialize-mysql.yml

@@ -27,6 +27,7 @@
 
 - name: "MySQL Database prep"
   when: zabbix_proxy_database_creation | bool
+  become: "{{ zabbix_proxy_dbhost_run_install }}"
   delegate_to: "{{ zabbix_proxy_real_dbhost | default(zabbix_proxy_dbhost_run_install | ternary(delegated_dbhost, inventory_hostname)) }}"
   vars:
     delegated_dbhost: "{{ (zabbix_proxy_dbhost == 'localhost') | ternary(inventory_hostname, zabbix_proxy_dbhost) }}"
@@ -56,12 +57,14 @@
         login_unix_socket: "{{ zabbix_proxy_mysql_login_unix_socket | default(omit) }}"
         name: "{{ zabbix_proxy_dbuser }}"
         password: "{{ zabbix_proxy_dbpassword }}"
-        priv: "{{ zabbix_proxy_dbname }}.*:ALL"
         host: "{{ zabbix_proxy_privileged_host }}"
+        priv: "{{ zabbix_proxy_dbname }}.*:ALL"
         state: present
 
 - name: "MySQL verify or create schema"
   when: zabbix_proxy_database_sqlload | bool
+  vars:
+    delegated_dbhost: "{{ (zabbix_proxy_dbhost == 'localhost') | ternary(inventory_hostname, zabbix_proxy_dbhost) }}"
   tags:
     - database
   block:
@@ -76,8 +79,6 @@
   rescue:
     - name: "MySQL | Get and set schema import overrides"
       delegate_to: "{{ zabbix_proxy_real_dbhost | default(zabbix_proxy_dbhost_run_install | ternary(delegated_dbhost, inventory_hostname)) }}"
-      vars:
-        delegated_dbhost: "{{ (zabbix_proxy_dbhost == 'localhost') | ternary(inventory_hostname, zabbix_proxy_dbhost) }}"
       block:
         - name: "MySQL | Get current value for variables"
           community.mysql.mysql_variables:
@@ -95,15 +96,15 @@
           register: _mysql_variable_defaults
 
         - name: "MySQL | Set variable overrides for schema import"
-          when: item.msg != _mysql_schema_import_overrides[item.name]
           community.mysql.mysql_variables:
             variable: "{{ item.name }}"
             value: "{{ _mysql_schema_import_overrides[item.name] }}"
-            login_host: "{{ zabbix_proxy_mysql_login_host | default(omit) }}"
             login_user: "{{ zabbix_proxy_mysql_login_user | default(omit) }}"
             login_password: "{{ zabbix_proxy_mysql_login_password | default(omit) }}"
+            login_host: "{{ zabbix_proxy_mysql_login_host | default(omit) }}"
             login_port: "{{ zabbix_proxy_mysql_login_port | default(omit) }}"
             login_unix_socket: "{{ zabbix_proxy_mysql_login_unix_socket | default(omit) }}"
+          when: item.msg != _mysql_schema_import_overrides[item.name]
           loop: "{{ _mysql_variable_defaults.results }}"
           loop_control:
             label: "{{ item.name }}: {{ _mysql_schema_import_overrides[item.name] }}"
@@ -126,10 +127,7 @@
 
   always:
     - name: "MySQL | Revert variable overrides for schema import"
-      when: _mysql_variable_defaults is defined
       delegate_to: "{{ zabbix_proxy_real_dbhost | default(zabbix_proxy_dbhost_run_install | ternary(delegated_dbhost, inventory_hostname)) }}"
-      vars:
-        delegated_dbhost: "{{ (zabbix_proxy_dbhost == 'localhost') | ternary(inventory_hostname, zabbix_proxy_dbhost) }}"
       community.mysql.mysql_variables:
         variable: "{{ item.name }}"
         value: "{{ item.msg }}"

roles/zabbix_server/tasks/initialize-mysql.yml

@@ -14,8 +14,18 @@
     - database
     - dependencies
 
+# NOTE: Upgrading system-packages with pip is generally a bad idea, but
+# these packaged older versions seems to have a problem with mysql 8 and above
+- name: Upgrade pymysql
+  when:
+    - ansible_facts['distribution'] in ['Debian', 'Ubuntu']
+    - ansible_facts['distribution_release'] in ['bullseye', 'focal']
+  ansible.builtin.pip:
+    name: "pymysql>=0.10.0,<0.11.0"
+    state: latest
+
 - name: "MySQL Database prep"
-  when: zabbix_server_database_creation
+  when: zabbix_server_database_creation | bool
   become: "{{ zabbix_server_dbhost_run_install }}"
   delegate_to: "{{ zabbix_server_real_dbhost | default(zabbix_server_dbhost_run_install | ternary(delegated_dbhost, inventory_hostname)) }}"
   vars:

roles/zabbix_web/defaults/main.yml

@@ -43,15 +43,16 @@ zabbix_server_dbhost: localhost
 zabbix_server_dbname: zabbix-server
 zabbix_server_dbuser: zabbix-server
 zabbix_server_dbpassword: zabbix-server
-zabbix_server_dbport: 5432
+_zabbix_server_database_default_port:
+  mysql: 3306
+  pgsql: 5432
+zabbix_server_dbport: "{{ _zabbix_server_database_default_port[zabbix_server_database] }}"
 zabbix_server_dbencryption: false
 zabbix_server_dbverifyhost: false
 zabbix_server_dbschema:
 
 # Yum/APT Variables
 zabbix_web_version_minor: "*"
-zabbix_web_disable_repo:
-  - epel
 
 # Elasticsearch
 # zabbix_server_history_url:
@@ -68,7 +69,6 @@ zabbix_server_history_types:
   - "dbl"
 
 # SELinux specific
-zabbix_web_selinux: false
 selinux_allow_httpd_can_connect_ldap: false
 selinux_allow_httpd_can_network_connect_db: false
 selinux_allow_httpd_can_connect_zabbix: false