Add DBTLS options
MODIFY
manifests/init.pp
manifests/init.pp
@@ -127,6 +127,8 @@ class zabbix (
$database_charset = $zabbix::params::server_database_charset,
$database_collate = $zabbix::params::server_database_collate,
$database_tablespace = $zabbix::params::server_database_tablespace,
+ Optional[Enum['required', 'verify_ca', 'verify_full']] $database_tlsconnect = $zabbix::params::server_database_tlsconnect,
+ Optional[Stdlib::Absolutepath] $database_tlscafile = $zabbix::params::server_database_tlscafile,
$startpollers = $zabbix::params::server_startpollers,
$startipmipollers = $zabbix::params::server_startipmipollers,
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,
@@ -259,6 +261,8 @@ class zabbix (
database_password => $database_password,
database_socket => $database_socket,
database_port => $database_port,
+ database_tlsconnect => $database_tlsconnect,
+ database_tlscafile => $database_tlscafile,
startpollers => $startpollers,
startipmipollers => $startipmipollers,
startpollersunreachable => $startpollersunreachable,

MODIFY
manifests/params.pp
manifests/params.pp
@@ -269,6 +269,12 @@ class zabbix::params {
$server_starttrappers = '5'
$server_startvmwarecollectors = '0'
$server_timeout = '3'
+ $server_database_tlsconnect = undef
+ $server_database_tlscafile = undef
+ $server_database_tlscertfile = undef
+ $server_database_tlskeyfile = undef
+ $server_database_tlscipher = undef
+ $server_database_tlscipher13 = undef
$server_tlscafile = undef
$server_tlscertfile = undef
$server_tlscrlfile = undef
@@ -421,6 +427,12 @@ class zabbix::params {
$proxy_starttrappers = '5'
$proxy_startvmwarecollectors = '0'
$proxy_timeout = '3'
+ $proxy_database_tlsconnect = undef
+ $proxy_database_tlscafile = undef
+ $proxy_database_tlscertfile = undef
+ $proxy_database_tlskeyfile = undef
+ $proxy_database_tlscipher = undef
+ $proxy_database_tlscipher13 = undef
$proxy_tlsaccept = undef
$proxy_tlscafile = undef
$proxy_tlscertfile = undef

MODIFY
manifests/proxy.pp
manifests/proxy.pp
@@ -387,6 +387,12 @@ class zabbix::proxy (
$database_password = $zabbix::params::proxy_database_password,
$database_socket = $zabbix::params::proxy_database_socket,
$database_port = $zabbix::params::proxy_database_port,
+ Optional[Enum['required', 'verify_ca', 'verify_full']] $database_tlsconnect = $zabbix::params::proxy_database_tlsconnect,
+ Optional[Stdlib::Absolutepath] $database_tlscafile = $zabbix::params::proxy_database_tlscafile,
+ Optional[Stdlib::Absolutepath] $database_tlscertfile = $zabbix::params::proxy_database_tlscertfile,
+ Optional[Stdlib::Absolutepath] $database_tlskeyfile = $zabbix::params::proxy_database_tlskeyfile,
+ Optional[String[1]] $database_tlscipher = $zabbix::params::proxy_database_tlscipher,
+ Optional[String[1]] $database_tlscipher13 = $zabbix::params::proxy_database_tlscipher13,
$localbuffer = $zabbix::params::proxy_localbuffer,
$offlinebuffer = $zabbix::params::proxy_offlinebuffer,
$heartbeatfrequency = $zabbix::params::proxy_heartbeatfrequency,

MODIFY
manifests/server.pp
manifests/server.pp
# [*database_port*]
# Database port when not using local socket. Ignored for sqlite.
#
+# [*database_tlsconnect*]
+# Available options:
+# * required - connect using TLS
+# * verify_ca - connect using TLS and verify certificate
+# * verify_full - connect using TLS, verify certificate and verify that database identity specified by DBHost matches its certificate
+#
+# [*database_tlscafile*]
+# Full pathname of a file containing the top-level CA(s) certificates for database certificate verification.
+#
+# [*database_tlscertfile*]
+# Full pathname of file containing Zabbix server certificate for authenticating to database.
+#
+# [*database_tlskeyfile*]
+# Full pathname of file containing the private key for authenticating to database.
+#
+# [*database_tlscipher*]
+# The list of encryption ciphers that Zabbix server permits for TLS protocols up through TLSv1.2.
+#
+# [*database_tlscipher13*]
+# The list of encryption ciphersuites that Zabbix server permits for TLSv1.3 protocol.
+#
# [*startpollers*]
# Number of pre-forked instances of pollers.
#
@@ -314,6 +335,12 @@ class zabbix::server (
$database_password = $zabbix::params::server_database_password,
$database_socket = $zabbix::params::server_database_socket,
Optional[Stdlib::Port::Unprivileged] $database_port = $zabbix::params::server_database_port,
+ Optional[Enum['required', 'verify_ca', 'verify_full']] $database_tlsconnect = $zabbix::params::server_database_tlsconnect,
+ Optional[Stdlib::Absolutepath] $database_tlscafile = $zabbix::params::server_database_tlscafile,
+ Optional[Stdlib::Absolutepath] $database_tlscertfile = $zabbix::params::server_database_tlscertfile,
+ Optional[Stdlib::Absolutepath] $database_tlskeyfile = $zabbix::params::server_database_tlskeyfile,
+ Optional[String[1]] $database_tlscipher = $zabbix::params::server_database_tlscipher,
+ Optional[String[1]] $database_tlscipher13 = $zabbix::params::server_database_tlscipher13,
$startpollers = $zabbix::params::server_startpollers,
$startipmipollers = $zabbix::params::server_startipmipollers,
$startpollersunreachable = $zabbix::params::server_startpollersunreachable,

MODIFY
spec/classes/proxy_spec.rb
spec/classes/proxy_spec.rb
@@ -218,6 +218,12 @@ describe 'zabbix::proxy' do
database_password: 'zabbix-proxy',
database_schema: 'zabbix-proxy',
database_user: 'zabbix-proxy',
+ database_tlsconnect: 'verify_ca',
+ database_tlscafile: '/etc/zabbix/ssl/ca.cert',
+ database_tlscertfile: '/etc/zabbix/ssl/cert.cert',
+ database_tlskeyfile: '/etc/zabbix/ssl/key.key',
+ database_tlscipher: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ database_tlscipher13: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
datasenderfrequency: '1',
debuglevel: '4',
externalscripts: '/usr/lib/zabbix/externalscripts',
@@ -288,6 +294,12 @@ describe 'zabbix::proxy' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBSchema=zabbix-proxy$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBUser=zabbix-proxy$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBPassword=zabbix-proxy$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSConnect=verify_ca} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSCAFile=/etc/zabbix/ssl/ca.cert} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSCertFile=/etc/zabbix/ssl/cert.cert} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSKeyFile=/etc/zabbix/ssl/key.key} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSCipher=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^DBTLSCipher13=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^ProxyLocalBuffer=0$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^ProxyOfflineBuffer=1$} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_proxy.conf').with_content %r{^HeartbeatFrequency=60$} }

MODIFY
spec/classes/server_spec.rb
spec/classes/server_spec.rb
@@ -208,6 +208,12 @@ describe 'zabbix::server' do
database_schema: 'zabbix-server',
database_socket: '/tmp/socket.db',
database_user: 'zabbix-server',
+ database_tlsconnect: 'verify_ca',
+ database_tlscafile: '/etc/zabbix/ssl/ca.cert',
+ database_tlscertfile: '/etc/zabbix/ssl/cert.cert',
+ database_tlskeyfile: '/etc/zabbix/ssl/key.key',
+ database_tlscipher: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
+ database_tlscipher13: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256',
debuglevel: '3',
externalscripts: '/usr/lib/zabbix/externalscripts0',
fping6location: '/usr/sbin/fping6',
@@ -268,6 +274,12 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBPort=3306} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBSchema=zabbix-server} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBSocket=/tmp/socket.db} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSConnect=verify_ca} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSCAFile=/etc/zabbix/ssl/ca.cert} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSCertFile=/etc/zabbix/ssl/cert.cert} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSKeyFile=/etc/zabbix/ssl/key.key} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSCipher=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBTLSCipher13=TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DBUser=zabbix-server} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^DebugLevel=3} }
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^ExternalScripts=/usr/lib/zabbix/externalscripts} }

MODIFY
templates/zabbix_proxy.conf.erb
templates/zabbix_proxy.conf.erb
@@ -504,3 +504,62 @@ LoadModulePath=<%= @loadmodulepath %>
# Full pathname of a file containing the pre-shared key.
#
<% if @tlspskfile %>TLSPSKFile=<%= @tlspskfile %><% end %>
+
+####### For advanced users - TLS ciphersuite selection criteria #######
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: DBTLSConnect
+# Setting this option enforces to use TLS connection to database.
+# required - connect using TLS
+# verify_ca - connect using TLS and verify certificate
+# verify_full - connect using TLS, verify certificate and verify that database identity specified by DBHost
+# matches its certificate
+# On MySQL starting from 5.7.11 and PostgreSQL following values are supported: "required", "verify_ca" and
+# "verify_full".
+# On MariaDB starting from version 10.2.6 "required" and "verify_full" values are supported.
+# Default is not to set any option and behavior depends on database configuration
+#
+# Mandatory: no
+# Default:
+<% if @database_tlsconnect %>DBTLSConnect=<%= @database_tlsconnect %><% end %>
+
+### Option: DBTLSCAFile
+# Full pathname of a file containing the top-level CA(s) certificates for database certificate verification.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# (yes, if DBTLSConnect set to one of: verify_ca, verify_full)
+# Default:
+<% if @database_tlscafile %>DBTLSCAFile=<%= @database_tlscafile %><% end %>
+
+### Option: DBTLSCertFile
+# Full pathname of file containing Zabbix server certificate for authenticating to database.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# Default:
+<% if @database_tlscertfile %>DBTLSCertFile=<%= @database_tlscertfile %><% end %>
+
+### Option: DBTLSKeyFile
+# Full pathname of file containing the private key for authenticating to database.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# Default:
+<% if @database_tlskeyfile %>DBTLSKeyFile=<%= @database_tlskeyfile %><% end %>
+
+### Option: DBTLSCipher
+# The list of encryption ciphers that Zabbix server permits for TLS protocols up through TLSv1.2
+# Supported only for MySQL
+#
+# Mandatory no
+# Default:
+<% if @database_tlscipher %>DBTLSCipher=<%= @database_tlscipher %><% end %>
+
+### Option: DBTLSCipher13
+# The list of encryption ciphersuites that Zabbix server permits for TLSv1.3 protocol
+# Supported only for MySQL, starting from version 8.0.16
+#
+# Mandatory no
+# Default:
+<% if @database_tlscipher13 %>DBTLSCipher13=<%= @database_tlscipher13 %><% end %>
+<% end %>

MODIFY
templates/zabbix_server.conf.erb
templates/zabbix_server.conf.erb
@@ -457,3 +457,62 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
# TLSKeyFile=
<% if @tlskeyfile %>TLSKeyFile=<%= @tlskeyfile %><% end %>
+
+####### For advanced users - TLS ciphersuite selection criteria #######
+<% if @zabbix_version.to_f >= 5.0 %>
+### Option: DBTLSConnect
+# Setting this option enforces to use TLS connection to database.
+# required - connect using TLS
+# verify_ca - connect using TLS and verify certificate
+# verify_full - connect using TLS, verify certificate and verify that database identity specified by DBHost
+# matches its certificate
+# On MySQL starting from 5.7.11 and PostgreSQL following values are supported: "required", "verify_ca" and
+# "verify_full".
+# On MariaDB starting from version 10.2.6 "required" and "verify_full" values are supported.
+# Default is not to set any option and behavior depends on database configuration
+#
+# Mandatory: no
+# Default:
+<% if @database_tlsconnect %>DBTLSConnect=<%= @database_tlsconnect %><% end %>
+
+### Option: DBTLSCAFile
+# Full pathname of a file containing the top-level CA(s) certificates for database certificate verification.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# (yes, if DBTLSConnect set to one of: verify_ca, verify_full)
+# Default:
+<% if @database_tlscafile %>DBTLSCAFile=<%= @database_tlscafile %><% end %>
+
+### Option: DBTLSCertFile
+# Full pathname of file containing Zabbix server certificate for authenticating to database.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# Default:
+<% if @database_tlscertfile %>DBTLSCertFile=<%= @database_tlscertfile %><% end %>
+
+### Option: DBTLSKeyFile
+# Full pathname of file containing the private key for authenticating to database.
+# Supported only for MySQL and PostgreSQL
+#
+# Mandatory: no
+# Default:
+<% if @database_tlskeyfile %>DBTLSKeyFile=<%= @database_tlskeyfile %><% end %>
+
+### Option: DBTLSCipher
+# The list of encryption ciphers that Zabbix server permits for TLS protocols up through TLSv1.2
+# Supported only for MySQL
+#
+# Mandatory no
+# Default:
+<% if @database_tlscipher %>DBTLSCipher=<%= @database_tlscipher %><% end %>
+
+### Option: DBTLSCipher13
+# The list of encryption ciphersuites that Zabbix server permits for TLSv1.3 protocol
+# Supported only for MySQL, starting from version 8.0.16
+#
+# Mandatory no
+# Default:
+<% if @database_tlscipher13 %>DBTLSCipher13=<%= @database_tlscipher13 %><% end %>
+<% end %>

Add DBTLS options

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>