Set up Zabbix 7 distributed monitoring with proxy servers for scalable infrastructure oversight

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Default values
ZABBIX_SERVER_IP=""
PROXY_HOSTNAME=""
PROXY_SOURCE_IP=""

# Usage function
usage() {
    echo "Usage: $0 --server <zabbix_server_ip> --hostname <proxy_hostname> [--source-ip <proxy_source_ip>]"
    echo "  --server      IP address of the Zabbix server"
    echo "  --hostname    Hostname for this proxy (must be unique)"
    echo "  --source-ip   Source IP for proxy connections (optional)"
    exit 1
}

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        --server)
            ZABBIX_SERVER_IP="$2"
            shift 2
            ;;
        --hostname)
            PROXY_HOSTNAME="$2"
            shift 2
            ;;
        --source-ip)
            PROXY_SOURCE_IP="$2"
            shift 2
            ;;
        -h|--help)
            usage
            ;;
        *)
            echo -e "${RED}Unknown option: $1${NC}"
            usage
            ;;
    esac
done

# Validate required arguments
if [[ -z "$ZABBIX_SERVER_IP" || -z "$PROXY_HOSTNAME" ]]; then
    echo -e "${RED}Error: Missing required arguments${NC}"
    usage
fi

# Cleanup function for rollback
cleanup() {
    echo -e "${YELLOW}Installation failed. Cleaning up...${NC}"
    systemctl stop zabbix-proxy 2>/dev/null || true
    systemctl disable zabbix-proxy 2>/dev/null || true
    rm -f /etc/zabbix/zabbix_proxy.conf.bak 2>/dev/null || true
}

# Set trap for cleanup on error
trap cleanup ERR

# Check if running as root or with sudo
if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root or with sudo${NC}"
    exit 1
fi

echo -e "${GREEN}Installing Zabbix 7 Proxy Server${NC}"

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            FIREWALL_CMD="firewall-cmd"
            ;;
        *)
            echo -e "${RED}Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
else
    echo -e "${RED}Cannot detect distribution${NC}"
    exit 1
fi

# Step 1: Update system packages
echo -e "${GREEN}[1/9] Updating system packages...${NC}"
$PKG_UPDATE

# Step 2: Install required tools
echo -e "${GREEN}[2/9] Installing required tools...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL wget curl openssl
else
    $PKG_INSTALL wget curl openssl
fi

# Step 3: Install Zabbix repository
echo -e "${GREEN}[3/9] Installing Zabbix repository...${NC}"
if [[ "$PKG_MGR" == "apt" ]]; then
    wget -q https://repo.zabbix.com/zabbix/7.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest+ubuntu24.04_all.deb
    dpkg -i zabbix-release_latest+ubuntu24.04_all.deb
    apt update
    rm -f zabbix-release_latest+ubuntu24.04_all.deb
else
    case "$ID" in
        almalinux|rocky)
            rpm -Uvh https://repo.zabbix.com/zabbix/7.0/rocky/9/x86_64/zabbix-release-latest.el9.noarch.rpm
            ;;
        centos|rhel|ol)
            rpm -Uvh https://repo.zabbix.com/zabbix/7.0/rhel/9/x86_64/zabbix-release-latest.el9.noarch.rpm
            ;;
        fedora)
            rpm -Uvh https://repo.zabbix.com/zabbix/7.0/fedora/39/x86_64/zabbix-release-latest.fc39.noarch.rpm
            ;;
        amzn)
            rpm -Uvh https://repo.zabbix.com/zabbix/7.0/rhel/9/x86_64/zabbix-release-latest.el9.noarch.rpm
            ;;
    esac
    $PKG_MGR clean all
    if [[ "$PKG_MGR" == "dnf" ]]; then
        dnf update -y
    fi
fi

# Step 4: Install Zabbix proxy
echo -e "${GREEN}[4/9] Installing Zabbix proxy server...${NC}"
$PKG_INSTALL zabbix-proxy-sqlite3 zabbix-sql-scripts

# Step 5: Create proxy database directory
echo -e "${GREEN}[5/9] Creating proxy database directory...${NC}"
mkdir -p /var/lib/zabbix
chown zabbix:zabbix /var/lib/zabbix
chmod 755 /var/lib/zabbix

# Step 6: Generate PSK encryption key
echo -e "${GREEN}[6/9] Generating PSK encryption key...${NC}"
mkdir -p /etc/zabbix/keys
openssl rand -hex 32 > /etc/zabbix/keys/proxy.psk
chown zabbix:zabbix /etc/zabbix/keys/proxy.psk
chmod 400 /etc/zabbix/keys/proxy.psk

PSK_KEY=$(cat /etc/zabbix/keys/proxy.psk)
echo -e "${YELLOW}PSK Key generated: ${PSK_KEY}${NC}"
echo -e "${YELLOW}Save this key - you'll need it on the Zabbix server!${NC}"

# Step 7: Configure Zabbix proxy
echo -e "${GREEN}[7/9] Configuring Zabbix proxy...${NC}"
cp /etc/zabbix/zabbix_proxy.conf /etc/zabbix/zabbix_proxy.conf.bak

cat > /etc/zabbix/zabbix_proxy.conf << EOF
Server=${ZABBIX_SERVER_IP}
Hostname=${PROXY_HOSTNAME}
ListenPort=10051
$([ -n "$PROXY_SOURCE_IP" ] && echo "SourceIP=${PROXY_SOURCE_IP}")
DBName=/var/lib/zabbix/zabbix_proxy.db
ProxyOfflineBuffer=24
ConfigFrequency=300
DataSenderFrequency=1

# PSK Encryption
TLSConnect=psk
TLSAccept=psk
TLSPSKIdentity=${PROXY_HOSTNAME}
TLSPSKFile=/etc/zabbix/keys/proxy.psk

# Cache settings
CacheSize=32M
HistoryCacheSize=64M
HistoryIndexCacheSize=16M
TrendCacheSize=16M

# Process settings
StartPollers=10
StartPollersUnreachable=5
StartTrappers=10
StartPingers=5
StartDiscoverers=3

LogFile=/var/log/zabbix/zabbix_proxy.log
LogFileSize=10
EOF

chown root:zabbix /etc/zabbix/zabbix_proxy.conf
chmod 640 /etc/zabbix/zabbix_proxy.conf

# Step 8: Configure firewall
echo -e "${GREEN}[8/9] Configuring firewall...${NC}"
if [[ "$FIREWALL_CMD" == "ufw" ]]; then
    if command -v ufw >/dev/null 2>&1; then
        ufw allow 10051/tcp comment "Zabbix Proxy"
        ufw allow 162/udp comment "SNMP Traps"
        ufw --force reload
    fi
else
    if command -v firewall-cmd >/dev/null 2>&1; then
        firewall-cmd --permanent --add-port=10051/tcp
        firewall-cmd --permanent --add-port=162/udp
        firewall-cmd --reload
    fi
fi

# Step 9: Enable and start Zabbix proxy
echo -e "${GREEN}[9/9] Starting Zabbix proxy service...${NC}"
systemctl enable zabbix-proxy
systemctl start zabbix-proxy

# Verification
echo -e "${GREEN}Verifying installation...${NC}"
sleep 5

if systemctl is-active --quiet zabbix-proxy; then
    echo -e "${GREEN}✓ Zabbix proxy service is running${NC}"
else
    echo -e "${RED}✗ Zabbix proxy service is not running${NC}"
    systemctl status zabbix-proxy
    exit 1
fi

if [[ -f /var/lib/zabbix/zabbix_proxy.db ]]; then
    echo -e "${GREEN}✓ Proxy database created${NC}"
else
    echo -e "${YELLOW}⚠ Proxy database not yet created (will be created on first connection)${NC}"
fi

echo -e "${GREEN}Installation completed successfully!${NC}"
echo -e "${YELLOW}Next steps:${NC}"
echo "1. Add this proxy to your Zabbix server web interface:"
echo "   - Proxy name: ${PROXY_HOSTNAME}"
echo "   - Proxy mode: Active"
echo "   - Proxy address: $(hostname -I | awk '{print $1}')${PROXY_SOURCE_IP:+ or $PROXY_SOURCE_IP}"
echo "   - Encryption: PSK"
echo "   - PSK identity: ${PROXY_HOSTNAME}"
echo "   - PSK: ${PSK_KEY}"
echo ""
echo "2. Configure hosts to use this proxy in Zabbix server"
echo "3. Check proxy logs: tail -f /var/log/zabbix/zabbix_proxy.log"