zbx

# Zabbix with Let's Encrypt in a Docker Compose

# Vladimir Mikhalev
# [email protected]
# www.heyvaldemar.com

# Install the Docker Engine by following the official guide: https://docs.docker.com/engine/install/
# Install the Docker Compose by following the official guide: https://docs.docker.com/compose/install/

# Run zabbix-restore-database.sh to restore database if needed.

# Deploy Zabbix server with a Docker Compose using the command:
# docker-compose -f zbx-pgs-lencrypt-docker-compose.yml -p zabbix up -d

volumes:
  zabbix-postgres:
  zabbix-postgres-backups:
  traefik-certificates:

services:
  postgres:
    # Image tag (replace with yours)
    image: postgres:13.2
    volumes:
      - zabbix-postgres:/var/lib/postgresql/data
    environment:
      # Database name (replace with yours)
      POSTGRES_DB: zabbixdb
      # Database user (replace with yours)
      POSTGRES_USER: zabbixdbuser
      # Database password (replace with yours)
      POSTGRES_PASSWORD: Proxima200!
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -h 127.0.0.1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  zabbix:
    # Image tag (replace with yours)
    image: zabbix/zabbix-server-pgsql:ubuntu-5.4.5
    environment:
      DB_SERVER_HOST: postgres
      DB_SERVER_PORT: 5432
      # Database name (replace with yours)
      POSTGRES_DB: zabbixdb
      # Database user (replace with yours)
      POSTGRES_USER: zabbixdbuser
      # Database password (replace with yours)
      POSTGRES_PASSWORD: Proxima200!
      ZBX_VALUECACHESIZE: 64M
      ZBX_CACHESIZE: 128M
      ZBX_TRENDCACHESIZE: 128M
    ports:
      - "10051:10051"
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy

  web:
    # Image tag (replace with yours)
    image: zabbix/zabbix-web-nginx-pgsql:ubuntu-5.4.5
    environment:
      DB_SERVER_HOST: postgres
     DB_SERVER_PORT: 5432
      # Database name (replace with yours)
      POSTGRES_DB: zabbixdb
      # Database user (replace with yours)
      POSTGRES_USER: zabbixdbuser
      # Database password (replace with yours)
      POSTGRES_PASSWORD: Proxima200!
      ZBX_SERVER_HOST: zabbix.eager.su
      ZBX_SERVER_PORT: 10051
      # Timezone (replace with yours) https://www.php.net/manual/en/timezones.php
      PHP_TZ: Europe/Minsk
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    labels:
      - "traefik.enable=true"
      # Zabbix URL (replace with yours)
      - "traefik.http.routers.zabbix.rule=Host(`zabbix.eager.su`)"
      - "traefik.http.routers.zabbix.service=zabbix"
      - "traefik.http.routers.zabbix.entrypoints=websecure"
      - "traefik.http.services.zabbix.loadbalancer.server.port=8080"
      - "traefik.http.routers.zabbix.tls=true"
      - "traefik.http.routers.zabbix.tls.certresolver=letsencrypt"
      - "traefik.http.services.zabbix.loadbalancer.passhostheader=true"
      - "traefik.http.routers.zabbix.middlewares=compresstraefik"
      - "traefik.http.middlewares.compresstraefik.compress=true"
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      traefik:
        condition: service_healthy

  agent:
    # Image tag (replace with yours)
    image: zabbix/zabbix-agent2:ubuntu-trunk
    environment:
      # Zabbix Hostname (replace with yours)
      # Set as DNS name on Zabbix server host configuration screen to make checks of Zabbix server itself
      ZBX_HOSTNAME: zabbix
      ZBX_SERVER_HOST: 0.0.0.0/0
    ports:
      - "10050:10050"
    restart: unless-stopped
    depends_on:
      - postgres
      - zabbix

  traefik:
    # Image tag (replace with yours)
    image: traefik:2.4
    command:
      - "--log.level=WARN"
      - "--accesslog=true"
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--ping=true"
      - "--ping.entrypoint=ping"
      - "--entryPoints.ping.address=:8082"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      - "--providers.docker=true"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedByDefault=false"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      # Email for Let's Encrypt (replace with yours)
      - "--certificatesresolvers.letsencrypt.acme.email=bordulets@gmail.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme/acme.json"
      - "--metrics.prometheus=true"
      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
      - "--global.checkNewVersion=true"
      - "--global.sendAnonymousUsage=false"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - traefik-certificates:/etc/traefik/acme
    ports:
      - "80:80"
      - "443:443"
    healthcheck:
      test: ["CMD", "wget", "http://localhost:8082/ping","--spider"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    labels:
      - "traefik.enable=true"
      # Traefik URL (replace with yours)
      - "traefik.http.routers.dashboard.rule=Host(`traefik.zabbix.eager.su`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.services.dashboard.loadbalancer.passhostheader=true"
      - "traefik.http.routers.dashboard.middlewares=authtraefik"
      # Basic Authentication for Traefik Dashboard
      # Username: traefikadmin (replace with yours)
      # Passwords must be encoded using MD5, SHA1, or BCrypt
      - "traefik.http.middlewares.authtraefik.basicauth.users=traefikadmin:$$apr1$$5xglnycu$$GzgaWmink.HuydjjyICAm1"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.entrypoints=web"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
    restart: unless-stopped

  backups:
    # Image tag (replace with yours)
    image: postgres:13.2
    # Database backups prune interval (replace with yours). Default is 7 days.
    # find /srv/zabbix-postgres/backups -type f -mtime +7 | xargs rm -f

    # Zabbix backups interval (replace with yours). Default is 1 day.
    # sleep 24h

    # Run zabbix-restore-database.sh to restore database if needed.
    command: sh -c 'sleep 30m
             && while true; do
             PGPASSWORD="$$(echo $$POSTGRES_PASSWORD)"
             pg_dump
             -h postgres
             -p 5432
             -d zabbixdb
             -U zabbixdbuser | gzip > /srv/zabbix-postgres/backups/zabbix-postgres-backup-$$(date "+%Y-%m-%d_%H-%M").gz
             && find /srv/zabbix-postgres/backups -type f -mtime +7 | xargs rm -f;
             sleep 24h; done'
    volumes:
      # Database backups location
      - zabbix-postgres-backups:/srv/zabbix-postgres/backups
    environment:
      # Database password (replace with yours)
      POSTGRES_PASSWORD: Proxima200!
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      web:
        condition: service_healthy