jcline/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

zabbix: debugging encryption config

Browse source 
Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>
This commit is contained in:
David Kirwan 2026-05-11 16:43:55 +01:00
commit 850e51c1db
Signed by untrusted user: dkirwan
GPG key ID: A5893AB6474AC37D
1 changed files with 6 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

14
roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2
View file

@ -71,16 +71,14 @@ zabbixProxy:
## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value.
- name: ZBX_SERVER_HOST
value: "zabbix01.stg.rdu3.fedoraproject.org:10051"
## TLS-PSK for connections *to this proxy from Zabbix clients* (incoming listener).
## Identity: zabbix_tls_psk_identity (see inventory group_vars/all). PSK value: prefer
## zabbix_tls_psk (set per-environment, e.g. staging -> zabbix_tls_stg_psk), else zabbix_tls_stg_psk,
## matching zabbix_agent role private vars.
## zabbix-docker creates TLSPSKFile from ZBX_TLSPSK; Zabbix then requires TLSConnect for
## proxy -> server (active) traffic. Use psk when the server expects the same PSK as agents.
## TLS split: proxy -> Zabbix server = plaintext; clients/agents -> proxy = TLS-PSK only.
## (TLSConnect outbound vs TLSAccept inbound — see Zabbix proxy TLS docs.)
## zabbix-docker builds TLSPSKFile from ZBX_TLSPSK for incoming PSK; TLSConnect must still be set
## explicitly (unencrypted) so startup does not require server-side PSK.
- name: ZBX_TLSCONNECT
value: "psk"
value: "unencrypted"
- name: ZBX_TLSACCEPT
value: "unencrypted,psk"
value: "psk"
- name: ZBX_TLSPSKIDENTITY
value: "{{ zabbix_tls_psk_identity }}"
- name: ZBX_TLSPSK