Configuration parameters: Zabbix frontend

Overview

Configuration parameters allow customizing Zabbix frontend behavior.

Specify parameter values in the frontend configuration file (zabbix.conf.php).

This page is structured as:

• Parameter overview (to see full details of a parameter, click its name)
• Parameter details

Parameter details

$DB['TYPE']

Database type.

Values: MYSQL - MySQL, POSTGRESQL - PostgreSQL.

$DB['SERVER']

Database host name or IP address.

If $DB['SERVER'] is not defined, the default Unix-domain socket is used. For MySQL, setting $DB['SERVER'] to localhost also results in a connection via the default Unix socket.
For PostgreSQL, $DB['SERVER'] can contain multiple host:port entries separated by commas. If a port is not defined for a host in the comma-separated list, the value defined in $DB['PORT'] is used as the default port. If a socket path is specified in $DB['SERVER'] (for example, /var/run/pgbouncer), that Unix-domain socket is used.

Examples:

$DB['SERVER'] = 'localhost';
$DB['SERVER'] = 127.0.0.1;

$DB['PORT']

Database port.

If not defined, the value 0 is used.

$DB['DATABASE']

Database name used by the Zabbix frontend to connect to the configured database.

Example:

$DB['DATABASE'] = 'zabbix';

$DB['USER']

Username used by the Zabbix frontend to connect to the database.

$DB['PASSWORD']

Password used by the Zabbix frontend to connect to the database.

$DB['SCHEMA']

Database schema name used for PostgreSQL.

$DB['ENCRYPTION']

Enable or disable encryption for connections between the Zabbix frontend and the database.

Values: true - enabled, false - disabled.

$DB['KEY_FILE']

Path to the client private key file used for the database TLS connection.

Example:

// For MySQL:
$DB['KEY_FILE'] = '/etc/ssl/mysql/client-key.pem';

$DB['CERT_FILE']

Path to the client certificate file used for the database TLS connection.

Example:

// For MySQL:
$DB['CERT_FILE'] = '/etc/ssl/mysql/client-cert.pem';

$DB['CA_FILE']

Path to the CA certificate file used for the database TLS connection.

Examples:

// For MySQL:
$DB['CA_FILE'] = '/etc/ssl/mysql/ca.pem';
// For PostgreSQL:
$DB['CA_FILE'] = '/etc/ssl/pgsql/root.crt';

$DB['VERIFY_HOST']

Enable or disable verification of the database server hostname in the TLS certificate.

Values: true - enabled, false - disabled.

$DB['CIPHER_LIST']

List of allowed TLS ciphers for the database connection.

Examples:

// For MySQL:
$DB['CIPHER_LIST'] = 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GC';

$DB['VAULT']

Specify the Vault secrets manager used to store database credentials.

Values: CyberArk or HashiCorp.

Examples:

// For CyberArk:
$DB['VAULT'] = 'CyberArk';
// For HashiCorp:
$DB['VAULT'] = 'HashiCorp';

$DB['VAULT_URL']

URL of the Vault secrets manager used to retrieve database credentials.

Examples:

// For CyberArk:
$DB['VAULT_URL'] = 'https://127.0.0.1:1858';
// For HashiCorp:
$DB['VAULT_URL'] = 'https://localhost:8200';

$DB['VAULT_PREFIX']

Prefix for the Vault path or query used to retrieve database credentials.

Example:

// For HashiCorp:
$DB['VAULT_PREFIX'] = '/v1/secret/data/zabbix/';

$DB['VAULT_DB_PATH']

Path to the database credentials in the Vault secrets manager.

Examples:

// For CyberArk:
$DB['VAULT_DB_PATH'] = 'AppID=foo&Query=Safe=bar;Object=buzz';
// For HashiCorp:
$DB['VAULT_DB_PATH'] = 'database';

$DB['VAULT_TOKEN']

Authentication token used to access the Vault secrets manager.

Example:

// For HashiCorp:
$DB['VAULT_TOKEN'] = 'hvs.CAESIIG_PILmULFYOsEyWHxkZ2mF2a8VPKNLE8eHqd4autYGGh4KHGh2cy5aeTY0NFNSaUp3ZnpWbDF1RUNjUkNTZEg';

$DB['VAULT_APP_ROLE_ID']

VaultAppSecretID role ID used to authenticate to HashiCorp Vault.

Example:

$DB['VAULT_APP_ROLE_ID'] = '6f1567f1-538d-7d70-e8e4-5d3e59471b2e';

$DB['VAULT_APP_SECRET_ID']

VaultAppSecretID used to authenticate to HashiCorp Vault.

Example:

$DB['VAULT_APP_SECRET_ID'] = '89dac8b1-f7d6-96a7-2ecf-f94d2de3d6f1';

$DB['VAULT_CERT_FILE']

Path to the client certificate file used to authenticate to the Vault secrets manager.

Example:

// For CyberArk:
$DB['VAULT_CERT_FILE'] = 'conf/certs/cyberark-cert.pem';

$DB['VAULT_KEY_FILE']

Path to the client private key file used to authenticate to the Vault secrets manager.

Example:

// For CyberArk:
$DB['VAULT_KEY_FILE'] = 'conf/certs/cyberark-key.pem';

$DB['VAULT_CACHE']

Enables or disables caching of credentials retrieved from the Vault secrets manager.

Values: true - enabled, false - disabled.

$ZBX_SERVER

Specify a value to override the Zabbix hostname/IP address.
If $ZBX_SERVER is specified without $ZBX_SERVER_PORT, the default port (10051) is used.

$ZBX_SERVER_PORT

Specify a value to override the Zabbix server port.
This parameter is used together with $ZBX_SERVER.

$ZBX_SERVER_NAME

Zabbix server name.

$IMAGE_FORMAT_DEFAULT

Default image format.

Default: IMAGE_FORMAT_PNG
Values:

• IMAGE_FORMAT_PNG - PNG format
• IMAGE_FORMAT_JPEG - JPEG format
• IMAGE_FORMAT_GIF - GIF format

$HISTORY_PROVIDERS[]

Configuration of history storage providers for Elasticsearch or ClickHouse.

Supported configuration parameters:

• types - array of data types to be stored in the external storage;
• provider - history provider type: elasticsearch or clickhouse;
• url - history provider URL;
• db - database name (used for ClickHouse);
• username - database user (used for ClickHouse);
• password - database password (used for ClickHouse).

Examples:

// For ClickHouse:
$HISTORY_PROVIDERS[] = [
    'types' => ['uint', 'dbl', 'str', 'log', 'text', 'json'],
    'provider' => 'clickhouse',
    'url' => 'http://localhost:8123',
    'db' => 'zabbix',
    'username' => 'zabbix',
    'password' => 'zabbix'
];
// For Elasticsearch:
$HISTORY_PROVIDERS[] = [
    'types' => ['uint', 'dbl', 'str', 'log', 'text', 'json'],
    'provider' => 'elasticsearch',
    'url' => 'http://localhost:9200'
];

$SSO['SETTINGS']

Configuration settings for SAML sign-in. The $SSO['SETTINGS'] array must follow the structure expected by the SAML PHP Toolkit library (supplied with Zabbix).

Only the following options can be specified in $SSO['SETTINGS']:

• strict
• baseurl
• compress
• contactPerson
• organization
• sp (only options specified in this list)
  • attributeConsumingService
  • x509certNew
• idp (only options specified in this list)
  • singleLogoutService (only one option)
    • responseUrl
  • certFingerprint
  • certFingerprintAlgorithm
  • x509certMulti
• security (only options specified in this list)
  • signMetadata
  • wantNameId
  • requestedAuthnContext
  • requestedAuthnContextComparison
  • wantXMLValidation
  • relaxDestinationValidation
  • destinationStrictlyMatches
  • rejectUnsolicitedResponsesWithInResponseTo
  • signatureAlgorithm
  • digestAlgorithm
  • lowercaseUrlencoding

All other options are taken from the database and cannot be overridden. The debug option will be ignored.

If the Zabbix UI is behind a proxy or load balancer, the custom use_proxy_headers option can be used:

• false (default) - ignore the X-Forwarded-* HTTP headers;
• true - use the X-Forwarded-* HTTP headers to build the base URL.

For a full description of available configuration options, refer to the official library documentation.

Example:

$SSO['SETTINGS'] = [
    'security' => [
        'signatureAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384',
        'digestAlgorithm' => 'http://www.w3.org/2001/04/xmldsig-more#sha384',
        // ...
    ],
    // ...
];

$SSO['CERT_STORAGE']

Specify where SAML certificates are stored.

Default: file
Values:

• database - the private key and certificates are stored in the database;
• file - the private key and certificates are stored on the filesystem.

Example:

$SSO['CERT_STORAGE'] = 'database';

$SSO['SP_KEY']

Path to the SAML service provider (SP) private key file when the private key is stored on the filesystem.

Example:

$SSO['SP_KEY'] = 'conf/certs/sp.key';

$SSO['SP_CERT']

Path to the SAML service provider (SP) certificate file when the certificate is stored on the filesystem.

Example:

$SSO['SP_CERT'] = 'conf/certs/sp.crt';

$SSO['IDP_CERT']

Path to the SAML identity provider certificate file when the certificate is stored on the filesystem.

Example:

$SSO['IDP_CERT'] = 'conf/certs/idp.crt';

$ZBX_FEATURE_FLAGS['banners_enabled']

Enable or disable support for banners.

Default: true
Values: true - enabled, false - disabled.

$ZBX_FEATURE_FLAGS['http_auth_enabled']

Enable or disable user HTTP authentication.

Default: true
Values: true - enabled, false - disabled.

$ZBX_FEATURE_FLAGS['modules_config_enabled']

Enable or disable access to modules.

Default: true
Values: true - enabled, false - disabled.

$ZBX_FEATURE_FLAGS['media_type_denylist']

Disable editing of specific pre-configured media types.

Values: email, script, sms, webhook, push.

Example:

$ZBX_FEATURE_FLAGS['media_type_denylist'] = ['webhook','push'];

$ZBX_SERVER_TLS['ACTIVE']

Specifies whether a TLS connection between the Zabbix frontend and Zabbix server is enabled.

Default: false
Values: true - enabled, false - disabled.

$ZBX_SERVER_TLS['CA_FILE']

Path to the Certificate Authority (CA) certificate file used to verify the server certificate.

Example:

$ZBX_SERVER_TLS['CA_FILE'] = '/etc/zabbix/ssl/ca.crt';

$ZBX_SERVER_TLS['KEY_FILE']

Path to the client private key file corresponding to the client certificate used for mutual TLS authentication.

Example:

$ZBX_SERVER_TLS['KEY_FILE'] = '/etc/zabbix/ssl/frontend.key';

$ZBX_SERVER_TLS['CERT_FILE']

Path to the client certificate file when mutual TLS authentication is required.

Example:

$ZBX_SERVER_TLS['CERT_FILE'] = '/etc/zabbix/ssl/frontend.crt';

$ZBX_SERVER_TLS['CERTIFICATE_ISSUER']

Distinguished Name (DN) of the issuer to match against the server certificate.

Example:

$ZBX_SERVER_TLS['CERTIFICATE_ISSUER']  = 'CN=MyZabbixCA';

$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT']

Distinguished Name (DN) of the subject to match against the server certificate.

Example:

$ZBX_SERVER_TLS['CERTIFICATE_SUBJECT'] = 'CN=zabbix-server.example.com';