Single server, secure and insecure frontend..

[albatrosdk]

Hiya,
I'm looking into setting up a Zabbix installation where we have 2 web frontends, one is on the internal network and can be used by admins to work in zabbix, and the other is in a DMZ behind a reverse proxy with the sole purpose of enabling external users(smartphone apps) to get alerts etc. and look at the dashboard.
The insecure frontend will probably have to have it's own database, since it won't be able to access the internal network at all. I've tried figuring out if database replication(postgres) is the way to go, but it doesn't look feasible.
Is there a way to i.e. get an active proxy to send it's gathered data to two zabbix servers(as one-way communication), or get the master zabbix server to replicate it's data to the zabbix server in the DMZ(also strictly one-way), without the server in the DMZ getting access to the internal network?

Any hints and suggestions are most welcome.

Thanks,

[cyber]

You could create one way replication but your "outside" DB cannot be read-only, if you want to use Zabbix UI, as frontend also wants to write things there (audit logs etc)
Maybe you can have a grafana instance outside for dashboards... That does not need writing to DB, so you can point it to your read-only DB replica... And based on the user, what you use for integration, you can restrict, what is seen outside...
Maybe you can think of pushing some data to outside (Redis ??), what is needed for certain graphs, dashboards and have completely separate solution (not Zabbix).? I have seen one such solution once, but it was quite limited scope (maybe 20-30 hosts) and custom webpage solution. Data was pushed out to Redis every couple of minutes and custom webpage used it to draw needed dashboard. So it was completely "one way". But there is nothing you can use "out-of-the-box" for this... its all custom..

[cyber]

You could create one way replication but your "outside" DB cannot be read-only, if you want to use Zabbix UI, as frontend also wants to write things there (audit logs etc)
Maybe you can have a grafana instance outside for dashboards... That does not need writing to DB, so you can point it to your read-only DB replica... And based on the user, what you use for integration, you can restrict, what is seen outside...
Maybe you can think of pushing some data to outside (Redis ??), what is needed for certain graphs, dashboards and have completely separate solution (not Zabbix).? I have seen one such solution once, but it was quite limited scope (maybe 20-30 hosts) and custom webpage solution. Data was pushed out to Redis every couple of minutes and custom webpage used it to draw needed dashboard. So it was completely "one way". But there is nothing you can use "out-of-the-box" for this... its all custom..

[tim.mooney]

I had the same thoughts that cyber had when I saw your initial request. My idea was to just build a very simple status page on the DMZ host that used API calls back to the internal front-end to get the status for a subset of systems. You would want to have an "api user" that has read-only access to just the hosts you want to report on, and it would require that you allow inbound access to the API part of the front-end, which may make it unworkable for your needs.

I also didn't think about having graphs for any of the hosts (just high level overview "status blocks").

In general, I think cyber's approach is the better one. I agree that to do what you really want, you're probably going to need to build the DMZ part using other tools, and just push or export some subset of data to those tools.

If you build something you're happy with, please follow-up on these forums and let people know what you did, what components are involved, and how it's working. It's an interesting problem, seeing your solution to it would certainly be beneficial to others.

[albatrosdk]

Thanks guys, your input is much appreciated.

Any pointers as to how to set up the replication? As mentioned, db replication might bring it's own issues -well at least for PG streaming WAL, since it likes the replica to be able to connect to the primary.
I haven't had much luck searching the forums or using search engines..

TIA,

/tony

[cyber]

https://pg-auto-failover.readthedocs.io/en/main/architecture-multi-standby.html#sample-architecture-with-three-standby-nodes-one-async

Example is about multiple standby-s, but it also shows the one, which is "outside" and will never used for failover ...

[albatrosdk]

Thanks guys. Your input is much appreciated.
Sorry for not getting back to you sooner, too much to do and too little time..

I'll give it a try using cyber's link to a guide.

/tony