Problem

Zabbix packages contain web server configuration only for Apache (zabbix-apache-conf) and Nginx (zabbix-nginx-conf). Neither of them gets TLS certificates automatically by default. Apache needs mod_md or certbot. Nginx needs certbot or the separate ngx_http_acme_module.

Public TLS certificates are getting shorter. Under CA/Browser Forum ballot SC-081v3, the maximum validity is 200 days since 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Manual renewal of the frontend certificate will soon not be practical.

Proposal

Add a new package zabbix-caddy-conf, similar to zabbix-nginx-conf. It contains:

• a Caddyfile site block for the Zabbix frontend
• a PHP-FPM pool for the frontend

Draft files are attached.

Why Caddy

• ACME is built in and enabled by default. With a public DNS name as the site address, Caddy gets and renews the certificate and redirects HTTP to HTTPS. No certbot, no timers, no reload hooks.
• Other ACME CAs, including internal ones, can be set with the acme_ca option.
• By default only TLS 1.2 and 1.3 are allowed, and HTTP/2 and HTTP/3 are enabled.

Attached configuration

The files are based on the Nginx configuration in the official zabbix-docker repository (branch 8.0: server-common.conf, server-ssl.conf, php-fpm.d/zabbix.conf). They keep the same rules:

• deny hidden files, app/, conf/, include/, local/, locale/, vendor/ and data/top_passwords.txt
• same cache headers, request body limit (10M) and FastCGI timeouts
• PATH_INFO for api_scim.php
• same PHP values as the Docker image defaults (max_execution_time 300, memory_limit 128M, post_max_size 16M, ...)

Differences from the Nginx configuration:

• PHP-FPM /status and /ping are allowed only from localhost (in zabbix-docker they are not limited).
• No equivalent of /nginx-status, real-ip.conf and the Content-Security-Policy-Report-Only header.
• The Server header is removed and expose_php is off.

Testing

Tested on Ubuntu 24.04 with Caddy 2.11.8, PHP-FPM 8.3 and PostgreSQL 16. Frontend files and DB schema come from the release/8.0 git branch (8.0.1rc1), not from packages. Zabbix server was not running.

• setup wizard pre-requisites check: all 27 items OK
• login, dashboard and main pages (Hosts, Problems, Latest data, Configuration of hosts, System information, Modules)
• all JS/CSS files loaded by the dashboard page (including jsLoader.php) and one widget request (clock)
• API (api_jsonrpc.php) and SCIM (api_scim.php with PATH_INFO)
• blocked directories return 404, PHP-FPM status and ping only from localhost
• HTTPS with Caddy local CA: HTTP to HTTPS redirect, TLS 1.3, HTTP/2, HSTS

Not tested: certificate from a public ACME CA, installation from Zabbix packages, RHEL.

Open items

• SELinux on RHEL needs work. Caddy must be allowed to bind to ports 80/443, connect to the PHP-FPM socket and reach the ACME CA. PHP-FPM still needs the usual booleans (httpd_can_network_connect_db, httpd_can_connect_zabbix). Not checked yet.
• The PHP-FPM socket path and session directory differ by distribution (RHEL: /run/php-fpm/ and /var/lib/php/session owned by root:apache, Debian/Ubuntu: /run/php/ and /var/lib/php/sessions). In the test, these directories were created manually.
• The admin must set the site address (the same step as server_name in the Nginx package).
• If a new package is not wanted, adding this configuration to the documentation would also help.