zabbix: bring to parity between agent, server, and proxy; and do some cleanup

[danielfdickinson]

📦 Package Details

Maintainer: @danielfdickinson

Description:

• Update to latest LTS. See release notes: https://www.zabbix.com/rn/rn7.0.28
• Use separate users for server and proxy. This is the upstream recommendation, and
  fits with our seperation of agent and server.
• Tweak the agentd and server patch configuration and bring agentd and
  server confgurations to parity.
• Tweak server initscript and bring agentd to parity
  • Genericize zabbix_server initscript.
  • Add shellcheck overrides where needed.
  • Add a 'never_root' config option (default true) that determines
    whether server starts as an unprivileged user or starts as root and
    drops to an unprivileged user (unless config is changed so it always
    runs as root).
  • Bring zabbix_agentd initscript to parity with zabbix_server for the
    initscript and configuration.
  • Tweak Makefile to reduce repetition
• Bring proxy to parity with server and agentd
  • Add config file patch for proxy
  • Add initscript for proxy
  • Update Makefile and support files to bring proxy to parity with
    agentd and server.
• Preserve user config files across sysupgrade
• Move agentd openwrt-supplied params to separated dir
• stop shipping sysctld conf in package
• add php8-mod-simplexml dependency to frontend

---

🧪 Run Testing Details

• OpenWrt Version: OpenWrt SNAPSHOT r35362-9e43544bc6
• OpenWrt Target/Subtarget: bcm27xx/bcm2712
• OpenWrt Device: Raspberry Pi 5 Model B Rev 1.0

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

• It can be applied using git am
• It has been refreshed to avoid offsets, fuzzes, etc., using

  make package/<your-package>/refresh V=s

• It is structured in a way that it is potentially upstreamable
  N/A: OpenWrt-specific configuration tweaks

[danielfdickinson]

Oh dear, I've confused the bot with the sed scripts.

[openwrt-ai]

Reviewed the sed-script conversion and proxy additions. Two functional issues flagged inline (both in the "replace conf file patches with sed scripts" commit); the commit messages themselves accurately describe their changes.

---

Generated by Claude Code

[danielfdickinson]

@BKPepe More files/* issues 🤷 Do you want me to create another issue, as suggested at the bottom of the comment, or is this enough for you?

[BKPepe]

I think just put this into the conffiles and you dont need to use keep.d, right?

[danielfdickinson]

Hmmm... I thought conffiles had to be files not directories. Will test.

[BKPepe]

afaik it works with directories as well. :) We can document it somewhere, if it isnt.

[BKPepe]

Once you confirm that conffiles works for directories as well, I’ll update the bot to recommend using conffiles instead. This will also fix the false positive where it flags things not strictly meant for /etc/config.

Well, new feature. It's a bit cheeky, but we'll fine-tune it

[danielfdickinson]

I can confirm directories in conffiles are preserved.

[danielfdickinson]

Built while I slept. Will run-test when I am back from work this evening.

[danielfdickinson]

@BKPepe Would you prefer this split into two or three PRs? The commits are reasonably atomic, so I don't think a split is required, but I thought I would ask, despite the fact that waiting for PRs to clear is a pain.

[openwrt-ai]

Re-reviewed at head after the restructure from sed-scripts back to config patches (9 commits since my last review). Each commit message matches its diff, the three USERIDs and per-service conf.d dirs line up, and the sysctl removal is consistent across file/install/conffiles. One minor parity nit left inline.

---

Generated by Claude Code

[openwrt-ai]

nit: This commit brings agentd to parity with zabbix_server, but the agentd instance omits procd_set_param file ${CONFIG}, which both zabbix_server.init:45 and zabbix_proxy.init:44 set. Without it procd won't track the config file, so editing /etc/zabbix_agentd.conf and running reload won't restart the agent. If the omission is intentional, ignore; otherwise:

Suggested change

	procd_set_param respawn
	procd_set_param file ${CONFIG}
	procd_set_param respawn

---

Generated by Claude Code

[danielfdickinson]

Fixed this is #30026 where these changes now live.

[danielfdickinson]

Have split into #30025, #30026, and #30027. Therefore closing this 'omnibus' PR.

[BKPepe]

@BKPepe Would you prefer this split into two or three PRs? The commits are reasonably atomic, so I don't think a split is required, but I thought I would ask, despite the fact that waiting for PRs to clear is a pain.

Oh, that's up to you, but from my point of view, it is always better to have it splitted.