From 0fa12940d5a65eb017e159a8f9c546dc6f6c3e4f Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Wed, 15 Jul 2026 22:30:00 -0400
Subject: [PATCH 1/4] zabbix: use separate users for server and proxy

This is the upstream recommendation, and fits with our separation
of agent and server.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
---
 admin/zabbix/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index f5693437632a6..1ccd939123371 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -192,7 +192,6 @@ define Package/zabbix-server-or-proxy/Default
     +libevent2-extra \
     +libpcre2 \
     +zlib
-  USERID:=zabbix-server=70:zabbix-server=70
 endef
 
 define Package/zabbix-proxy/Default
@@ -202,6 +201,7 @@ define Package/zabbix-proxy/Default
     @zabbix-proxy-any \
     zabbix-proxy-ssl \
     zabbix-proxy-openssl
+  USERID:=zabbix-proxy=71:zabbix-proxy=71
 endef
 
 define Package/zabbix-proxy
@@ -281,6 +281,7 @@ define Package/zabbix-server
   PROVIDES:= \
     zabbix-server-ssl \
     zabbix-server-openssl
+  USERID:=zabbix-server=70:zabbix-server=70
   VARIANT:=full
 endef
 

From 58447aaf1315cb9f2253bacfa98fbb4d4287c4d8 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Thu, 16 Jul 2026 19:47:53 -0400
Subject: [PATCH 2/4] zabbix: tweak patch agent and server patch configs

Tweak the agentd and server patch configurations and bring agentd and
server confgurations to parity.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
---
 .../patches/010-change-agentd-config.patch    | 92 ------------------
 ...agentd-tweak-config-file-for-openwrt.patch | 97 +++++++++++++++++++
 ...erver-tweak-config-file-for-openwrt.patch} | 54 ++++++-----
 3 files changed, 125 insertions(+), 118 deletions(-)
 delete mode 100644 admin/zabbix/patches/010-change-agentd-config.patch
 create mode 100644 admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch
 rename admin/zabbix/patches/{020-change-server-config.patch => 020-zabbix_server-tweak-config-file-for-openwrt.patch} (59%)

diff --git a/admin/zabbix/patches/010-change-agentd-config.patch b/admin/zabbix/patches/010-change-agentd-config.patch
deleted file mode 100644
index 7450e81e62326..0000000000000
--- a/admin/zabbix/patches/010-change-agentd-config.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From da7f1292838f087e2179705f2778f78ddd85cba8 Mon Sep 17 00:00:00 2001
-From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
-Date: Wed, 17 Dec 2025 18:28:37 -0500
-Subject: [PATCH] zabbix_agentd: Tweak config file for OpenWrt
-
-Note: original patch had no header, header added 2025-12-16, while
-bumping package version. Modified 2025-12-25. Modified 2026-01-21.
-
-1. Use syslog not a file for logging
-2. Place PidFile under /var/run/zabbix
-3. Only start passive agent by default
-4. Do not do active checks by default
-5. Use the system hostname as hostname (except on zabbix server)
-6. Include configurations under /etc/zabbix_agentd.conf.d/
-7. Drop privileges to the zabbix-agent user (instead of zabbix)
-
-Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
----
- conf/zabbix_agentd.conf | 19 +++++++------------
- 1 file changed, 7 insertions(+), 12 deletions(-)
-
---- a/conf/zabbix_agentd.conf
-+++ b/conf/zabbix_agentd.conf
-@@ -3,12 +3,11 @@
- 
- ############ GENERAL PARAMETERS #################
- 
--### Option: PidFile
--#	Name of PID file.
--#
--# Mandatory: no
--# Default:
--# PidFile=/tmp/zabbix_agentd.pid
-+# Zabbix always creates a PidFile. Make sure it is where we want it.
-+PidFile=/var/run/zabbix-agent/zabbix_agentd.pid
-+
-+# use syslog
-+LogType=system
- 
- ### Option: LogType
- #	Specifies where log messages are written to:
-@@ -27,8 +26,6 @@
- # Default:
- # LogFile=
- 
--LogFile=/tmp/zabbix_agentd.log
--
- ### Option: LogFileSize
- #	Maximum size of log file in MB.
- #	0 - disable automatic log rotation.
-@@ -136,6 +133,7 @@ Server=127.0.0.1
- # Range: 0-100
- # Default:
- # StartAgents=10
-+StartAgents=1
- 
- ##### Active checks related
- 
-@@ -166,8 +164,6 @@ Server=127.0.0.1
- # Default:
- # ServerActive=
- 
--ServerActive=127.0.0.1
--
- ### Option: Hostname
- #	List of comma delimited unique, case sensitive hostnames.
- #	Required for active checks and must match hostnames as configured on the server.
-@@ -177,8 +173,6 @@ ServerActive=127.0.0.1
- # Default:
- # Hostname=
- 
--Hostname=Zabbix server
--
- ### Option: HostnameItem
- #	Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
- #	Does not support UserParameters or aliases.
-@@ -317,7 +311,7 @@ Hostname=Zabbix server
- #
- # Mandatory: no
- # Default:
--# User=zabbix
-+User=zabbix-agent
- 
- ####### USER-DEFINED MONITORED PARAMETERS #######
- 
-@@ -547,5 +541,5 @@ Hostname=Zabbix server
- # Include=
- 
- # Include=/usr/local/etc/zabbix_agentd.userparams.conf
--# Include=/usr/local/etc/zabbix_agentd.conf.d/
- # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
-+Include=/etc/zabbix_agentd.conf.d/
diff --git a/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch
new file mode 100644
index 0000000000000..b95cf71803ae1
--- /dev/null
+++ b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch
@@ -0,0 +1,97 @@
+From 502248599bfc0b36daf0f8dd83bee5bc6e1b24e4 Mon Sep 17 00:00:00 2001
+From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
+Date: Wed, 17 Dec 2025 18:28:37 -0500
+Subject: zabbix_agentd: tweak config file for OpenWrt
+
+Note: original patch had no header, header added 2025-12-16, while
+bumping package version. Modified 2025-12-25. Modified 2026-01-21.
+Tweaked further 2026-07-16.
+
+1. Use syslog not a file for logging.
+2. Place PidFile under /var/run/zabbix-agent.
+3. Only start 1 passive agent by default.
+4. Do not do active checks by default.
+5. Use the system hostname as hostname.
+6. If started as root, drop privileges to the zabbix-agent user, not
+   a shared (with server and proxy) zabbix user or root, per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation
+7. Include configuration files under /etc/zabbix_agentd.conf.d/.
+8. Require configurations under /etc/zabbix_agent.conf.d/ end in .conf.
+   (other files are ignored for configuration purposes).
+
+Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
+---
+ conf/zabbix_agentd.conf | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/conf/zabbix_agentd.conf
++++ b/conf/zabbix_agentd.conf
+@@ -10,6 +10,9 @@
+ # Default:
+ # PidFile=/tmp/zabbix_agentd.pid
+ 
++# Zabbix always creates a PidFile. Make sure it is where we want it.
++PidFile=/var/run/zabbix-agent/zabbix_agentd.pid
++
+ ### Option: LogType
+ #	Specifies where log messages are written to:
+ #		system  - syslog
+@@ -20,6 +23,9 @@
+ # Default:
+ # LogType=file
+ 
++# Use syslog
++LogType=system
++
+ ### Option: LogFile
+ #	Log file name for LogType 'file' parameter.
+ #
+@@ -27,7 +33,7 @@
+ # Default:
+ # LogFile=
+ 
+-LogFile=/tmp/zabbix_agentd.log
++# LogFile=/tmp/zabbix_agentd.log
+ 
+ ### Option: LogFileSize
+ #	Maximum size of log file in MB.
+@@ -136,6 +142,7 @@ Server=127.0.0.1
+ # Range: 0-100
+ # Default:
+ # StartAgents=10
++StartAgents=1
+ 
+ ##### Active checks related
+ 
+@@ -166,7 +173,7 @@ Server=127.0.0.1
+ # Default:
+ # ServerActive=
+ 
+-ServerActive=127.0.0.1
++# ServerActive=127.0.0.1
+ 
+ ### Option: Hostname
+ #	List of comma delimited unique, case sensitive hostnames.
+@@ -177,7 +184,7 @@ ServerActive=127.0.0.1
+ # Default:
+ # Hostname=
+ 
+-Hostname=Zabbix server
++# Hostname=Zabbix server
+ 
+ ### Option: HostnameItem
+ #	Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
+@@ -318,6 +325,7 @@ Hostname=Zabbix server
+ # Mandatory: no
+ # Default:
+ # User=zabbix
++User=zabbix-agent
+ 
+ ####### USER-DEFINED MONITORED PARAMETERS #######
+ 
+@@ -549,3 +557,4 @@ Hostname=Zabbix server
+ # Include=/usr/local/etc/zabbix_agentd.userparams.conf
+ # Include=/usr/local/etc/zabbix_agentd.conf.d/
+ # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
++Include=/etc/zabbix_agentd.conf.d/*.conf
diff --git a/admin/zabbix/patches/020-change-server-config.patch b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
similarity index 59%
rename from admin/zabbix/patches/020-change-server-config.patch
rename to admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
index d9251d5c094fc..04f8b5684d932 100644
--- a/admin/zabbix/patches/020-change-server-config.patch
+++ b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
@@ -1,21 +1,28 @@
-From ca45744e63b957d83cdbc2a28588077cbf8b5639 Mon Sep 17 00:00:00 2001
+From 6655a1f2e5bff8d0082f41cf2711339f0d75d788 Mon Sep 17 00:00:00 2001
 From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
 Date: Wed, 17 Dec 2025 06:39:16 -0500
-Subject: [PATCH] Make zabbix_server config suitable for OpenWrt
+Subject: zabbix_server: tweak config file for OpenWrt
 
-1. Log to (default ephemeral) syslog, not a file (and don't rotate)
+Created 2025-12-17. Updated 2026-07-16.
+
+1. Log to syslog, not a file.
 2. Update PidFile path so correct permissions can be set for access by
-   Zabbix server running without privileges
+   Zabbix server running without privileges.
 3. If started as root, drop privileges to zabbix-server user (instead of
-   zabbix)
-4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin)
-5. Configure fping as the ipv6 fping as well
-6. For privacy, disable the public API call to check Zabbix version
+   zabbix user shared with agent and proxy, or root) per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation.
+4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin).
+5. Configure fping as the ipv6 fping as well.
+6. For privacy, disable the public API call to check Zabbix version.
+7. Include configurations under /etc/zabbix_server.conf.d/.
+8. Require configurations under /etc/zabbix_server.conf.d/ end in .conf
+   (other files are ignored for configuration purposes).
 
 Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
 ---
- conf/zabbix_server.conf | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
+ conf/zabbix_server.conf | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
 
 --- a/conf/zabbix_server.conf
 +++ b/conf/zabbix_server.conf
@@ -36,15 +43,7 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: LogFileSize
  #	Maximum size of log file in MB.
-@@ -45,6 +46,7 @@ LogFile=/tmp/zabbix_server.log
- # Range: 0-1024
- # Default:
- # LogFileSize=1
-+LogFileSize=0
- 
- ### Option: DebugLevel
- #	Specifies debug level:
-@@ -67,6 +69,10 @@ LogFile=/tmp/zabbix_server.log
+@@ -67,6 +68,10 @@ LogFile=/tmp/zabbix_server.log
  # Default:
  # PidFile=/tmp/zabbix_server.pid
  
@@ -55,11 +54,10 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  ### Option: SocketDir
  #	IPC socket directory.
  #		Directory to store IPC sockets used by internal Zabbix services.
-@@ -610,7 +616,7 @@ Timeout=4
- #
+@@ -611,6 +616,7 @@ Timeout=4
  # Mandatory: no
  # Default:
--# FpingLocation=/usr/sbin/fping
+ # FpingLocation=/usr/sbin/fping
 +FpingLocation=/usr/bin/fping
  
  ### Option: Fping6Location
@@ -72,16 +70,15 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: SSHKeyLocation
  #	Location of public and private keys for SSH checks and actions.
-@@ -698,7 +705,7 @@ LogSlowQueries=3000
- #
+@@ -699,6 +706,7 @@ LogSlowQueries=3000
  # Mandatory: no
  # Default:
--# User=zabbix
+ # User=zabbix
 +User=zabbix-server
  
  ### Option: SSLCertLocation
  #	Location of SSL client certificates.
-@@ -1050,7 +1057,7 @@ EnableGlobalScripts=0
+@@ -1050,7 +1058,7 @@ EnableGlobalScripts=0
  #
  # Mandatory: no
  # Default:
@@ -90,3 +87,8 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: SMSDevices
  #	List of comma delimited modem files allowed to use Zabbix server
+@@ -1125,3 +1133,4 @@ EnableGlobalScripts=0
+ # Include=/usr/local/etc/zabbix_server.general.conf
+ # Include=/usr/local/etc/zabbix_server.conf.d/
+ # Include=/usr/local/etc/zabbix_server.conf.d/*.conf
++Include=/etc/zabbix_server.conf.d/*.conf

From 6e405812658d54c9c501529e2362c2542da98e5f Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Thu, 16 Jul 2026 20:21:41 -0400
Subject: [PATCH 3/4] zabbix: tweak server initscript and bring agentd to
 parity

* Genericize zabbix_server initscript.
* Add shellcheck overrides where needed.
* Add a 'never_root' config option (default true) that determines
  whether server starts as an unprivileged user or starts as root and
  drops to an unprivileged user (unless config is changed so it always
  runs as root).
* Bring zabbix_agentd initscript to parity with zabbix_server for the
  initscript and configuration.
* Tweak Makefile to reduce repetition

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
---
 admin/zabbix/Makefile                     | 23 +++++++++-----
 admin/zabbix/files/zabbix_agentd.config   |  4 +++
 admin/zabbix/files/zabbix_agentd.defaults |  3 ++
 admin/zabbix/files/zabbix_agentd.init     | 38 +++++++++++++++++++----
 admin/zabbix/files/zabbix_server.config   |  1 +
 admin/zabbix/files/zabbix_server.init     | 19 +++++++++---
 6 files changed, 69 insertions(+), 19 deletions(-)
 create mode 100644 admin/zabbix/files/zabbix_agentd.config
 create mode 100644 admin/zabbix/files/zabbix_agentd.defaults

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index 1ccd939123371..b350f0125f470 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zabbix
 PKG_VERSION:=7.0.28
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \
@@ -493,6 +493,13 @@ endef
 
 define Package/zabbix-agentd/conffiles
 /etc/zabbix_agentd.conf
+/etc/config/zabbix_agentd
+endef
+
+define Package/zabbix-agentd/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_agentd) && rm -f /etc/uci-defaults/90_zabbix_agentd
+exit 0
 endef
 
 define Package/zabbix-agentd/install
@@ -500,17 +507,17 @@ define Package/zabbix-agentd/install
 	$(call Package/zabbix/install/sbin,$(1),agentd)
 	$(call Package/zabbix/install/etc,$(1),agentd)
 	$(call Package/zabbix/install/init.d,$(1),agentd)
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/zabbix_agentd.config $(1)/etc/config/zabbix_agentd
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/zabbix_agentd.defaults $(1)/etc/uci-defaults/90_zabbix_agentd
 endef
 
-define Package/zabbix-agentd-basic/conffiles
-/etc/zabbix_agentd.conf
-endef
+Package/zabbix-agentd-basic/conffiles=$(call Package/zabbix-agentd/conffiles)
+Package/zabbix-agentd-basic/postinst=$(call Package/zabbix-agentd/postinst)
 
 define Package/zabbix-agentd-basic/install
-	$(INSTALL_DIR) $(1)/etc/zabbix_agentd.conf.d
-	$(call Package/zabbix/install/sbin,$(1),agentd)
-	$(call Package/zabbix/install/etc,$(1),agentd)
-	$(call Package/zabbix/install/init.d,$(1),agentd)
+	$(call Package/zabbix-agentd/install,$(1))
 endef
 
 define Package/zabbix-proxy/conffiles
diff --git a/admin/zabbix/files/zabbix_agentd.config b/admin/zabbix/files/zabbix_agentd.config
new file mode 100644
index 0000000000000..9f38a26c71f09
--- /dev/null
+++ b/admin/zabbix/files/zabbix_agentd.config
@@ -0,0 +1,4 @@
+
+config zabbix_agentd 'general'
+    option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_agentd.defaults b/admin/zabbix/files/zabbix_agentd.defaults
new file mode 100644
index 0000000000000..601eb5daa2c3d
--- /dev/null
+++ b/admin/zabbix/files/zabbix_agentd.defaults
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+chown zabbix-agent:zabbix-agent /etc/zabbix_agentd.conf
diff --git a/admin/zabbix/files/zabbix_agentd.init b/admin/zabbix/files/zabbix_agentd.init
index 04bef3730d3a6..eb2b0d830bda3 100755
--- a/admin/zabbix/files/zabbix_agentd.init
+++ b/admin/zabbix/files/zabbix_agentd.init
@@ -1,26 +1,52 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2008-2011 OpenWrt.org
 
+# shellcheck shell=busybox
+
+# shellcheck disable=SC2034
 START=60
 
+# shellcheck disable=SC2034
 USE_PROCD=1
-PROG=/usr/sbin/zabbix_agentd
-CONFIG=/etc/zabbix_agentd.conf
+NAME=zabbix_agentd
+PROG=/usr/sbin/${NAME}
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-agent
 
 start_service() {
+	local enabled never_root
+
 	# Sometimes the agentd config was installed in /etc/zabbix/zabbix_agentd.conf
 	[ -f /etc/zabbix/zabbix_agentd.conf ] && mv /etc/zabbix/zabbix_agentd.conf ${CONFIG}
 
-	[ -f ${CONFIG} ] || return 1
+	if [ ! -f "${CONFIG}" ]; then
+		logger "Configuration file not found: '${CONFIG}'"
+		return 1
+	fi
+
+	# Get enabled config option
+	config_load "$NAME"
+	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
 
-	mkdir -p /var/run/zabbix-agent
-	chown zabbix-agent:zabbix-agent /var/run/zabbix-agent
+	# shellcheck disable=SC2154
+	if [ "$enabled" -eq 0 ]; then
+		logger "service not enabled in $UCI_CONFIG"
+		return 1
+	fi
+
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
 
 	procd_open_instance
 	procd_set_param command ${PROG} -c ${CONFIG} -f
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
+	procd_set_param file ${CONFIG}
 	procd_set_param respawn
 	procd_set_param stdout 1
 	procd_set_param stderr 1
 	procd_close_instance
 }
-
diff --git a/admin/zabbix/files/zabbix_server.config b/admin/zabbix/files/zabbix_server.config
index 45e3f3062b0ab..c6fceba4d0a38 100644
--- a/admin/zabbix/files/zabbix_server.config
+++ b/admin/zabbix/files/zabbix_server.config
@@ -1,3 +1,4 @@
 
 config zabbix_server 'general'
     option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_server.init b/admin/zabbix/files/zabbix_server.init
index bcbdb41cd7d7e..a2454697663fd 100755
--- a/admin/zabbix/files/zabbix_server.init
+++ b/admin/zabbix/files/zabbix_server.init
@@ -1,6 +1,8 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2008-2025 OpenWrt.org
 
+# shellcheck shell=busybox
+
 # shellcheck disable=SC2034
 START=59
 
@@ -9,9 +11,13 @@ USE_PROCD=1
 
 NAME=zabbix_server
 PROG=/usr/sbin/${NAME}
-CONFIG=/etc/zabbix_server.conf
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-server
 
 start_service() {
+	local enabled never_root
+
 	if [ ! -f "${CONFIG}" ]; then
 		logger "Configuration file not found: '${CONFIG}'"
 		return 1
@@ -20,19 +26,22 @@ start_service() {
 	# Get enabled config option
 	config_load "$NAME"
 	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
 
 	# shellcheck disable=SC2154
 	if [ "$enabled" -eq 0 ]; then
-		logger "service not enabled in /etc/config/$NAME"
+		logger "service not enabled in $UCI_CONFIG"
 		return 1
 	fi
 
-	mkdir -p /var/run/zabbix-server
-	chown zabbix-server:zabbix-server /var/run/zabbix-server
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
 
 	procd_open_instance
 	procd_set_param command ${PROG} -c ${CONFIG} -f
-	procd_set_param user zabbix-server
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
 	procd_set_param limits nofile="16384 100000"
 	procd_set_param file ${CONFIG}
 	procd_set_param respawn

From fb2e60902b281dc33e0d83510178200df9dda137 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Thu, 16 Jul 2026 21:01:36 -0400
Subject: [PATCH 4/4] zabbix: bring proxy to parity with server and agentd

* Add config file patch for proxy
* Add initscript for proxy
* Update Makefile and support files to bring proxy to parity with
  agentd and server.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
---
 admin/zabbix/Makefile                         | 23 +++--
 admin/zabbix/files/zabbix_proxy.config        |  4 +
 admin/zabbix/files/zabbix_proxy.defaults      |  3 +
 admin/zabbix/files/zabbix_proxy.init          | 50 ++++++++++
 ..._proxy-tweak-config-file-for-openwrt.patch | 98 +++++++++++++++++++
 5 files changed, 171 insertions(+), 7 deletions(-)
 create mode 100644 admin/zabbix/files/zabbix_proxy.config
 create mode 100644 admin/zabbix/files/zabbix_proxy.defaults
 create mode 100755 admin/zabbix/files/zabbix_proxy.init
 create mode 100644 admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index b350f0125f470..f7aec9383a8f8 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -454,7 +454,7 @@ define Build/Configure
 	$(call Build/Configure/Default)
 endef
 
-# We use spaces for continued lines so that is if continuation does not parse
+# We use spaces for continued lines so that if continuation does not parse
 # properly we will get a hard error instead of subtle failure.
 define Build/Compile
 	$(call Build/Compile/Default)
@@ -522,22 +522,31 @@ endef
 
 define Package/zabbix-proxy/conffiles
 /etc/zabbix_proxy.conf
+/etc/config/zabbix_proxy
+endef
+
+define Package/zabbix-proxy/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_proxy) && rm -f /etc/uci-defaults/90_zabbix_proxy
+exit 0
 endef
 
 define Package/zabbix-proxy/install
 	$(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d
 	$(call Package/zabbix/install/sbin,$(1),proxy)
 	$(call Package/zabbix/install/etc,$(1),proxy)
+	$(call Package/zabbix/install/init.d,$(1),proxy)
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/zabbix_proxy.config $(1)/etc/config/zabbix_proxy
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/zabbix_proxy.defaults $(1)/etc/uci-defaults/90_zabbix_proxy
 endef
 
-define Package/zabbix-proxy-basic-sqlite/conffiles
-/etc/zabbix_proxy.conf
-endef
+Package/zabbix-proxy-basic-sqlite/conffiles=$(call Package/zabbix-proxy/conffiles)
+Package/zabbix-proxy-basic-sqlite/postinst=$(call Package/zabbix-proxy/postinst)
 
 define Package/zabbix-proxy-basic-sqlite/install
-	$(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d
-	$(call Package/zabbix/install/sbin,$(1),proxy)
-	$(call Package/zabbix/install/etc,$(1),proxy)
+	$(call Package/zabbix-proxy/install,$(1))
 endef
 
 define Package/zabbix-server/conffiles
diff --git a/admin/zabbix/files/zabbix_proxy.config b/admin/zabbix/files/zabbix_proxy.config
new file mode 100644
index 0000000000000..8464b009855c8
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.config
@@ -0,0 +1,4 @@
+
+config zabbix_proxy 'general'
+    option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_proxy.defaults b/admin/zabbix/files/zabbix_proxy.defaults
new file mode 100644
index 0000000000000..346814c3feb2f
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.defaults
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+chown zabbix-proxy:zabbix-proxy /etc/zabbix_proxy.conf
diff --git a/admin/zabbix/files/zabbix_proxy.init b/admin/zabbix/files/zabbix_proxy.init
new file mode 100755
index 0000000000000..9939f80569203
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.init
@@ -0,0 +1,50 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2008-2025 OpenWrt.org
+
+# shellcheck shell=busybox
+
+# shellcheck disable=SC2034
+START=59
+
+# shellcheck disable=SC2034
+USE_PROCD=1
+
+NAME=zabbix_proxy
+PROG=/usr/sbin/${NAME}
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-proxy
+
+start_service() {
+	local enabled never_root
+
+	if [ ! -f "${CONFIG}" ]; then
+		logger "Configuration file not found: '${CONFIG}'"
+		return 1
+	fi
+
+	# Get enabled config option
+	config_load "$NAME"
+	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
+
+	# shellcheck disable=SC2154
+	if [ "$enabled" -eq 0 ]; then
+		logger "service not enabled in $UCI_CONFIG"
+		return 1
+	fi
+
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
+
+	procd_open_instance
+	procd_set_param command ${PROG} -c ${CONFIG} -f
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
+	procd_set_param file ${CONFIG}
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
diff --git a/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch
new file mode 100644
index 0000000000000..cd1abd201b8c1
--- /dev/null
+++ b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch
@@ -0,0 +1,98 @@
+From c03db1c64e218fb2ef469ddb9705eff9f9d493e1 Mon Sep 17 00:00:00 2001
+From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
+Date: Thu, 16 Jul 2026 18:58:26 -0400
+Subject: zabbix_proxy: tweak config file for OpenWrt
+
+Created 2026-07-16.
+
+1. Use passive proxy mode by default (in keeping with agentd defaults).
+2. Use system hostname as system hostname not 'Zabbix proxy'.
+3. Log to syslog, not a file.
+4. Update PidFile path so correct permissions can be set for access by
+   Zabbix proxy running without privileges.
+5. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin).
+6. Configure fping as the ipv6 fping as well.
+7. If started as root, drop privileges to zabbix-proxy user (instead of
+   zabbix user shared with agent and server, or root) per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation.
+8. Include configurations under /etc/zabbix_proxy.conf.d/.
+9. Require configurations under /etc/zabbix_proxy.conf.d/ end in .conf
+   (other files are ignored for configuration purposes).
+---
+ conf/zabbix_proxy.conf | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/conf/zabbix_proxy.conf
++++ b/conf/zabbix_proxy.conf
+@@ -11,6 +11,7 @@
+ # Mandatory: no
+ # Default:
+ # ProxyMode=0
++ProxyMode=1
+ 
+ ### Option: Server
+ #	If ProxyMode is set to active mode:
+@@ -39,7 +40,7 @@ Server=127.0.0.1
+ # Default:
+ # Hostname=
+ 
+-Hostname=Zabbix proxy
++# Hostname=Zabbix proxy
+ 
+ ### Option: HostnameItem
+ #	Item used for generating Hostname if it is undefined.
+@@ -73,6 +74,7 @@ Hostname=Zabbix proxy
+ # Mandatory: no
+ # Default:
+ # LogType=file
++LogType=system
+ 
+ ### Option: LogFile
+ #	Log file name for LogType 'file' parameter.
+@@ -81,7 +83,7 @@ Hostname=Zabbix proxy
+ # Default:
+ # LogFile=
+ 
+-LogFile=/tmp/zabbix_proxy.log
++# LogFile=/tmp/zabbix_proxy.log
+ 
+ ### Option: LogFileSize
+ #	Maximum size of log file in MB.
+@@ -130,6 +132,7 @@ LogFile=/tmp/zabbix_proxy.log
+ # Mandatory: no
+ # Default:
+ # PidFile=/tmp/zabbix_proxy.pid
++PidFile=/var/run/zabbix-proxy/zabbix_proxy.pid
+ 
+ ### Option: SocketDir
+ #	IPC socket directory.
+@@ -613,6 +616,7 @@ Timeout=4
+ # Mandatory: no
+ # Default:
+ # FpingLocation=/usr/sbin/fping
++FpingLocation=/usr/bin/fping
+ 
+ ### Option: Fping6Location
+ #	Location of fping6.
+@@ -622,6 +626,7 @@ Timeout=4
+ # Mandatory: no
+ # Default:
+ # Fping6Location=/usr/sbin/fping6
++Fping6Location=
+ 
+ ### Option: SSHKeyLocation
+ #	Location of public and private keys for SSH checks and actions.
+@@ -667,6 +672,7 @@ LogSlowQueries=3000
+ # Mandatory: no
+ # Default:
+ # User=zabbix
++User=zabbix-proxy
+ 
+ ### Option: SSLCertLocation
+ #	Location of SSL client certificates.
+@@ -1051,3 +1057,4 @@ StatsAllowedIP=127.0.0.1
+ # Include=/usr/local/etc/zabbix_proxy.general.conf
+ # Include=/usr/local/etc/zabbix_proxy.conf.d/
+ # Include=/usr/local/etc/zabbix_proxy.conf.d/*.conf
++Include=/etc/zabbix_proxy.conf.d/*.conf