Zabbix 7.0 LTS sobre Proxmox — de la plantilla al primer host monitoreado

qm list | awk 'NR==1 || /template/ || /ubuntu.*24|ubuntu2404|cloudinit/i'

# Clon "linked" (rápido, comparte disco base) desde snapshot de la plantilla.
# Si tu plantilla no tiene snapshot, usa "full" en vez de "linked".
qm clone 9000 230 \
  --name zbx-lab \
  --description "Zabbix 7.0 LTS server · Ubuntu 24.04 · lab Harper" \
  --full 0 --pool lab

# Recursos: 2 vCPU + 4 GB RAM. Disco a 40 GB (crece si el cliente monitorea muchos hosts).
qm set 230 --cores 2 --sockets 1 --cpu host --memory 4096 --balloon 0
qm resize 230 scsi0 40G

# Configurar el cloud-init (usuario, llave SSH, red estática).
# El password es de emergencia — el acceso real es por llave SSH.
qm set 230 \
  --ciuser rbatista \
  --sshkeys ~/.ssh/dojo_authorized_keys \
  --ipconfig0 ip=192.168.0.230/24,gw=192.168.0.1 \
  --nameserver "192.168.0.1 1.1.1.1" \
  --searchdomain lab.harper.local

# Regenerar la imagen cloud-init (si no, los cambios no se aplican al primer boot).
qm cloudinit update 230

# Configurar arranque al boot del host + iniciar.
qm set 230 --onboot 1
qm start 230

# Esperar al agent (cloud-init tarda ~40-60s el primer boot).
until qm agent 230 ping 2>/dev/null; do echo "esperando cloud-init..."; sleep 5; done
qm agent 230 network-get-interfaces | jq -r '.[] | select(.name!="lo").["ip-addresses"][]?."ip-address"'

ssh rbatista@192.168.0.230 "hostnamectl; lsb_release -d; ip -brief a; uptime"

sudo hostnamectl set-hostname zbx-lab.lab.harper.local
sudo timedatectl set-timezone America/Santo_Domingo

# Verificar
hostnamectl
timedatectl

sudo apt update
sudo DEBIAN_FRONTEND=noninteractive apt -y full-upgrade
sudo apt -y install curl wget gnupg2 lsb-release ca-certificates \
  ufw fail2ban unattended-upgrades chrony jq htop net-tools bash-completion

# Si actualizó el kernel: reiniciar.
[ -f /var/run/reboot-required ] && sudo reboot

echo "rbatista ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/90-rbatista
sudo chmod 440 /etc/sudoers.d/90-rbatista
sudo visudo -c   # valida sintaxis; debe decir "parsed OK"

sudo tee /etc/ssh/sshd_config.d/50-harper.conf >/dev/null <<'EOF'
# --- Harper SSH hardening baseline ---
PasswordAuthentication no
PermitRootLogin no
KbdInteractiveAuthentication no
MaxAuthTries 3
LoginGraceTime 30
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
EOF

sudo sshd -t && sudo systemctl reload ssh

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw --force enable
sudo ufw status verbose

sudo install -d /usr/share/postgresql-common/pgdg
sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc \
  --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc

echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] \
https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | \
  sudo tee /etc/apt/sources.list.d/pgdg.list

sudo apt update
sudo apt -y install postgresql-16 postgresql-contrib-16

systemctl status postgresql --no-pager
sudo -u postgres psql -c "select version();"

sudo tee /etc/postgresql/16/main/conf.d/50-harper-zabbix.conf >/dev/null <<'EOF'
# --- Harper baseline para Zabbix 7.0 (VM 4 GB RAM) ---
listen_addresses = 'localhost'
shared_buffers = 1GB              # ~25% de RAM
effective_cache_size = 3GB        # ~75% de RAM
work_mem = 16MB                   # por operación de sort
maintenance_work_mem = 256MB
wal_buffers = 16MB
checkpoint_completion_target = 0.9
random_page_cost = 1.1            # asumimos SSD
max_connections = 100

timezone = 'UTC'                  # requisito Zabbix
log_timezone = 'UTC'
EOF

# Debe estar en UTC — Zabbix guarda todo en UTC y convierte en el frontend.
sudo systemctl restart postgresql
sudo -u postgres psql -c "show timezone;"

# Generar 32 caracteres random URL-safe.
ZBX_DB_PASS="$(openssl rand -base64 32 | tr -d '=+/' | cut -c1-32)"

# Guardar para uso futuro (backups, upgrades) — solo root.
echo "$ZBX_DB_PASS" | sudo tee /root/.zabbix-db-pass >/dev/null
sudo chmod 600 /root/.zabbix-db-pass
echo "Password guardado en /root/.zabbix-db-pass"

sudo -u postgres psql <<EOF
CREATE USER zabbix WITH PASSWORD '$(sudo cat /root/.zabbix-db-pass)';
CREATE DATABASE zabbix
  OWNER zabbix
  ENCODING 'UTF8'
  LC_COLLATE 'C'
  LC_CTYPE 'C'
  TEMPLATE template0;
GRANT ALL PRIVILEGES ON DATABASE zabbix TO zabbix;
\c zabbix
GRANT ALL ON SCHEMA public TO zabbix;
EOF

cd /tmp
wget https://repo.zabbix.com/zabbix/7.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest+ubuntu24.04_all.deb
sudo dpkg -i zabbix-release_latest+ubuntu24.04_all.deb
sudo apt update

sudo apt -y install \
  zabbix-server-pgsql \
  zabbix-frontend-php \
  php8.3-pgsql \
  zabbix-nginx-conf \
  zabbix-sql-scripts \
  zabbix-agent2 \
  zabbix-agent2-plugin-postgresql \
  zabbix-agent2-plugin-mongodb

ZBX_DB_PASS="$(sudo cat /root/.zabbix-db-pass)"

zcat /usr/share/zabbix-sql-scripts/postgresql/server.sql.gz | \
  PGPASSWORD="$ZBX_DB_PASS" psql -h 127.0.0.1 -U zabbix -d zabbix

# Verificar: debe haber ~180 tablas.
PGPASSWORD="$ZBX_DB_PASS" psql -h 127.0.0.1 -U zabbix -d zabbix -c "\dt" | tail -5
echo "Tablas creadas: $(PGPASSWORD=$ZBX_DB_PASS psql -h 127.0.0.1 -U zabbix -d zabbix -tAc "select count(*) from pg_tables where schemaname='public';")"

ZBX_DB_PASS="$(sudo cat /root/.zabbix-db-pass)"

# Sed idempotente — funciona la primera vez y las siguientes.
sudo sed -i -E \
  -e "s|^# ?DBPassword=.*|DBPassword=$ZBX_DB_PASS|" \
  -e "s|^# ?DBHost=.*|DBHost=127.0.0.1|" \
  -e "s|^# ?StartPollers=.*|StartPollers=10|" \
  -e "s|^# ?StartPingers=.*|StartPingers=4|" \
  -e "s|^# ?CacheSize=.*|CacheSize=64M|" \
  -e "s|^# ?HistoryCacheSize=.*|HistoryCacheSize=32M|" \
  -e "s|^# ?LogSlowQueries=.*|LogSlowQueries=3000|" \
  /etc/zabbix/zabbix_server.conf

# Confirmar que el password quedó (sin imprimirlo — grep muestra la línea entera).
sudo grep -E "^(DBHost|DBPassword|StartPollers|CacheSize)" /etc/zabbix/zabbix_server.conf | \
  sed 's/DBPassword=.*/DBPassword=[HIDDEN]/'

sudo systemctl enable --now zabbix-server
sudo journalctl -u zabbix-server -n 30 --no-pager
sudo tail -20 /var/log/zabbix/zabbix_server.log

sudo sed -i \
  -e 's|^#\s*listen\s\+8080;|        listen          80;|' \
  -e 's|^#\s*server_name.*|        server_name     zbx-lab.lab.harper.local 192.168.0.230;|' \
  /etc/zabbix/nginx.conf

# Enlazar como sitio activo en Nginx.
sudo ln -sf /etc/zabbix/nginx.conf /etc/nginx/conf.d/zabbix.conf

# Deshabilitar el default para no chocar en :80.
[ -e /etc/nginx/sites-enabled/default ] && sudo rm /etc/nginx/sites-enabled/default || true

sudo nginx -t
sudo systemctl reload nginx

sudo sed -i -E \
  -e 's|^;?\s*date.timezone\s*=.*|date.timezone = America/Santo_Domingo|' \
  -e 's|^;?\s*post_max_size\s*=.*|post_max_size = 16M|' \
  -e 's|^;?\s*upload_max_filesize\s*=.*|upload_max_filesize = 2M|' \
  -e 's|^;?\s*max_execution_time\s*=.*|max_execution_time = 300|' \
  -e 's|^;?\s*max_input_time\s*=.*|max_input_time = 300|' \
  -e 's|^;?\s*memory_limit\s*=.*|memory_limit = 256M|' \
  /etc/php/8.3/fpm/php.ini

sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm --no-pager | head -8

sudo ufw allow 80/tcp
sudo ufw status

sudo sed -i -E \
  -e 's|^Server=.*|Server=127.0.0.1|' \
  -e 's|^ServerActive=.*|ServerActive=127.0.0.1|' \
  -e 's|^Hostname=.*|Hostname=Zabbix server|' \
  /etc/zabbix/zabbix_agent2.conf

sudo systemctl enable --now zabbix-agent2
sudo systemctl status zabbix-agent2 --no-pager | head -8

sudo apt -y install certbot python3-certbot-nginx
sudo certbot --nginx \
  -d zbx.cliente-ejemplo.com \
  --agree-tos \
  --email ramces.batista@har-per.com \
  --no-eff-email \
  --redirect

# Verificar renovación automática (via systemd timer)
sudo systemctl list-timers | grep certbot

sudo mkdir -p /etc/nginx/ssl
sudo openssl req -x509 -nodes -days 825 -newkey rsa:2048 \
  -keyout /etc/nginx/ssl/zbx-lab.key \
  -out    /etc/nginx/ssl/zbx-lab.crt \
  -subj "/C=DO/ST=SDO/L=SantoDomingo/O=Harper/OU=Infra/CN=zbx-lab.lab.harper.local"

# Editar /etc/zabbix/nginx.conf: añadir bloque HTTPS + redirect.
sudo tee /etc/nginx/conf.d/zabbix-ssl.conf >/dev/null <<'EOF'
server {
    listen 80;
    server_name zbx-lab.lab.harper.local 192.168.0.230;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name zbx-lab.lab.harper.local 192.168.0.230;

    ssl_certificate     /etc/nginx/ssl/zbx-lab.crt;
    ssl_certificate_key /etc/nginx/ssl/zbx-lab.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    include /etc/zabbix/nginx.conf;
}
EOF

# Quitar el /etc/nginx/conf.d/zabbix.conf duplicado (queda dentro del SSL).
sudo mv /etc/nginx/conf.d/zabbix.conf /etc/nginx/conf.d/zabbix.conf.disabled

sudo nginx -t && sudo systemctl reload nginx
sudo ufw allow 443/tcp

cd /tmp
wget https://repo.zabbix.com/zabbix/7.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest+ubuntu24.04_all.deb
sudo dpkg -i zabbix-release_latest+ubuntu24.04_all.deb
sudo apt update
sudo apt -y install zabbix-agent2

# Apuntar al servidor Zabbix (IP LAN de la VM del server).
sudo sed -i -E \
  -e 's|^Server=.*|Server=192.168.0.230|' \
  -e 's|^ServerActive=.*|ServerActive=192.168.0.230|' \
  -e "s|^Hostname=.*|Hostname=$(hostname -f)|" \
  /etc/zabbix/zabbix_agent2.conf

sudo systemctl enable --now zabbix-agent2

# Abrir el puerto 10050 SOLO desde la IP del Zabbix server.
sudo ufw allow from 192.168.0.230 to any port 10050 proto tcp

sudo tee /usr/local/sbin/zbx-backup.sh >/dev/null <<'EOF'
#!/usr/bin/env bash
# Backup nocturno de Zabbix — Harper.
# - Dump comprimido de la DB Postgres (schema + datos).
# - Tar de /etc/zabbix (configs).
# - Retención: 14 archivos más recientes de cada tipo.
set -euo pipefail

BACKUP_DIR=/var/backups/zabbix
STAMP=$(date +%F_%H%M)
mkdir -p "$BACKUP_DIR"

# 1) DB
export PGPASSWORD="$(cat /root/.zabbix-db-pass)"
pg_dump -h 127.0.0.1 -U zabbix -Fc zabbix \
  | gzip -9 > "$BACKUP_DIR/zabbix-db-$STAMP.dump.gz"

# 2) Configs
tar -C / -czf "$BACKUP_DIR/zabbix-etc-$STAMP.tar.gz" etc/zabbix etc/nginx/conf.d 2>/dev/null

# 3) Retención: dejar 14 más recientes de cada patrón.
ls -1t "$BACKUP_DIR"/zabbix-db-*.dump.gz  | tail -n +15 | xargs -r rm --
ls -1t "$BACKUP_DIR"/zabbix-etc-*.tar.gz  | tail -n +15 | xargs -r rm --

logger -t zbx-backup "backup OK · $STAMP · $(du -sh $BACKUP_DIR | cut -f1)"
EOF

sudo chmod 700 /usr/local/sbin/zbx-backup.sh
sudo /usr/local/sbin/zbx-backup.sh   # test manual
ls -lh /var/backups/zabbix/

sudo tee /etc/systemd/system/zbx-backup.service >/dev/null <<'EOF'
[Unit]
Description=Zabbix nightly backup (DB + configs)
After=postgresql.service

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/zbx-backup.sh
EOF

sudo tee /etc/systemd/system/zbx-backup.timer >/dev/null <<'EOF'
[Unit]
Description=Trigger zbx-backup.service cada noche a las 03:00

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true
RandomizedDelaySec=5m

[Install]
WantedBy=timers.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now zbx-backup.timer
sudo systemctl list-timers zbx-backup.timer