From f0de91df4e3f4e2aaf5ad76bfe7d4cc074969761 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Wed, 15 Jul 2026 02:39:49 -0400
Subject: [PATCH 01/11] zabbix: do not error in postinst when no ubusd

Now that post install is running properly, when CI executes the
tests the zabbix-extra-* packages that have a posinst exit the
post install with an error if ubusd is not running.

Drop the error code from killall with no usbd running to fix this.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 33fa804bdd693f29d6f91fc597a024d91fa5b006)
---
 admin/zabbix/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index ea49259a6c94c..8c0cc833382f5 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zabbix
 PKG_VERSION:=7.0.27
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \
@@ -581,7 +581,7 @@ endef
 define Package/zabbix-extra-network/postinst
 #!/bin/sh
 if [ -z "$${IPKG_INSTROOT}" ]; then
-  killall -s HUP ubusd
+  killall -s HUP ubusd || true
 fi
 endef
 
@@ -594,7 +594,7 @@ endef
 define Package/zabbix-extra-wifi/postinst
 #!/bin/sh
 if [ -z "$${IPKG_INSTROOT}" ]; then
-  killall -s HUP ubusd
+  killall -s HUP ubusd || true
 fi
 endef
 

From 87729e9f48c69a19d88d8f400f39734609a37cbb Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Wed, 15 Jul 2026 21:41:38 -0400
Subject: [PATCH 02/11] zabbix: bump version to 7.0.28

Update to latest LTS. See release notes:
https://www.zabbix.com/rn/rn7.0.28

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 69b555d22a04703a6564009011f320d289c09c64)
---
 admin/zabbix/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index 8c0cc833382f5..f5693437632a6 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zabbix
-PKG_VERSION:=7.0.27
-PKG_RELEASE:=2
+PKG_VERSION:=7.0.28
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \
 	https://cdn.zabbix.com/zabbix/sources/oldstable/$(basename $(PKG_VERSION))/
-PKG_HASH:=15e4c233e65c87922824d01abad624f34128bbb4af021a75e38e89b68e13e851
+PKG_HASH:=020a2649a450a642c3d74577eb583ec175f4bd85ebe2c3d39ede399487e1da33
 
 PKG_MAINTAINER:=Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
 PKG_LICENSE:=AGPL-3.0-only

From e2f12a16235c4298878e12a0ebb590b0504722ca Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Thu, 16 Jul 2026 21:09:43 -0400
Subject: [PATCH 03/11] zabbix: preserve user config files across sysupgrade

Add the user config file directories (/etc/zabbix_x.conf.d) to the
list of directories and files to preserve across sysupgrade.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 9058162e11dc2e0728aaa3380d975e4f412168b3)
---
 admin/zabbix/Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index f5693437632a6..4c875d2f5a1bb 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -492,6 +492,7 @@ endef
 
 define Package/zabbix-agentd/conffiles
 /etc/zabbix_agentd.conf
+/etc/zabbix_agentd.conf.d/
 endef
 
 define Package/zabbix-agentd/install
@@ -503,6 +504,7 @@ endef
 
 define Package/zabbix-agentd-basic/conffiles
 /etc/zabbix_agentd.conf
+/etc/zabbix_agentd.conf.d/
 endef
 
 define Package/zabbix-agentd-basic/install
@@ -514,6 +516,7 @@ endef
 
 define Package/zabbix-proxy/conffiles
 /etc/zabbix_proxy.conf
+/etc/zabbix_proxy.conf.d/
 endef
 
 define Package/zabbix-proxy/install
@@ -524,6 +527,7 @@ endef
 
 define Package/zabbix-proxy-basic-sqlite/conffiles
 /etc/zabbix_proxy.conf
+/etc/zabbix_proxy.conf.d/
 endef
 
 define Package/zabbix-proxy-basic-sqlite/install
@@ -534,6 +538,7 @@ endef
 
 define Package/zabbix-server/conffiles
 /etc/zabbix_server.conf
+/etc/zabbix_server.conf.d/
 /etc/config/zabbix_server
 /etc/sysctl.d/90-zabbix-discovery-workers.conf
 endef

From 5fc48eb2244e158dc22ea004dd47d72b01614d86 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Thu, 16 Jul 2026 23:56:31 -0400
Subject: [PATCH 04/11] zabbix: reorganize files dir for clarity and to better
 follow the FHS

Reorganize the extra files under the 'files' dir so that it is more
clear where they go and what they are for, and to avoid having a
disorganized mass of files.

Move the extra C source file out of files and into 'src-extra'.

Avoid treating openwrt-supplied params files as configuration data.
Instead have them in a separate directory under /usr/share which is
included in the zabbix_agentd configuration by default. This also better
follows the FHS.

Hopefully these changes make sense on their own, as well as helping the
CI accept the changes.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 2616169cd42ae207254f9d4a9b59a4ca8d527210)
---
 admin/zabbix/Makefile                                | 12 +++++++-----
 .../share/acl.d}/zabbix-network-ubus-acl.json        |  0
 .../{ => usr/share/acl.d}/zabbix-wifi-ubus-acl.json  |  0
 .../share/zabbix_agentd.openwrt-params.d}/mac80211   |  0
 .../share/zabbix_agentd.openwrt-params.d}/network    |  0
 .../share/zabbix_agentd.openwrt-params.d}/wifi       |  0
 admin/zabbix/patches/010-change-agentd-config.patch  |  3 ++-
 .../{files => src-extra}/zabbix_helper_mac80211.c    |  0
 8 files changed, 9 insertions(+), 6 deletions(-)
 rename admin/zabbix/files/{ => usr/share/acl.d}/zabbix-network-ubus-acl.json (100%)
 rename admin/zabbix/files/{ => usr/share/acl.d}/zabbix-wifi-ubus-acl.json (100%)
 rename admin/zabbix/files/{ => usr/share/zabbix_agentd.openwrt-params.d}/mac80211 (100%)
 rename admin/zabbix/files/{ => usr/share/zabbix_agentd.openwrt-params.d}/network (100%)
 rename admin/zabbix/files/{ => usr/share/zabbix_agentd.openwrt-params.d}/wifi (100%)
 rename admin/zabbix/{files => src-extra}/zabbix_helper_mac80211.c (100%)

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index 4c875d2f5a1bb..b53ea9df9d971 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -446,7 +446,7 @@ ifdef CONFIG_PACKAGE_zabbix-extra-mac80211
 define Build/Prepare
 	$(call Build/Prepare/Default)
 	mkdir -p $(PKG_BUILD_DIR)/zabbix-extra-mac80211
-	$(CP) ./files/zabbix_helper_mac80211.c $(PKG_BUILD_DIR)/zabbix-extra-mac80211/
+	$(CP) ./src-extra/zabbix_helper_mac80211.c $(PKG_BUILD_DIR)/zabbix-extra-mac80211/
 endef
 
 define Build/Configure
@@ -486,8 +486,8 @@ define Package/zabbix/install/init.d
 endef
 
 define Package/zabbix/install/zabbix.conf.d
-	$(INSTALL_DIR) $(1)/etc/zabbix_agentd.conf.d
-	$(INSTALL_BIN) ./files/$(2) $(1)/etc/zabbix_agentd.conf.d/$(2)
+	$(INSTALL_DIR) $(1)/usr/share/zabbix_agentd.openwrt-params.d
+	$(INSTALL_DATA) ./files/usr/share/zabbix_agentd.openwrt-params.d/$(2) $(1)/usr/share/zabbix_agentd.openwrt-params.d/$(2)
 endef
 
 define Package/zabbix-agentd/conffiles
@@ -497,6 +497,7 @@ endef
 
 define Package/zabbix-agentd/install
 	$(INSTALL_DIR) $(1)/etc/zabbix_agentd.conf.d
+	$(INSTALL_DIR) $(1)/usr/share/zabbix_agentd.openwrt-params.d
 	$(call Package/zabbix/install/sbin,$(1),agentd)
 	$(call Package/zabbix/install/etc,$(1),agentd)
 	$(call Package/zabbix/install/init.d,$(1),agentd)
@@ -509,6 +510,7 @@ endef
 
 define Package/zabbix-agentd-basic/install
 	$(INSTALL_DIR) $(1)/etc/zabbix_agentd.conf.d
+	$(INSTALL_DIR) $(1)/usr/share/zabbix_agentd.openwrt-params.d
 	$(call Package/zabbix/install/sbin,$(1),agentd)
 	$(call Package/zabbix/install/etc,$(1),agentd)
 	$(call Package/zabbix/install/init.d,$(1),agentd)
@@ -580,7 +582,7 @@ endef
 define Package/zabbix-extra-network/install
 	$(call Package/zabbix/install/zabbix.conf.d,$(1),network)
 	$(INSTALL_DIR) $(1)/usr/share/acl.d
-	$(INSTALL_DATA) ./files/zabbix-network-ubus-acl.json $(1)/usr/share/acl.d/zabbix-network.json
+	$(INSTALL_DATA) ./files/usr/share/acl.d/zabbix-network-ubus-acl.json $(1)/usr/share/acl.d/zabbix-network.json
 endef
 
 define Package/zabbix-extra-network/postinst
@@ -593,7 +595,7 @@ endef
 define Package/zabbix-extra-wifi/install
 	$(call Package/zabbix/install/zabbix.conf.d,$(1),wifi)
 	$(INSTALL_DIR) $(1)/usr/share/acl.d
-	$(INSTALL_DATA) ./files/zabbix-wifi-ubus-acl.json $(1)/usr/share/acl.d/zabbix-wifi.json
+	$(INSTALL_DATA) ./files/usr/share/acl.d/zabbix-wifi-ubus-acl.json $(1)/usr/share/acl.d/zabbix-wifi.json
 endef
 
 define Package/zabbix-extra-wifi/postinst
diff --git a/admin/zabbix/files/zabbix-network-ubus-acl.json b/admin/zabbix/files/usr/share/acl.d/zabbix-network-ubus-acl.json
similarity index 100%
rename from admin/zabbix/files/zabbix-network-ubus-acl.json
rename to admin/zabbix/files/usr/share/acl.d/zabbix-network-ubus-acl.json
diff --git a/admin/zabbix/files/zabbix-wifi-ubus-acl.json b/admin/zabbix/files/usr/share/acl.d/zabbix-wifi-ubus-acl.json
similarity index 100%
rename from admin/zabbix/files/zabbix-wifi-ubus-acl.json
rename to admin/zabbix/files/usr/share/acl.d/zabbix-wifi-ubus-acl.json
diff --git a/admin/zabbix/files/mac80211 b/admin/zabbix/files/usr/share/zabbix_agentd.openwrt-params.d/mac80211
similarity index 100%
rename from admin/zabbix/files/mac80211
rename to admin/zabbix/files/usr/share/zabbix_agentd.openwrt-params.d/mac80211
diff --git a/admin/zabbix/files/network b/admin/zabbix/files/usr/share/zabbix_agentd.openwrt-params.d/network
similarity index 100%
rename from admin/zabbix/files/network
rename to admin/zabbix/files/usr/share/zabbix_agentd.openwrt-params.d/network
diff --git a/admin/zabbix/files/wifi b/admin/zabbix/files/usr/share/zabbix_agentd.openwrt-params.d/wifi
similarity index 100%
rename from admin/zabbix/files/wifi
rename to admin/zabbix/files/usr/share/zabbix_agentd.openwrt-params.d/wifi
diff --git a/admin/zabbix/patches/010-change-agentd-config.patch b/admin/zabbix/patches/010-change-agentd-config.patch
index 7450e81e62326..b94fbe693fdff 100644
--- a/admin/zabbix/patches/010-change-agentd-config.patch
+++ b/admin/zabbix/patches/010-change-agentd-config.patch
@@ -83,10 +83,11 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ####### USER-DEFINED MONITORED PARAMETERS #######
  
-@@ -547,5 +541,5 @@ Hostname=Zabbix server
+@@ -547,5 +541,6 @@ Hostname=Zabbix server
  # Include=
  
  # Include=/usr/local/etc/zabbix_agentd.userparams.conf
 -# Include=/usr/local/etc/zabbix_agentd.conf.d/
  # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
++Include=/usr/share/zabbix_agentd.openwrt-params.d/
 +Include=/etc/zabbix_agentd.conf.d/
diff --git a/admin/zabbix/files/zabbix_helper_mac80211.c b/admin/zabbix/src-extra/zabbix_helper_mac80211.c
similarity index 100%
rename from admin/zabbix/files/zabbix_helper_mac80211.c
rename to admin/zabbix/src-extra/zabbix_helper_mac80211.c

From efa31e8a356ef98bc5407ac49e7aa6dabbf83ef4 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Fri, 17 Jul 2026 02:28:30 -0400
Subject: [PATCH 05/11] zabbix: stop shipping sysctl.d conf in package

The sysctl file increases max files to allow the default full
complement of discovery workers, however this is probably not a
hard requirement and such a conf not shipped elsewhere in tree, so
leave that to the user to configure. (The syslog messages from
zabbix-server and/or zabbix-proxy provided the needed information).

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit f1bf9f56d866dfe8192f82428e910a3420092039)
---
 admin/zabbix/Makefile                                   | 3 ---
 admin/zabbix/files/zabbix-discovery-workers.conf.sysctl | 1 -
 2 files changed, 4 deletions(-)
 delete mode 100644 admin/zabbix/files/zabbix-discovery-workers.conf.sysctl

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index b53ea9df9d971..000734f9caf0f 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -542,7 +542,6 @@ define Package/zabbix-server/conffiles
 /etc/zabbix_server.conf
 /etc/zabbix_server.conf.d/
 /etc/config/zabbix_server
-/etc/sysctl.d/90-zabbix-discovery-workers.conf
 endef
 
 define Package/zabbix-server/install
@@ -550,8 +549,6 @@ define Package/zabbix-server/install
 	$(call Package/zabbix/install/sbin,$(1),server)
 	$(call Package/zabbix/install/etc,$(1),server)
 	$(call Package/zabbix/install/init.d,$(1),server)
-	$(INSTALL_DIR) $(1)/etc/sysctl.d
-	$(INSTALL_CONF) ./files/zabbix-discovery-workers.conf.sysctl $(1)/etc/sysctl.d/90-zabbix-discovery-workers.conf
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_CONF) ./files/zabbix_server.config $(1)/etc/config/zabbix_server
 	$(INSTALL_DIR) $(1)/etc/uci-defaults
diff --git a/admin/zabbix/files/zabbix-discovery-workers.conf.sysctl b/admin/zabbix/files/zabbix-discovery-workers.conf.sysctl
deleted file mode 100644
index e88c23943f991..0000000000000
--- a/admin/zabbix/files/zabbix-discovery-workers.conf.sysctl
+++ /dev/null
@@ -1 +0,0 @@
-fs.file-max=100000

From 49cb9acb72c5f7d33ac5625655629f113e4edc3b Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Fri, 17 Jul 2026 02:48:36 -0400
Subject: [PATCH 06/11] zabbix: add php8-mod-simplexml dependency to frontend

While the frontend can mostly operate without php8-mod-simplexml, when
trying to import XML templates the user only gets unhelpful error
messages and is unlikely to realize the module is required for that
functionality. Therefore have the frontend depend on php8-mod-simplexml.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 3e46007e605a8e6da5abd56bd45b485ee769e19b)
---
 admin/zabbix/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index 000734f9caf0f..2d841ab0c5965 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zabbix
 PKG_VERSION:=7.0.28
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \
@@ -360,6 +360,7 @@ define Package/zabbix-frontend-server
     +php8-mod-mbstring \
     +php8-mod-openssl \
     +php8-mod-session \
+    +php8-mod-simplexml \
     +php8-mod-sockets \
     +php8-mod-xmlreader \
     +php8-mod-xmlwriter

From a8f138529f260bd60a852d481fa5c706e17d7e61 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Wed, 15 Jul 2026 22:30:00 -0400
Subject: [PATCH 07/11] zabbix: use separate users for server and proxy

This is the upstream recommendation, and fits with our separation
of agent and server.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 134078192468dfb4f9e4449db39258b39b8f98cf)
---
 admin/zabbix/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index 2d841ab0c5965..dcc5373e502c8 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -192,7 +192,6 @@ define Package/zabbix-server-or-proxy/Default
     +libevent2-extra \
     +libpcre2 \
     +zlib
-  USERID:=zabbix-server=70:zabbix-server=70
 endef
 
 define Package/zabbix-proxy/Default
@@ -202,6 +201,7 @@ define Package/zabbix-proxy/Default
     @zabbix-proxy-any \
     zabbix-proxy-ssl \
     zabbix-proxy-openssl
+  USERID:=zabbix-proxy=71:zabbix-proxy=71
 endef
 
 define Package/zabbix-proxy
@@ -281,6 +281,7 @@ define Package/zabbix-server
   PROVIDES:= \
     zabbix-server-ssl \
     zabbix-server-openssl
+  USERID:=zabbix-server=70:zabbix-server=70
   VARIANT:=full
 endef
 

From b57f6b01b5ad503a020507ae9e9bb2d2ff2f095c Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Thu, 16 Jul 2026 19:47:53 -0400
Subject: [PATCH 08/11] zabbix: tweak patch agent and server patch configs

Tweak the agentd and server patch configurations and bring agentd and
server confgurations to parity.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 589cf9a73cdcbc3a0d23e096061f54624abb0cbd)
---
 .../patches/010-change-agentd-config.patch    | 93 ------------------
 ...agentd-tweak-config-file-for-openwrt.patch | 98 +++++++++++++++++++
 ...erver-tweak-config-file-for-openwrt.patch} | 54 +++++-----
 3 files changed, 126 insertions(+), 119 deletions(-)
 delete mode 100644 admin/zabbix/patches/010-change-agentd-config.patch
 create mode 100644 admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch
 rename admin/zabbix/patches/{020-change-server-config.patch => 020-zabbix_server-tweak-config-file-for-openwrt.patch} (59%)

diff --git a/admin/zabbix/patches/010-change-agentd-config.patch b/admin/zabbix/patches/010-change-agentd-config.patch
deleted file mode 100644
index b94fbe693fdff..0000000000000
--- a/admin/zabbix/patches/010-change-agentd-config.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From da7f1292838f087e2179705f2778f78ddd85cba8 Mon Sep 17 00:00:00 2001
-From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
-Date: Wed, 17 Dec 2025 18:28:37 -0500
-Subject: [PATCH] zabbix_agentd: Tweak config file for OpenWrt
-
-Note: original patch had no header, header added 2025-12-16, while
-bumping package version. Modified 2025-12-25. Modified 2026-01-21.
-
-1. Use syslog not a file for logging
-2. Place PidFile under /var/run/zabbix
-3. Only start passive agent by default
-4. Do not do active checks by default
-5. Use the system hostname as hostname (except on zabbix server)
-6. Include configurations under /etc/zabbix_agentd.conf.d/
-7. Drop privileges to the zabbix-agent user (instead of zabbix)
-
-Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
----
- conf/zabbix_agentd.conf | 19 +++++++------------
- 1 file changed, 7 insertions(+), 12 deletions(-)
-
---- a/conf/zabbix_agentd.conf
-+++ b/conf/zabbix_agentd.conf
-@@ -3,12 +3,11 @@
- 
- ############ GENERAL PARAMETERS #################
- 
--### Option: PidFile
--#	Name of PID file.
--#
--# Mandatory: no
--# Default:
--# PidFile=/tmp/zabbix_agentd.pid
-+# Zabbix always creates a PidFile. Make sure it is where we want it.
-+PidFile=/var/run/zabbix-agent/zabbix_agentd.pid
-+
-+# use syslog
-+LogType=system
- 
- ### Option: LogType
- #	Specifies where log messages are written to:
-@@ -27,8 +26,6 @@
- # Default:
- # LogFile=
- 
--LogFile=/tmp/zabbix_agentd.log
--
- ### Option: LogFileSize
- #	Maximum size of log file in MB.
- #	0 - disable automatic log rotation.
-@@ -136,6 +133,7 @@ Server=127.0.0.1
- # Range: 0-100
- # Default:
- # StartAgents=10
-+StartAgents=1
- 
- ##### Active checks related
- 
-@@ -166,8 +164,6 @@ Server=127.0.0.1
- # Default:
- # ServerActive=
- 
--ServerActive=127.0.0.1
--
- ### Option: Hostname
- #	List of comma delimited unique, case sensitive hostnames.
- #	Required for active checks and must match hostnames as configured on the server.
-@@ -177,8 +173,6 @@ ServerActive=127.0.0.1
- # Default:
- # Hostname=
- 
--Hostname=Zabbix server
--
- ### Option: HostnameItem
- #	Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
- #	Does not support UserParameters or aliases.
-@@ -317,7 +311,7 @@ Hostname=Zabbix server
- #
- # Mandatory: no
- # Default:
--# User=zabbix
-+User=zabbix-agent
- 
- ####### USER-DEFINED MONITORED PARAMETERS #######
- 
-@@ -547,5 +541,6 @@ Hostname=Zabbix server
- # Include=
- 
- # Include=/usr/local/etc/zabbix_agentd.userparams.conf
--# Include=/usr/local/etc/zabbix_agentd.conf.d/
- # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
-+Include=/usr/share/zabbix_agentd.openwrt-params.d/
-+Include=/etc/zabbix_agentd.conf.d/
diff --git a/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch
new file mode 100644
index 0000000000000..ab7b43e506878
--- /dev/null
+++ b/admin/zabbix/patches/010-zabbix_agentd-tweak-config-file-for-openwrt.patch
@@ -0,0 +1,98 @@
+From 502248599bfc0b36daf0f8dd83bee5bc6e1b24e4 Mon Sep 17 00:00:00 2001
+From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
+Date: Wed, 17 Dec 2025 18:28:37 -0500
+Subject: zabbix_agentd: tweak config file for OpenWrt
+
+Note: original patch had no header, header added 2025-12-16, while
+bumping package version. Modified 2025-12-25. Modified 2026-01-21.
+Tweaked further 2026-07-16.
+
+1. Use syslog not a file for logging.
+2. Place PidFile under /var/run/zabbix-agent.
+3. Only start 1 passive agent by default.
+4. Do not do active checks by default.
+5. Use the system hostname as hostname.
+6. If started as root, drop privileges to the zabbix-agent user, not
+   a shared (with server and proxy) zabbix user or root, per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation
+7. Include configuration files under /etc/zabbix_agentd.conf.d/.
+8. Require configurations under /etc/zabbix_agentd.conf.d/ end in .conf.
+   (other files are ignored for configuration purposes).
+
+Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
+---
+ conf/zabbix_agentd.conf | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/conf/zabbix_agentd.conf
++++ b/conf/zabbix_agentd.conf
+@@ -10,6 +10,9 @@
+ # Default:
+ # PidFile=/tmp/zabbix_agentd.pid
+ 
++# Zabbix always creates a PidFile. Make sure it is where we want it.
++PidFile=/var/run/zabbix-agent/zabbix_agentd.pid
++
+ ### Option: LogType
+ #	Specifies where log messages are written to:
+ #		system  - syslog
+@@ -20,6 +23,9 @@
+ # Default:
+ # LogType=file
+ 
++# Use syslog
++LogType=system
++
+ ### Option: LogFile
+ #	Log file name for LogType 'file' parameter.
+ #
+@@ -27,7 +33,7 @@
+ # Default:
+ # LogFile=
+ 
+-LogFile=/tmp/zabbix_agentd.log
++# LogFile=/tmp/zabbix_agentd.log
+ 
+ ### Option: LogFileSize
+ #	Maximum size of log file in MB.
+@@ -136,6 +142,7 @@ Server=127.0.0.1
+ # Range: 0-100
+ # Default:
+ # StartAgents=10
++StartAgents=1
+ 
+ ##### Active checks related
+ 
+@@ -166,7 +173,7 @@ Server=127.0.0.1
+ # Default:
+ # ServerActive=
+ 
+-ServerActive=127.0.0.1
++# ServerActive=127.0.0.1
+ 
+ ### Option: Hostname
+ #	List of comma delimited unique, case sensitive hostnames.
+@@ -177,7 +184,7 @@ ServerActive=127.0.0.1
+ # Default:
+ # Hostname=
+ 
+-Hostname=Zabbix server
++# Hostname=Zabbix server
+ 
+ ### Option: HostnameItem
+ #	Item used for generating Hostname if it is undefined. Ignored if Hostname is defined.
+@@ -318,6 +325,7 @@ Hostname=Zabbix server
+ # Mandatory: no
+ # Default:
+ # User=zabbix
++User=zabbix-agent
+ 
+ ####### USER-DEFINED MONITORED PARAMETERS #######
+ 
+@@ -549,3 +557,5 @@ Hostname=Zabbix server
+ # Include=/usr/local/etc/zabbix_agentd.userparams.conf
+ # Include=/usr/local/etc/zabbix_agentd.conf.d/
+ # Include=/usr/local/etc/zabbix_agentd.conf.d/*.conf
++Include=/usr/share/zabbix_agentd.openwrt-params.d/
++Include=/etc/zabbix_agentd.conf.d/*.conf
diff --git a/admin/zabbix/patches/020-change-server-config.patch b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
similarity index 59%
rename from admin/zabbix/patches/020-change-server-config.patch
rename to admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
index d9251d5c094fc..04f8b5684d932 100644
--- a/admin/zabbix/patches/020-change-server-config.patch
+++ b/admin/zabbix/patches/020-zabbix_server-tweak-config-file-for-openwrt.patch
@@ -1,21 +1,28 @@
-From ca45744e63b957d83cdbc2a28588077cbf8b5639 Mon Sep 17 00:00:00 2001
+From 6655a1f2e5bff8d0082f41cf2711339f0d75d788 Mon Sep 17 00:00:00 2001
 From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
 Date: Wed, 17 Dec 2025 06:39:16 -0500
-Subject: [PATCH] Make zabbix_server config suitable for OpenWrt
+Subject: zabbix_server: tweak config file for OpenWrt
 
-1. Log to (default ephemeral) syslog, not a file (and don't rotate)
+Created 2025-12-17. Updated 2026-07-16.
+
+1. Log to syslog, not a file.
 2. Update PidFile path so correct permissions can be set for access by
-   Zabbix server running without privileges
+   Zabbix server running without privileges.
 3. If started as root, drop privileges to zabbix-server user (instead of
-   zabbix)
-4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin)
-5. Configure fping as the ipv6 fping as well
-6. For privacy, disable the public API call to check Zabbix version
+   zabbix user shared with agent and proxy, or root) per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation.
+4. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin).
+5. Configure fping as the ipv6 fping as well.
+6. For privacy, disable the public API call to check Zabbix version.
+7. Include configurations under /etc/zabbix_server.conf.d/.
+8. Require configurations under /etc/zabbix_server.conf.d/ end in .conf
+   (other files are ignored for configuration purposes).
 
 Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
 ---
- conf/zabbix_server.conf | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
+ conf/zabbix_server.conf | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
 
 --- a/conf/zabbix_server.conf
 +++ b/conf/zabbix_server.conf
@@ -36,15 +43,7 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: LogFileSize
  #	Maximum size of log file in MB.
-@@ -45,6 +46,7 @@ LogFile=/tmp/zabbix_server.log
- # Range: 0-1024
- # Default:
- # LogFileSize=1
-+LogFileSize=0
- 
- ### Option: DebugLevel
- #	Specifies debug level:
-@@ -67,6 +69,10 @@ LogFile=/tmp/zabbix_server.log
+@@ -67,6 +68,10 @@ LogFile=/tmp/zabbix_server.log
  # Default:
  # PidFile=/tmp/zabbix_server.pid
  
@@ -55,11 +54,10 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  ### Option: SocketDir
  #	IPC socket directory.
  #		Directory to store IPC sockets used by internal Zabbix services.
-@@ -610,7 +616,7 @@ Timeout=4
- #
+@@ -611,6 +616,7 @@ Timeout=4
  # Mandatory: no
  # Default:
--# FpingLocation=/usr/sbin/fping
+ # FpingLocation=/usr/sbin/fping
 +FpingLocation=/usr/bin/fping
  
  ### Option: Fping6Location
@@ -72,16 +70,15 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: SSHKeyLocation
  #	Location of public and private keys for SSH checks and actions.
-@@ -698,7 +705,7 @@ LogSlowQueries=3000
- #
+@@ -699,6 +706,7 @@ LogSlowQueries=3000
  # Mandatory: no
  # Default:
--# User=zabbix
+ # User=zabbix
 +User=zabbix-server
  
  ### Option: SSLCertLocation
  #	Location of SSL client certificates.
-@@ -1050,7 +1057,7 @@ EnableGlobalScripts=0
+@@ -1050,7 +1058,7 @@ EnableGlobalScripts=0
  #
  # Mandatory: no
  # Default:
@@ -90,3 +87,8 @@ Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
  
  ### Option: SMSDevices
  #	List of comma delimited modem files allowed to use Zabbix server
+@@ -1125,3 +1133,4 @@ EnableGlobalScripts=0
+ # Include=/usr/local/etc/zabbix_server.general.conf
+ # Include=/usr/local/etc/zabbix_server.conf.d/
+ # Include=/usr/local/etc/zabbix_server.conf.d/*.conf
++Include=/etc/zabbix_server.conf.d/*.conf

From d2f85c8a9de264c273b5f8af198613c37bbad422 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Thu, 16 Jul 2026 20:21:41 -0400
Subject: [PATCH 09/11] zabbix: tweak server initscript and bring agentd to
 parity

* Genericize zabbix_server initscript.
* Add shellcheck overrides where needed.
* Add a 'never_root' config option (default true) that determines
  whether server starts as an unprivileged user or starts as root and
  drops to an unprivileged user (unless config is changed so it always
  runs as root).
* Bring zabbix_agentd initscript to parity with zabbix_server for the
  initscript and configuration.
* Tweak Makefile to reduce repetition

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit ec5497292452db0cfb0205fca16c6460607b5433)
---
 admin/zabbix/Makefile                     | 23 ++++++++------
 admin/zabbix/files/zabbix_agentd.config   |  4 +++
 admin/zabbix/files/zabbix_agentd.defaults |  3 ++
 admin/zabbix/files/zabbix_agentd.init     | 38 +++++++++++++++++++----
 admin/zabbix/files/zabbix_server.config   |  1 +
 admin/zabbix/files/zabbix_server.init     | 19 +++++++++---
 6 files changed, 68 insertions(+), 20 deletions(-)
 create mode 100644 admin/zabbix/files/zabbix_agentd.config
 create mode 100644 admin/zabbix/files/zabbix_agentd.defaults

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index dcc5373e502c8..d4bedaf404d26 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -495,6 +495,13 @@ endef
 define Package/zabbix-agentd/conffiles
 /etc/zabbix_agentd.conf
 /etc/zabbix_agentd.conf.d/
+/etc/config/zabbix_agentd
+endef
+
+define Package/zabbix-agentd/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_agentd) && rm -f /etc/uci-defaults/90_zabbix_agentd
+exit 0
 endef
 
 define Package/zabbix-agentd/install
@@ -503,19 +510,17 @@ define Package/zabbix-agentd/install
 	$(call Package/zabbix/install/sbin,$(1),agentd)
 	$(call Package/zabbix/install/etc,$(1),agentd)
 	$(call Package/zabbix/install/init.d,$(1),agentd)
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/zabbix_agentd.config $(1)/etc/config/zabbix_agentd
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/zabbix_agentd.defaults $(1)/etc/uci-defaults/90_zabbix_agentd
 endef
 
-define Package/zabbix-agentd-basic/conffiles
-/etc/zabbix_agentd.conf
-/etc/zabbix_agentd.conf.d/
-endef
+Package/zabbix-agentd-basic/conffiles=$(call Package/zabbix-agentd/conffiles)
+Package/zabbix-agentd-basic/postinst=$(call Package/zabbix-agentd/postinst)
 
 define Package/zabbix-agentd-basic/install
-	$(INSTALL_DIR) $(1)/etc/zabbix_agentd.conf.d
-	$(INSTALL_DIR) $(1)/usr/share/zabbix_agentd.openwrt-params.d
-	$(call Package/zabbix/install/sbin,$(1),agentd)
-	$(call Package/zabbix/install/etc,$(1),agentd)
-	$(call Package/zabbix/install/init.d,$(1),agentd)
+	$(call Package/zabbix-agentd/install,$(1))
 endef
 
 define Package/zabbix-proxy/conffiles
diff --git a/admin/zabbix/files/zabbix_agentd.config b/admin/zabbix/files/zabbix_agentd.config
new file mode 100644
index 0000000000000..9f38a26c71f09
--- /dev/null
+++ b/admin/zabbix/files/zabbix_agentd.config
@@ -0,0 +1,4 @@
+
+config zabbix_agentd 'general'
+    option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_agentd.defaults b/admin/zabbix/files/zabbix_agentd.defaults
new file mode 100644
index 0000000000000..601eb5daa2c3d
--- /dev/null
+++ b/admin/zabbix/files/zabbix_agentd.defaults
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+chown zabbix-agent:zabbix-agent /etc/zabbix_agentd.conf
diff --git a/admin/zabbix/files/zabbix_agentd.init b/admin/zabbix/files/zabbix_agentd.init
index 04bef3730d3a6..eb2b0d830bda3 100755
--- a/admin/zabbix/files/zabbix_agentd.init
+++ b/admin/zabbix/files/zabbix_agentd.init
@@ -1,26 +1,52 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2008-2011 OpenWrt.org
 
+# shellcheck shell=busybox
+
+# shellcheck disable=SC2034
 START=60
 
+# shellcheck disable=SC2034
 USE_PROCD=1
-PROG=/usr/sbin/zabbix_agentd
-CONFIG=/etc/zabbix_agentd.conf
+NAME=zabbix_agentd
+PROG=/usr/sbin/${NAME}
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-agent
 
 start_service() {
+	local enabled never_root
+
 	# Sometimes the agentd config was installed in /etc/zabbix/zabbix_agentd.conf
 	[ -f /etc/zabbix/zabbix_agentd.conf ] && mv /etc/zabbix/zabbix_agentd.conf ${CONFIG}
 
-	[ -f ${CONFIG} ] || return 1
+	if [ ! -f "${CONFIG}" ]; then
+		logger "Configuration file not found: '${CONFIG}'"
+		return 1
+	fi
+
+	# Get enabled config option
+	config_load "$NAME"
+	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
 
-	mkdir -p /var/run/zabbix-agent
-	chown zabbix-agent:zabbix-agent /var/run/zabbix-agent
+	# shellcheck disable=SC2154
+	if [ "$enabled" -eq 0 ]; then
+		logger "service not enabled in $UCI_CONFIG"
+		return 1
+	fi
+
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
 
 	procd_open_instance
 	procd_set_param command ${PROG} -c ${CONFIG} -f
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
+	procd_set_param file ${CONFIG}
 	procd_set_param respawn
 	procd_set_param stdout 1
 	procd_set_param stderr 1
 	procd_close_instance
 }
-
diff --git a/admin/zabbix/files/zabbix_server.config b/admin/zabbix/files/zabbix_server.config
index 45e3f3062b0ab..c6fceba4d0a38 100644
--- a/admin/zabbix/files/zabbix_server.config
+++ b/admin/zabbix/files/zabbix_server.config
@@ -1,3 +1,4 @@
 
 config zabbix_server 'general'
     option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_server.init b/admin/zabbix/files/zabbix_server.init
index bcbdb41cd7d7e..a2454697663fd 100755
--- a/admin/zabbix/files/zabbix_server.init
+++ b/admin/zabbix/files/zabbix_server.init
@@ -1,6 +1,8 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2008-2025 OpenWrt.org
 
+# shellcheck shell=busybox
+
 # shellcheck disable=SC2034
 START=59
 
@@ -9,9 +11,13 @@ USE_PROCD=1
 
 NAME=zabbix_server
 PROG=/usr/sbin/${NAME}
-CONFIG=/etc/zabbix_server.conf
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-server
 
 start_service() {
+	local enabled never_root
+
 	if [ ! -f "${CONFIG}" ]; then
 		logger "Configuration file not found: '${CONFIG}'"
 		return 1
@@ -20,19 +26,22 @@ start_service() {
 	# Get enabled config option
 	config_load "$NAME"
 	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
 
 	# shellcheck disable=SC2154
 	if [ "$enabled" -eq 0 ]; then
-		logger "service not enabled in /etc/config/$NAME"
+		logger "service not enabled in $UCI_CONFIG"
 		return 1
 	fi
 
-	mkdir -p /var/run/zabbix-server
-	chown zabbix-server:zabbix-server /var/run/zabbix-server
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
 
 	procd_open_instance
 	procd_set_param command ${PROG} -c ${CONFIG} -f
-	procd_set_param user zabbix-server
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
 	procd_set_param limits nofile="16384 100000"
 	procd_set_param file ${CONFIG}
 	procd_set_param respawn

From 5288927154a3f7dfc9ed5d61faa720a3299cbcbb Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Thu, 16 Jul 2026 21:01:36 -0400
Subject: [PATCH 10/11] zabbix: bring proxy to parity with server and agentd

* Add config file patch for proxy
* Add initscript for proxy
* Update Makefile and support files to bring proxy to parity with
  agentd and server.

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 355665cfb5246a4a0e437bc367cb8c0cf7d20688)
---
 admin/zabbix/Makefile                         | 26 +++--
 admin/zabbix/files/zabbix_proxy.config        |  4 +
 admin/zabbix/files/zabbix_proxy.defaults      |  3 +
 admin/zabbix/files/zabbix_proxy.init          | 50 ++++++++++
 ..._proxy-tweak-config-file-for-openwrt.patch | 98 +++++++++++++++++++
 5 files changed, 172 insertions(+), 9 deletions(-)
 create mode 100644 admin/zabbix/files/zabbix_proxy.config
 create mode 100644 admin/zabbix/files/zabbix_proxy.defaults
 create mode 100755 admin/zabbix/files/zabbix_proxy.init
 create mode 100644 admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index d4bedaf404d26..eb951ef7bdfc5 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zabbix
 PKG_VERSION:=7.0.28
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \
@@ -455,7 +455,7 @@ define Build/Configure
 	$(call Build/Configure/Default)
 endef
 
-# We use spaces for continued lines so that is if continuation does not parse
+# We use spaces for continued lines so that if continuation does not parse
 # properly we will get a hard error instead of subtle failure.
 define Build/Compile
 	$(call Build/Compile/Default)
@@ -526,23 +526,31 @@ endef
 define Package/zabbix-proxy/conffiles
 /etc/zabbix_proxy.conf
 /etc/zabbix_proxy.conf.d/
+/etc/config/zabbix_proxy
+endef
+
+define Package/zabbix-proxy/postinst
+#!/bin/sh
+[ -n "$${IPKG_INSTROOT}" ] || (. /etc/uci-defaults/90_zabbix_proxy) && rm -f /etc/uci-defaults/90_zabbix_proxy
+exit 0
 endef
 
 define Package/zabbix-proxy/install
 	$(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d
 	$(call Package/zabbix/install/sbin,$(1),proxy)
 	$(call Package/zabbix/install/etc,$(1),proxy)
+	$(call Package/zabbix/install/init.d,$(1),proxy)
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/zabbix_proxy.config $(1)/etc/config/zabbix_proxy
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_BIN) ./files/zabbix_proxy.defaults $(1)/etc/uci-defaults/90_zabbix_proxy
 endef
 
-define Package/zabbix-proxy-basic-sqlite/conffiles
-/etc/zabbix_proxy.conf
-/etc/zabbix_proxy.conf.d/
-endef
+Package/zabbix-proxy-basic-sqlite/conffiles=$(call Package/zabbix-proxy/conffiles)
+Package/zabbix-proxy-basic-sqlite/postinst=$(call Package/zabbix-proxy/postinst)
 
 define Package/zabbix-proxy-basic-sqlite/install
-	$(INSTALL_DIR) $(1)/etc/zabbix_proxy.conf.d
-	$(call Package/zabbix/install/sbin,$(1),proxy)
-	$(call Package/zabbix/install/etc,$(1),proxy)
+	$(call Package/zabbix-proxy/install,$(1))
 endef
 
 define Package/zabbix-server/conffiles
diff --git a/admin/zabbix/files/zabbix_proxy.config b/admin/zabbix/files/zabbix_proxy.config
new file mode 100644
index 0000000000000..8464b009855c8
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.config
@@ -0,0 +1,4 @@
+
+config zabbix_proxy 'general'
+    option enabled 0
+    # option never_root 1
diff --git a/admin/zabbix/files/zabbix_proxy.defaults b/admin/zabbix/files/zabbix_proxy.defaults
new file mode 100644
index 0000000000000..346814c3feb2f
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.defaults
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+chown zabbix-proxy:zabbix-proxy /etc/zabbix_proxy.conf
diff --git a/admin/zabbix/files/zabbix_proxy.init b/admin/zabbix/files/zabbix_proxy.init
new file mode 100755
index 0000000000000..9939f80569203
--- /dev/null
+++ b/admin/zabbix/files/zabbix_proxy.init
@@ -0,0 +1,50 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2008-2025 OpenWrt.org
+
+# shellcheck shell=busybox
+
+# shellcheck disable=SC2034
+START=59
+
+# shellcheck disable=SC2034
+USE_PROCD=1
+
+NAME=zabbix_proxy
+PROG=/usr/sbin/${NAME}
+CONFIG=/etc/${NAME}.conf
+UCI_CONFIG=/etc/config/${NAME}
+USER=zabbix-proxy
+
+start_service() {
+	local enabled never_root
+
+	if [ ! -f "${CONFIG}" ]; then
+		logger "Configuration file not found: '${CONFIG}'"
+		return 1
+	fi
+
+	# Get enabled config option
+	config_load "$NAME"
+	config_get_bool enabled general enabled 0
+	config_get_bool never_root general never_root 1
+
+	# shellcheck disable=SC2154
+	if [ "$enabled" -eq 0 ]; then
+		logger "service not enabled in $UCI_CONFIG"
+		return 1
+	fi
+
+	mkdir -p "/var/run/$USER"
+	chown $USER:$USER "/var/run/$USER"
+
+	procd_open_instance
+	procd_set_param command ${PROG} -c ${CONFIG} -f
+	if [ "$never_root" -eq 1 ]; then
+		procd_set_param user ${USER}
+	fi
+	procd_set_param file ${CONFIG}
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
diff --git a/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch
new file mode 100644
index 0000000000000..cd1abd201b8c1
--- /dev/null
+++ b/admin/zabbix/patches/030-zabbix_proxy-tweak-config-file-for-openwrt.patch
@@ -0,0 +1,98 @@
+From c03db1c64e218fb2ef469ddb9705eff9f9d493e1 Mon Sep 17 00:00:00 2001
+From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
+Date: Thu, 16 Jul 2026 18:58:26 -0400
+Subject: zabbix_proxy: tweak config file for OpenWrt
+
+Created 2026-07-16.
+
+1. Use passive proxy mode by default (in keeping with agentd defaults).
+2. Use system hostname as system hostname not 'Zabbix proxy'.
+3. Log to syslog, not a file.
+4. Update PidFile path so correct permissions can be set for access by
+   Zabbix proxy running without privileges.
+5. Set the fping location properly for OpenWrt (/usr/bin not /usr/sbin).
+6. Configure fping as the ipv6 fping as well.
+7. If started as root, drop privileges to zabbix-proxy user (instead of
+   zabbix user shared with agent and server, or root) per upstream
+   recommendation:
+   https://www.zabbix.com/documentation/7.0/en/manual/installation/install#security-recommendation.
+8. Include configurations under /etc/zabbix_proxy.conf.d/.
+9. Require configurations under /etc/zabbix_proxy.conf.d/ end in .conf
+   (other files are ignored for configuration purposes).
+---
+ conf/zabbix_proxy.conf | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/conf/zabbix_proxy.conf
++++ b/conf/zabbix_proxy.conf
+@@ -11,6 +11,7 @@
+ # Mandatory: no
+ # Default:
+ # ProxyMode=0
++ProxyMode=1
+ 
+ ### Option: Server
+ #	If ProxyMode is set to active mode:
+@@ -39,7 +40,7 @@ Server=127.0.0.1
+ # Default:
+ # Hostname=
+ 
+-Hostname=Zabbix proxy
++# Hostname=Zabbix proxy
+ 
+ ### Option: HostnameItem
+ #	Item used for generating Hostname if it is undefined.
+@@ -73,6 +74,7 @@ Hostname=Zabbix proxy
+ # Mandatory: no
+ # Default:
+ # LogType=file
++LogType=system
+ 
+ ### Option: LogFile
+ #	Log file name for LogType 'file' parameter.
+@@ -81,7 +83,7 @@ Hostname=Zabbix proxy
+ # Default:
+ # LogFile=
+ 
+-LogFile=/tmp/zabbix_proxy.log
++# LogFile=/tmp/zabbix_proxy.log
+ 
+ ### Option: LogFileSize
+ #	Maximum size of log file in MB.
+@@ -130,6 +132,7 @@ LogFile=/tmp/zabbix_proxy.log
+ # Mandatory: no
+ # Default:
+ # PidFile=/tmp/zabbix_proxy.pid
++PidFile=/var/run/zabbix-proxy/zabbix_proxy.pid
+ 
+ ### Option: SocketDir
+ #	IPC socket directory.
+@@ -613,6 +616,7 @@ Timeout=4
+ # Mandatory: no
+ # Default:
+ # FpingLocation=/usr/sbin/fping
++FpingLocation=/usr/bin/fping
+ 
+ ### Option: Fping6Location
+ #	Location of fping6.
+@@ -622,6 +626,7 @@ Timeout=4
+ # Mandatory: no
+ # Default:
+ # Fping6Location=/usr/sbin/fping6
++Fping6Location=
+ 
+ ### Option: SSHKeyLocation
+ #	Location of public and private keys for SSH checks and actions.
+@@ -667,6 +672,7 @@ LogSlowQueries=3000
+ # Mandatory: no
+ # Default:
+ # User=zabbix
++User=zabbix-proxy
+ 
+ ### Option: SSLCertLocation
+ #	Location of SSL client certificates.
+@@ -1051,3 +1057,4 @@ StatsAllowedIP=127.0.0.1
+ # Include=/usr/local/etc/zabbix_proxy.general.conf
+ # Include=/usr/local/etc/zabbix_proxy.conf.d/
+ # Include=/usr/local/etc/zabbix_proxy.conf.d/*.conf
++Include=/etc/zabbix_proxy.conf.d/*.conf

From 74100efab5384ea2c82ccb4a52870ff278ca12f9 Mon Sep 17 00:00:00 2001
From: "Daniel F. Dickinson" <dfdpublic@wildtechgarden.ca>
Date: Sat, 8 Aug 2026 12:43:53 -0400
Subject: [PATCH 11/11] zabbix: bump version to 7.0.29

July 28, 2026 LTS release: https://www.zabbix.com/rn/rn7.0.29

Patches refreshed (no changes required).

Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
(cherry picked from commit 5e84a9851b1651d650f1aae21209a12654cb90c9)
---
 admin/zabbix/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/admin/zabbix/Makefile b/admin/zabbix/Makefile
index eb951ef7bdfc5..316a4a4f5fb59 100644
--- a/admin/zabbix/Makefile
+++ b/admin/zabbix/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zabbix
-PKG_VERSION:=7.0.28
-PKG_RELEASE:=3
+PKG_VERSION:=7.0.29
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://cdn.zabbix.com/zabbix/sources/stable/$(basename $(PKG_VERSION))/ \
 	https://cdn.zabbix.com/zabbix/sources/oldstable/$(basename $(PKG_VERSION))/
-PKG_HASH:=020a2649a450a642c3d74577eb583ec175f4bd85ebe2c3d39ede399487e1da33
+PKG_HASH:=184d03454d7ff2d49fa1d292082ad335bce907ba22e30d54035d05329708ce32
 
 PKG_MAINTAINER:=Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
 PKG_LICENSE:=AGPL-3.0-only