don't start the zabbix server as root

the service got started as root, which is really bad. We now provide the
correct default user based on the operatingsystem, the user can
overwrite it and even start it as root if he wants (by passing
zabbix_user => undef).

manifests/init.pp

@@ -174,6 +174,7 @@
   $loadmodule                               = $zabbix::params::server_loadmodule,
   Boolean $manage_selinux                   = $zabbix::params::manage_selinux,
   String $additional_service_params         = $zabbix::params::additional_service_params,
+  Optional[String[1]] $zabbix_user          = $zabbix::params::server_zabbix_user,
 ) inherits zabbix::params {
 
   class { '::zabbix::web':

manifests/params.pp

@@ -25,6 +25,7 @@
       $agent_zabbix_user     = 'zabbix'
       $agent_config_group    = 'zabbix'
       $agent_pidfile         = '/var/run/zabbix/zabbix_agentd.pid'
+      $server_zabbix_user    = 'zabbix'
     }
     'Archlinux': {
       $server_fpinglocation  = '/usr/bin/fping'
@@ -38,6 +39,7 @@
       $agent_zabbix_user     = 'zabbix-agent'
       $agent_config_group    = 'zabbix-agent'
       $agent_pidfile         = undef
+      $server_zabbix_user    = 'zabbix-server'
     }
     'Fedora': {
       $server_fpinglocation  = '/usr/sbin/fping'
@@ -51,6 +53,7 @@
       $agent_zabbix_user     = 'zabbix'
       $agent_config_group    = 'zabbix'
       $agent_pidfile         = '/var/run/zabbix/zabbix_agentd.pid'
+      $server_zabbix_user    = 'zabbix'
     }
     default  : {
       $server_fpinglocation  = '/usr/sbin/fping'
@@ -64,6 +67,7 @@
       $agent_zabbix_user     = 'zabbix'
       $agent_config_group    = 'zabbix'
       $agent_pidfile         = '/var/run/zabbix/zabbix_agentd.pid'
+      $server_zabbix_user    = 'zabbix'
     }
   }
 

manifests/server.pp

@@ -373,6 +373,7 @@
   $sslkeylocation_dir               = $zabbix::params::server_sslkeylocation,
   Boolean $manage_selinux           = $zabbix::params::manage_selinux,
   String $additional_service_params = $zabbix::params::additional_service_params,
+  Optional[String[1]] $zabbix_user  = $zabbix::params::server_zabbix_user,
 ) inherits zabbix::params {
 
   # the following codeblock is a bit blargh. The correct default value for
@@ -457,6 +458,7 @@
     pidfile                   => $pidfile,
     database_type             => $database_type,
     server_configfile_path    => $server_configfile_path,
+    zabbix_user               => $zabbix_user,
     additional_service_params => $real_additional_service_params,
     require                   => Package["zabbix-server-${db}"],
   }

templates/zabbix-server-systemd.init.erb

@@ -16,6 +16,7 @@ PrivateDevices=yes
 PrivateTmp=yes
 ProtectSystem=full
 ProtectHome=yes
+<% if @zabbix_user %>User=<%= @zabbix_user %><% end %>
 
 [Install]
 WantedBy=multi-user.target