From 2695379589b6ea825009b6b9be5098ce7cca6389 Mon Sep 17 00:00:00 2001
From: Christoph Gasser <cg@stranto.com>
Date: Fri, 17 Apr 2026 10:07:41 +0200
Subject: [PATCH] Add Zabbix API token authentication support

ZABBIX_API_TOKEN env var can now be used instead of ZABBIX_USER +
ZABBIX_PASSWORD. When set, the token is passed directly as the auth
value in JSON-RPC calls and no login/logout session is created.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/config.py      | 2 ++
 app/zabbix.py      | 9 +++++++--
 docker-compose.yml | 7 +++++--
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/app/config.py b/app/config.py
index 75f04c6..e3c4097 100644
--- a/app/config.py
+++ b/app/config.py
@@ -7,6 +7,8 @@ YODECK_POLL_INTERVAL_MINUTES = int(os.environ.get('YODECK_POLL_INTERVAL_MINUTES'
 
 # Zabbix (all optional — leave ZABBIX_URL empty to disable)
 ZABBIX_URL = os.environ.get('ZABBIX_URL', '')
+# Authentication: set ZABBIX_API_TOKEN (preferred) OR ZABBIX_USER + ZABBIX_PASSWORD
+ZABBIX_API_TOKEN = os.environ.get('ZABBIX_API_TOKEN', '')
 ZABBIX_USER = os.environ.get('ZABBIX_USER', 'Admin')
 ZABBIX_PASSWORD = os.environ.get('ZABBIX_PASSWORD', '')
 ZABBIX_HOST_GROUP = os.environ.get('ZABBIX_HOST_GROUP', 'Yodeck Players')
diff --git a/app/zabbix.py b/app/zabbix.py
index 229fa08..e9adcb7 100644
--- a/app/zabbix.py
+++ b/app/zabbix.py
@@ -10,7 +10,7 @@ Each Yodeck player becomes a Zabbix host with:
 import logging
 import requests
 from app.config import (
-    ZABBIX_URL, ZABBIX_USER, ZABBIX_PASSWORD,
+    ZABBIX_URL, ZABBIX_API_TOKEN, ZABBIX_USER, ZABBIX_PASSWORD,
     ZABBIX_HOST_GROUP, ZABBIX_SNMP_COMMUNITY,
     APP_HOST, ENTERPRISE_OID,
 )
@@ -47,9 +47,14 @@ class ZabbixClient:
         return body['result']
 
     def login(self):
-        self._auth = self._call('user.login', {'user': ZABBIX_USER, 'password': ZABBIX_PASSWORD})
+        if ZABBIX_API_TOKEN:
+            self._auth = ZABBIX_API_TOKEN   # API token used directly — no session needed
+        else:
+            self._auth = self._call('user.login', {'user': ZABBIX_USER, 'password': ZABBIX_PASSWORD})
 
     def logout(self):
+        if ZABBIX_API_TOKEN:
+            return  # API tokens have no session to invalidate
         try:
             self._call('user.logout', [])
         except Exception:
diff --git a/docker-compose.yml b/docker-compose.yml
index 4c099d9..14c658a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,8 +28,11 @@ services:
 
       # ── Zabbix API (optional) ─────────────────────────────────────────────
       # Leave ZABBIX_URL empty to disable automatic host management.
-      # Requires Zabbix 6.0+.
-      ZABBIX_URL: "https://monitor.stranto.com"              # e.g. "http://zabbix.example.com"
+      # Requires Zabbix 5.4+.
+      ZABBIX_URL: "https://monitor.stranto.com"
+      # Use an API token (preferred) OR user + password — not both.
+      # Create token in Zabbix: Administration → API tokens → Create API token
+      ZABBIX_API_TOKEN: ""
       ZABBIX_USER: "odmon"
       ZABBIX_PASSWORD: "lk09u834ojnaslvnjh09u34g"
       ZABBIX_HOST_GROUP: "Yodeck Players"