Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
Next revision Both sides next revision
tutorial:adm:server_preparation_tmp [2020/03/11 10:05]
urbanl [DB server configuration] 		tutorial:adm:server_preparation_tmp [2020/03/12 09:53]
urbanl [2. JDBC driver installation ​- CentOS8 ​]
Line 227: Line 227:
 For Debian installation, edit those configuration files instead: For Debian installation, edit those configuration files instead:
 <code> <code>
-/etc/postgresql/9.6/main/pg_hba.conf +/etc/postgresql/12/main/pg_hba.conf 
-/etc/postgresql/9.6/main/postgresql.conf+/etc/postgresql/12/main/postgresql.conf
 </code> </code>
  
 <note>If you install the database to a different server than the CzechIdM application itself (Tomcat etc.), don't forget to configure PostgreSQL to allow remote SSL connection from that server.</note> <note>If you install the database to a different server than the CzechIdM application itself (Tomcat etc.), don't forget to configure PostgreSQL to allow remote SSL connection from that server.</note>
  
-===== Java - CentOS7 =====+===== Java - CentOS8 -! CHANGED =====
  
-Java must be installed before Tomcat start. It is recommended to use OpenJDK (at least 1.8) from standard OS repository.+Java must be installed before Tomcat start. It is recommended to use OpenJDK (at least 1.11) from standard OS repository.
  
 Installation: Installation:
 <code bash> <code bash>
-yum install -y java-1.8.0-openjdk-headless java-1.8.0-openjdk-devel+yum install -y java-11-openjdk-headless java-11-openjdk-devel
 </code> </code>
  
Line 445: Line 445:
 <Server port="-1" shutdown="SHUTDOWN"> <Server port="-1" shutdown="SHUTDOWN">
 </code> </code>
 +-! CHANGED
   * Make Tomcat listen only on localhost:   * Make Tomcat listen only on localhost:
-    * In the ''/opt/tomcat/current/conf/server.xml'' add the ''address="127.0.0.1"'' property to configuration of ''8009'' and ''8080'' ports.+    * In the ''/opt/tomcat/current/conf/server.xml'' add the ''address="127.0.0.1"'' property to configuration of ''8080'' port. 
 +    * In same file configure ajp port(''8009'') to look like this: 
 + 
 +    <Connector protocol="AJP/1.3" 
 +                address="127.0.0.1" 
 +                secretRequired="true" 
 +                secret="***password for ajp port***" 
 +                port="8009" 
 +                redirectPort="8443" /> 
  
   * Do not show aplication server version:   * Do not show aplication server version:
Line 531: Line 541:
 </code> </code>
  
-HTTPd basic configuration:+HTTPd basic configuration -!CHANGED:
  
-Change MPM to worker (lower system requirements) - in the file ''/etc/httpd/conf.modules.d/00-mpm.conf'' comment the lines with mod\_mpm\_prefork.so and uncomment mod\_mpm\_worker.so:+Change MPM to worker (lower system requirements) - in the file ''/etc/httpd/conf.modules.d/00-mpm.conf'' comment all lines but mod\_mpm\_worker.so:
  
 <code bash> <code bash>
Line 794: Line 804:
 If you want to enable SSO to CzechIdM, additional configuration must be done with mod\_auth\_kerb. See [[tutorial:adm:sso_ad_domain#configure_apache_httpd_-_linux|SSO installation guide]] for more details. If you want to enable SSO to CzechIdM, additional configuration must be done with mod\_auth\_kerb. See [[tutorial:adm:sso_ad_domain#configure_apache_httpd_-_linux|SSO installation guide]] for more details.
  
-====== nginx as reverse proxy ======+====== INSTALACTNI NAVOD ======
  
-In case that you want to use nginx instead of Apache httpd, the configuration is as follows. +==== 2. JDBC driver installation ​- CentOS8 ​====  
 +**CentOS**
  
-<code ini> +Install the package with PostgreSQL JDBC driver:
-server { +
- listen   *:443 ssl http2; +
- server_name  idm.domain.tld; +
- client_max_body_size 1G; +
- ssl on; +
- ssl_certificate      /path/to/fullchain.pem; +
- ssl_certificate_key  /path/to/privkey.pem; +
- gzip on; +
- gzip_proxied any; +
- gzip_types +
-        text/css +
-        text/javascript +
-        text/xml +
-        text/plain +
-        application/javascript +
-        application/x-javascript +
-        application/json;+
  
- location / { +<code bash> 
- proxy_hide_header X-Frame-Options; +yum install -y postgresql-jdbc 
- add_header X-Frame-Options SAMEORIGIN; +</code>
- proxy_pass http://localhost:8080/; +
- proxy_set_header Host $host; +
- proxy_set_header X-Real-IP $remote_addr; +
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +
- proxy_set_header X-Forwarded-Proto "https"; +
- proxy_ssl_session_reuse off; +
- proxy_redirect off;+
  
- # WebSocket support +allow Tomcat to use the driver: 
- proxy_http_version 1.1; + 
-     proxy_set_header Upgrade $http_upgrade; +<code bash> 
-     proxy_set_header Connection "upgrade"; +ln -s /usr/share/java/postgresql-jdbc.jar /opt/tomcat/current/lib/
- } +
-}+
 </code> </code>
  
 +==== Application properties ​==== 
 +
 +  * The most important file is **/opt/czechidm/etc/application-production.properties** (application-PROFILE.properties, where the PROFILE is the profile you run the IdM under). You can use most of the file as-is, there is a bit of configuration needed though. This is a template file:
 +
 +<file properties application-production.properties>
 +# Doc: https://wiki.czechidm.com/devel/dev/configuration/backend
 + 
 +idm.pub.app.instanceId=idm-primary
 +idm.pub.app.stage=production
 + 
 +spring.datasource.url=jdbc:postgresql://localhost:5432/czechidm
 +spring.datasource.username=czechidm
 +spring.datasource.password=********** TODO *********
 +spring.datasource.driver-class-name=org.postgresql.Driver
 +spring.datasource.validationQuery=SELECT 1
 +spring.datasource.test-on-borrow=true
 +spring.jpa.generate-ddl=false
 +spring.jpa.hibernate.ddl-auto=none
 +flyway.enabled=true
 + 
 +
 +scheduler.properties.location=quartz-production.properties
 +
 +logging.config=/opt/czechidm/etc/logback-spring.xml
 +
 +idm.sec.core.demo.data.enabled=false
 +
 +# attachments will be stored under this path.
 +# new directories for attachment will be created in this folder (permissions has to be added)
 +# System.getProperty("user.home")/idm_data will be used if no path is given
 +idm.sec.core.attachment.storagePath=/opt/czechidm/data
 +# configuration property for default backup 
 +idm.sec.core.backups.default.folder.path=/opt/czechidm/backup
 +
 + 
 +idm.pub.security.allowed-origins=http://localhost
 +# Generate JWT token security string as "cat /dev/urandom | tr -dc 'a-z0-9' | head -c VALUE" where VALUE can be from 1 to 255.
 +# We recommend the VALUE to be at least 25.
 +idm.sec.security.jwt.secret.token=********** TODO *********
 +idm.sec.security.jwt.expirationTimeout=36000000
 +
 +# Cipher secret key for crypt values in confidential storage
 +# for crypt values is used secretKey or secretKey defined by file - secretKeyPath
 +#cipher.crypt.secret.key=XXXXXXXXXXXXXXXX
 +cipher.crypt.secret.keyPath=/opt/czechidm/etc/secret.key
 +
 +# Defaults for: emailer.*
 +# test.enabled=true means mail WILL NOT be sent
 +idm.sec.core.emailer.test.enabled=true
 +# http://camel.apache.org/mail.html
 +idm.sec.core.emailer.protocol=smtp
 +idm.sec.core.emailer.host=something.tld
 +idm.sec.core.emailer.port=25
 +# idm.sec.core.emailer.username=czechidm@domain.tld
 +# idm.sec.core.emailer.password=password
 +idm.sec.core.emailer.from=czechidm@localhost
 + 
 +# Default user role will be added automatically, after an identity is logged in
 +# could contains default authorities and authority policies configuration
 +# for adding autocomplete or all record read permission etc.
 +idm.sec.core.role.default=userRole
 +# Admin user role
 +idm.sec.core.role.admin=superAdminRole
 +
 +# Max file size of uploaded file. Values can use the suffixed "MB" or "KB" to indicate a Megabyte or Kilobyte size.
 +spring.servlet.multipart.max-file-size=100MB
 +spring.servlet.multipart.max-request-size=100MB
 +</file>
 +
 +
 +
 +