Hi,
This is a quick howto on installing OpenKM in FreeBSD jails.
My setup is as follows:
Host running:
Jail 1 - webserver - 192.168.1.101 (running nginx)
Jail 2 - database server - 192.168.1.103 (running MariaDB)
Jail 3 - OpenKM server - 192.168.1.104 (running tomcat7 and OpenJDK7)
Host IP - 10.0.0.103
host firewall PF
first my pf.conf:
2. make sure the /etc/hosts file has right localhost ip for each jail.
Nginx configuration for virtual server:
you need to include the vserver conf in nginx.conf (include directive)
my server.xml within tomcat directory is as follows:
This is a quick howto on installing OpenKM in FreeBSD jails.
My setup is as follows:
Host running:
Code: Select all
I used ezjail to create the jails reference: https://forums.freebsd.org/threads/howt ... ost-26528310.1-RELEASE-p9Jail 1 - webserver - 192.168.1.101 (running nginx)
Jail 2 - database server - 192.168.1.103 (running MariaDB)
Jail 3 - OpenKM server - 192.168.1.104 (running tomcat7 and OpenJDK7)
Host IP - 10.0.0.103
host firewall PF
first my pf.conf:
Code: Select all
1. make sure OpenKM database has the right permissions for username@openkmhostname on database jail
int_if="bge0"
serverip="10.0.0.103"
set block-policy return
jail_if="lo1"
IP_JAIL_WEB="192.168.1.101"
IP_JAIL_DATA="192.168.1.103"
IP_JAIL_APP="192.168.1.104"
NET_JAIL="192.168.1.0/24"
PORT_WWW="{80,443}"
PORT_MYSQL="{3306}"
PORT_OPENKM="{8080}" # <-- last edited to change to OpenKM default port 8080 and only to include 8080
### all incoming traffic on external interface is normalized and fragmented
### packets are reassembled.
scrub in on $int_if all fragment reassemble
nat pass on $int_if from $NET_JAIL to any -> $serverip
rdr pass on $int_if proto tcp from any to $IP_JAIL_WEB port $PORT_OPENKM -> $IP_JAIL_APP
rdr pass on $int_if proto tcp from any to $serverip port $PORT_WWW -> $IP_JAIL_WEB
rdr pass on $int_if proto tcp from any to $IP_JAIL_APP port $PORT_MYSQL -> $IP_JAIL_DATA
#use with care and modify once everything is set up correctly
#pass out
#pass in
2. make sure the /etc/hosts file has right localhost ip for each jail.
Nginx configuration for virtual server:
you need to include the vserver conf in nginx.conf (include directive)
Code: Select all
make sure database server listening on the right port usually port 3306
server {
listen 192.168.1.101:80;
server_name docs.domain.com;
return 301 https://$server_name$request_uri;
}
server {
ssl_certificate /usr/local/etc/nginx/certs/domainserver.pem;
ssl_certificate_key /usr/local/etc/nginx/certs/domainserver.pem;
listen 192.168.1.101:443 ssl;
server_name dms.domain.com;
client_max_body_size 500M;
ssl_session_timeout 5m;
ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;
keepalive_timeout 360;
location /
{
rewrite ^/(.*) https://docs.domain.com/OpenKM/ permanent;
}
location /OpenKM/ {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://192.168.1.104:8484/OpenKM/;
proxy_connect_timeout 6000;
proxy_send_timeout 6000;
proxy_read_timeout 6000;
proxy_buffer_size 4k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
send_timeout 6000;
proxy_buffering off;
}
}
my server.xml within tomcat directory is as follows:
Code: Select all
<?xml version='1.0' encoding='utf-8'?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Note: A "Server" is not itself a "Container", so you may not
define subcomponents such as "Valves" at this level.
Documentation at /docs/config/server.html
-->
<Server port="8005" shutdown="SHUTDOWN">
<!-- Security listener. Documentation at /docs/config/listeners.html
<Listener className="org.apache.catalina.security.SecurityListener" />
-->
<!--APR library loader. Documentation at /docs/apr.html -->
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
<!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
<Listener className="org.apache.catalina.core.JasperListener" />
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
<!-- Automatically reload log4j configuration -->
<Listener className="com.openkm.util.Log4JInitializer" configFile="${catalina.base}/conf/log4j.properties"/>
<!-- Global JNDI resources
Documentation at /docs/jndi-resources-howto.html
-->
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
<!--
<Resource name="jdbc/OpenKMDS" auth="Container" type="javax.sql.DataSource"
maxActive="100" maxIdle="30" maxWait="10000" validationQuery="select 1 from INFORMATION_SCHEMA.SYSTEM_USERS"
username="sa" password="" driverClassName="org.hsqldb.jdbcDriver"
url="jdbc:hsqldb:${catalina.base}/repository/okmdb"/>
-->
<Resource name="jdbc/OpenKMDS" auth="Container" type="javax.sql.DataSource"
maxActive="100" maxIdle="30" maxWait="10000" validationQuery="select 1"
username="username" password="password" driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://192.168.1.103:3306/okm_db?autoReconnect=true&useUnicode=true&characterEncoding=UTF8"/>
<Resource name="mail/OpenKM" auth="Container" type="javax.mail.Session"
mail.transport.protocol="smtp"
mail.smtp.auth="true"
mail.smtp.host="smtp.gmail.com"
mail.smtp.port="465"
mail.smtp.user=""
password=""
mail.smtp.from=""
mail.smtp.quitwait="false"
mail.smtp.starttls.enable="true"
mail.smtp.socketFactory.class="javax.net.ssl.SSLSocketFactory"
mail.debug="true"/>
</GlobalNamingResources>
<!-- A "Service" is a collection of one or more "Connectors" that share
a single "Container" Note: A "Service" is not itself a "Container",
so you may not define subcomponents such as "Valves" at this level.
Documentation at /docs/config/service.html
-->
<Service name="Catalina">
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
maxThreads="150" minSpareThreads="4"/>
-->
<!-- A "Connector" represents an endpoint by which requests are received
and responses are returned. Documentation at :
Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
Java AJP Connector: /docs/config/ajp.html
APR (HTTP/AJP) Connector: /docs/apr.html
Define a non-SSL HTTP/1.1 Connector on port 8080
-->
<Connector port="8484" address="192.168.1.104" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<!-- A "Connector" using the shared thread pool-->
<!--
<Connector executor="tomcatThreadPool"
port="8080" address="127.0.0.1" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
-->
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<!--
<Connector port="8443" address="127.0.0.1" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
-->
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" address="192.168.1.104" protocol="AJP/1.3" redirectPort="8443" />
<!-- An Engine represents the entry point (within Catalina) that processes
every request. The Engine implementation for Tomcat stand alone
analyzes the HTTP headers included with the request, and passes them
on to the appropriate Host (virtual host).
Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="192.168.1.104">
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
via a brute-force attack -->
<Realm className="org.apache.catalina.realm.LockOutRealm">
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="192.168.1.104" appBase="webapps"
unpackWARs="true" autoDeploy="true">
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common" -->
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log." suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
</Host>
</Engine>
</Service>
</Server>
