Introduction. In Openfire host, external ports 80 and 443 must be redirect to 7443 and 5222 respectively.

Transcription

1 GUIDE TO DEPLOYMENT

2 Introduction This document describes the basic system infrastructure, architecture and configuration details for Mosaic/HUB backend server. It is not conceived as a how-to document but a snapshot and brief but complete enough description of the architecture. W e try to avoid as much as possible forcing any specific configuration, security parameters, directories structure, services management or configuration management tool, so the person in charge could choose the most appropriated for his infrastructure. Nevertheless, it should be almost straightforward to clone and deploy an environment similar to our installation in our servers. We provide a zip file with all configuration files, certificates, deployment files and an example directory structure together with the links to the necessary files. Installing the services listed above and copying the required files, should be enough for a working environment. Any further configuration details about logging, monitoring, service daemon management, configuration management tools, backups, etc. is left to the person or department in charge In Openfire host, external ports 80 and 443 must be redirect to 7443 and 5222 respectively.

3 Our backend is composed by the following services: Wildfly JEE application server. Openfire XMPP server. Hazelcast. Netty-Socket.io service for drawing real time. Nginx for both serving the web application and proxying requests to the API running in Wildfly. MySQL database as persistence engine. Services start order: To make sure the environment is started correctly, you need to follow the following order: 1. MySQL 2. Hazelcast 3. Openfire 4. Wildfly 5. Netty-Socket.io 6. Nginx

4 Hardware architecture and requirements The minimal deploy is a single server for Nginx, Wilfly, Openfire, Netty- Socket.io, Hazelcast and MySQL plus 1 to 5 Coturn server(s). In this case, a server with 8 GB of memory and 4 CPU core is enough, but we recommend at least 8 Gb and 6 CPU core for a production environment. However, we recommend the following configuration using 3 different servers for the application components and 5 servers for Coturn: Server1: Nginx + Wildfly + Hazelcast (Memory 4Gb, 4 CPU) Server2: XMPP (Memory 4Gb, 2 CPU) Server3: Database (Memory 4Gb, 2 CPU) Server4: Netty-Socket.io (Memory 4Gb, 2 CPU) Server5-9: Coturn Two IP public addresses are necessary, one for HTTP API and another for XMPP.

5 Core components & Versions Regarding the services which are third parties, we recommend following versions for the bootstrap deployment. These components can be downloaded from their respective websites. The service netty-socket.io is developed by DisplayNote. Although it should work with later releases (probably with some configuration changes), we can't guarantee it, especially the services Wildfly and Hazelcast. Since we use a modified core of Openfire, we only recommend use version Wildfly Openfire Hazelcast Nginx Coturn MySQL 5.6 Netty-Socket.io Oracle Java JRE (>=1.8.0_45) is a requirement for Wildfly, Openfire and Hazelcast. We recommend Ubuntu >=14.04 as operating system, but other Linux distributions should work fine as well.

6 Wildfly Configuration and deploy files: <wildfly home>/bin/standalone.conf <wildly home>/standalone/configuration/standalone.xml <wildly home>/standalone/configuration/ssl/keystore.jks <wildly home>/standalone/configuration/worzel_roles.properties <wildfly home>/modules/system/layers/base/com/displaynote/auth/main/bcryptlogin-module-1.1.jar <wildfly home>/modules/system/layers/base/com/mysql/main/mysqlconnector-java jar <wildfly home>/standalone/deployments/release-canvas-enterpriseapp final.ear Both Openfire and Wildfly use the same JKS file format for SSL encryption. This configuration assumes that the host where Wildfly runs can resolve the host dbserver to the database server IP, for example from an entry in /etc/hosts Download link: Final.zip Wildfly connects to MySQL server with credentials 'candela / password' which can be modified in file <wildfly_home>/standalone/configuration/standalone.xml. <xa-datasource jndi-name="java:jboss/datasources/candelaxads" poolname="mysqlcandelaxads" enabled="true" use-java-context="true">... <security> <user-name>candela</user-name> <password>password</password> </security>... </xa-datasource>

7 Openfire Port 5222 is used for XMP and port 7443 listens for WebSocket/HTTP bind incoming connections. External ports 80 and 443 must be redirect to 7443 and 5222 respectively. Configuration and deploy files: <openfire home>/resources/security/keystore.jks <openfire home>/conf/openfire.xml <openfire home>/conf/security.xml <openfire home>/plugins/canvas.jar <openfire home>/plugins/websocket.jar <openfire home>/lib/guava jar <openfire home>/lib/openfire.jar We provide you the application components canvas.jar, websocket.jar and openfire.jar, the current configuration files openfire.xml, security.xml and keystore.jks certificate from production servers. The default configuration assumes that Openfire's home is /opt/openfire. Otherwise, you would need to modify the entries of ofproperty table whose name='xmpp.socket.ssl.client.keystore' and name='xmpp.bosh.ssl.client.keystore' to point to the right path. Download link: filename=openfire/openfire_4_0_2.tar.gz Openfire connects to MySQL server with credentials 'candela / password' which can be modified in file openfire.xml. <database> <defaultprovider>... <username>candela</username> <password>password</password>... </defaultprovider> </database>

8 Hazelcast Configuration files: hazelcast.xml If the Hazelcast service is not running on the same machine as Wildfly or Openfire then you will need to add an entry to ofproperty table where name = 'hazelcast.instance.0' and propvalue = <IP of the hazelcast instance> Additional security can be added modifying hazelcast.xml file to restrict the listening port of the instance. <interfaces enabled="true"> <interface>listening IP</interface> </interfaces> Download link: hazelcast Nginx Nginx has two proposals: Proxy HTTPS requests to Wildfly. o Configuration file: nginx/api.conf Proxy HTTPS request to Netty-Socket.io. o Configuration file: nginx/hub.conf It could be replaced with any other HTTP(s) proxy that accomplish with the same tasks. We provide SSL certificates according to the nginx configuration and web client deployment.

9 Coturn We use Coturn as STUN/TURN server. The authentication mechanism is through username and password. At least one instance of Coturn is mandatory for the application, the maximum number of Coturn servers supported for the current version is 5. Our standard configuration consists of one server for each of the above domains, to have global coverage. The clients and receiver applications expect to resolve a Coturn server in at least one of these specific domains (which may be or not physically located in that region): stunturn-ireland.yourdomain.com stunturn-virginia.yourdomain.com stunturn-california.yourdomain.com stunturn-singapore.yourdomain.com stunturn-mumbai.yourdomain.com This is planned to be replaced for a more dynamic configuration in following versions. Configuration files: /etc/turnserver.conf Ports: The server's firewall must allow incoming traffic for ports: 443 TCP/UDP UDP Download Page

10 Netty-Socket.io This service is necessary for real time communication between HUBs and it is based in a Java implementation of Socket.io framework over an asynchronous and event driven server as Netty. The service can expose a secure HTTPS port that has to be reachable for clients (we recommend using Nginx as proxy). For client authentication, Netty-Socket.io will use the API service deployed in Wildfly. Configuration files: etc/config.ini etc/logging.properties Installation Checklist & Trouble Shooting Domains resolve correctly and ports are open (check connection with telnet): xmpp.yourdomain.com (Openfire) api.yourdomain.com (Nginx) (Nginx) stunturn-ireland.yourdomain.com stunturn-california.yourdomain.com stunturn-virginia.yourdomain.com stunturn-mumbai.yourdomain.com stunturn-singapore.yourdomain.com A file with extension.deployed is located in directory <wildfly_home>/standalone/deployments/ The receiver application generates a 6-digit meeting id when all services are running. From Netty-Socket.io service, be sure that the validationapi.url host set in config.ini is reachable.