Portal environment

This file describes your network and HPA portal ports

A minimal environment.config, holding only the values to set, is stored in {{hpa_base_dir}}/hpa/environment.config.sample. The default of every variable is in {{hpa_base_dir}}/hpa/environment.config.default.

Mandatory values to modify

HPA_EXTERNAL_DNS : put the external DNS name of the HPA server, DNS should be accessible from end-user

This part must be done on first installation as keycloak login settings are build agains those values. If you have to modify something :

remove var/database-keycloak
restart the installation

HPA is deployed behind a proxy

When HPA is deployed behind a proxy :

often the proxy port is 443
HPA port is the Nginx port is by default 8443

Client -> Proxy (external port) -> HPA (Nginx port)
Client -> https://my-proxy.bank.com -> https://hpaserver:8443

To activate the correct configuration in HPA, uncomment :

#export HPA_EXTERNAL_PORT=443 : if proxy port is not standard, change 443 value

Defaults and overrides

environment.config holds the values of the installation, environment.config.default holds the default of every variable. Both files are loaded at every start, environment.config first : a variable set there keeps its value, a variable absent from it takes the default of environment.config.default.

An upgrade introducing a new variable is therefore installed without editing environment.config. The number of variables falling back to their default is shown during the installation, they have to be added to environment.config only when the default does not fit. The config_diff action lists them :

./controller.sh config_diff

Each variable is shown with the value it gets, secrets (*PASSWORD*, *PWD*, *SECRET*, *TOKEN*) being masked. Only the variables having a default are listed : the variables computed by the .default files from other values (such as the URLs of security.config) can not be overridden.

environment.config itself remains mandatory : the installation stops as long as the file does not exist, since HPA_EXTERNAL_DNS has no usable default. The .default files are mandatory too, they are delivered by the installation of a version : an action needing the environment stops when they are missing.

Reducing environment.config to its own values

An environment.config copied from the former template repeats every default. A default changed by an upgrade does not reach such an installation, since the site file answers first.

The clean_config action removes the variables already holding their default, and the comments repeating environment.config.default :

./controller.sh clean_config              # lists them, writes environment.config.cleaned
./controller.sh clean_config --apply      # rewrites environment.config, keeps a backup

Without --apply nothing is modified, the result is written next to the file for comparison. A variable is removed only when the environment obtained after the removal is strictly identical, so a value differing from the default, an empty value chosen on purpose or a variable unknown to environment.config.default are all preserved.

Environment.config file

#!/bin/bash
#
# Default values, sourced after environment.config : a value already set there wins.
# Site-tunable variable : export HPA_X=${HPA_X-default}, with "-" and not ":-" so that an
# empty value stays an explicit choice. Computed variable : plain assignment.
#

export HPA_BASE="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

# JVM 17
export HPA_JAVA_HOME=${HPA_JAVA_HOME-$HPA_BASE/modules/java/current}

# Introscope
export HPA_INTROSCOPE_JAVA_HOME=${HPA_INTROSCOPE_JAVA_HOME-$HPA_JAVA_HOME}

# External DNS without port
export HPA_EXTERNAL_DNS=${HPA_EXTERNAL_DNS-hpa-server.mydomain.com}

# External port, if empty or not defined, Nginx port will be used
#export HPA_EXTERNAL_PORT=443

# If HPA must be exposed on another path, do not add leading or trailing "/",
# ex : HPA_URL_CONTEXTPATH=portal/internal
# ex : HPA_URL_CONTEXTPATH=portal
# ex : (default) HPA_URL_CONTEXTPATH=
export HPA_URL_CONTEXTPATH=${HPA_URL_CONTEXTPATH-}

export HPA_NGINX_LISTENIP=${HPA_NGINX_LISTENIP-0.0.0.0}
export HPA_NGINX_PORT=${HPA_NGINX_PORT-8443}

export HPA_EM_DNS=${HPA_EM_DNS-$HPA_EXTERNAL_DNS}
export HPA_EM_LISTENIP=${HPA_EM_LISTENIP-0.0.0.0}
export HPA_EM_CHANNEL_PORT=${HPA_EM_CHANNEL_PORT-5001}
export HPA_EM_CHANNEL_PORT_SECURE=${HPA_EM_CHANNEL_PORT_SECURE-5443}

export HPA_KEYCLOAK_PORT=${HPA_KEYCLOAK_PORT-28444}
export HPA_KEYCLOAK_LISTENIP=${HPA_KEYCLOAK_LISTENIP-127.0.0.1}
export HPA_KEYCLOAK_DNS=${HPA_KEYCLOAK_DNS-$HPA_EXTERNAL_DNS}

export HPA_EM_WEB_HOST=${HPA_EM_WEB_HOST-127.0.0.1}
export HPA_EM_WEB_PORT=${HPA_EM_WEB_PORT-8081}

export HPA_EM_WEBVIEW_LISTENIP=${HPA_EM_WEBVIEW_LISTENIP-127.0.0.1}
export HPA_EM_WEBVIEW_PORT=${HPA_EM_WEBVIEW_PORT-8445}

export HPA_EM_POSTGRESQL_LISTENIP=${HPA_EM_POSTGRESQL_LISTENIP-127.0.0.1}
export HPA_EM_POSTGRESQL_PORT=${HPA_EM_POSTGRESQL_PORT-5432}
export HPA_EM_POSTGRESQL_USER=${HPA_EM_POSTGRESQL_USER-cemdbadmin}
export HPA_EM_POSTGRESQL_PASSWORD=${HPA_EM_POSTGRESQL_PASSWORD-putherethepassword}
export HPA_EXTRACTOR_APMSQL_USER=${HPA_EXTRACTOR_APMSQL_USER-apmsqlhexagon}
export HPA_EXTRACTOR_APMSQL_PASSWORD=${HPA_EXTRACTOR_APMSQL_PASSWORD-putherethepassword}

export HPA_EXTRACTOR_POSTGRESQL_LISTENIP=${HPA_EXTRACTOR_POSTGRESQL_LISTENIP-127.0.0.1}
export HPA_EXTRACTOR_POSTGRESQL_PORT=${HPA_EXTRACTOR_POSTGRESQL_PORT-5555}
export HPA_EXTRACTOR_POSTGRESQL_USER=${HPA_EXTRACTOR_POSTGRESQL_USER-hpa_user}
export HPA_EXTRACTOR_POSTGRESQL_PASSWORD=${HPA_EXTRACTOR_POSTGRESQL_PASSWORD-putherethepassword}

# Keycloak service-account secret for the hpa-mcp-client confidential client (client-credentials
# grant used by the MCP server to call server's API)
export HPA_MCP_CLIENT_SECRET=${HPA_MCP_CLIENT_SECRET-putherethepassword}

export HPA_MCP_PORT=${HPA_MCP_PORT-28090}
export HPA_MCP_LISTENIP=${HPA_MCP_LISTENIP-127.0.0.1}

export HPA_EXTRACTOR_PORT=${HPA_EXTRACTOR_PORT-18080}
export HPA_EXTRACTOR_LISTENIP=${HPA_EXTRACTOR_LISTENIP-127.0.0.1}

export HPA_SERVER_PORT=${HPA_SERVER_PORT-28443}
export HPA_SERVER_LISTENIP=${HPA_SERVER_LISTENIP-127.0.0.1}
export HPA_SERVER_DNS=${HPA_SERVER_DNS-$HPA_EXTERNAL_DNS}

export HPA_ENVIRONMENT_CONFIGFILE=${HPA_ENVIRONMENT_CONFIGFILE-$HPA_BASE/environment.yml}
#export HPA_USER_FILE=$HPA_BASE/user.properties

# For Host monitoring
export HPA_CALYPSO_EPAGENT_PORT=${HPA_CALYPSO_EPAGENT_PORT-48080}
export HPA_CALYPSO_EPAGENT_COLLECTOR_PORT=${HPA_CALYPSO_EPAGENT_COLLECTOR_PORT-5005}

# JVM options for hpa-extractor (default: -Xmx2G)
#export HPA_EXTRACTOR_JOPTS="-Xmx2G"

# JVM options for hpa-portal-server (default: -Xmx1G)
#export HPA_SERVER_JOPTS="-Xmx1G"

# Dump directory (debug session, config exports, dbrequests)
# Uncomment to set another directory than default one (./var/hpadumpsessions)
# export BASEDIR_DUMPSESSION=

JVM tuning

By default the JVM heap limits are:

hpa-extractor: -Xmx2G
hpa-portal-server: -Xmx1G

These can be overridden by setting HPA_EXTRACTOR_JOPTS or HPA_SERVER_JOPTS in environment.config. The variable replaces the default heap option entirely, so include all desired JVM flags:

export HPA_EXTRACTOR_JOPTS="-Xmx4G"
export HPA_SERVER_JOPTS="-Xmx2G"

Restart the relevant module after changing these values.

If restricted firewall rules

Check against your firewall rules if default ports are authorized

HPA_EM_PORT HPA_KEYCLOAK_PORT HPA_EM_WEBVIEW_PORT HPA_SERVER_PORT

These ports must be opened to external network : end-user or calypso environments, see the firewall rules.

If restriction on internal server port

The others values should not be modified except if some of these ports are already used on the target HPA server.

HPA installation and deployment HPA portal Portal configuration Configuration file - environment.config