If necessary create a new user:
adduser kalaschnikow
And add this user to the sudoers group:
usermod -aG sudo kalaschnikow
Edit the sshd_config file:
sudo nano /etc/ssh/sshd_config
Change following options in it:
Port 1002
PermitRootLogin no
AllowUsers kalaschnikow
To apply the new settings reload the SSH service:
sudo service ssh reload
More about SSH hardening: https://major.io/2013/05/14/changing-your-ssh-servers-port-from-the-default-is-it-worth-it/
https://docs.docker.com/install/linux/docker-ce/ubuntu/#install-docker-ce-1
After that install docker-compose: https://docs.docker.com/compose/install/
After that create directories for our installation:
sudo mkdir -p /dockerdata/avril/upload sudo mkdir -p /dockerdata/avril/wildfly/upload sudo mkdir -p /dockerdata/avril/wildfly/deployments sudo mkdir -p /dockerdata/avrilmysql sudo mkdir -p /dockerdata/keycloakmysql sudo mkdir -p /dockerdata/_artifacts sudo mkdir -p /dockerdata/_projects/Avril sudo mkdir -p /dockerdata/_projects/AvrilKeycloak sudo mkdir -p /dockerdata/_projects/AvrilRabbitMQ # make dirs for volumes (see docker-compose.yml for all volumes): # # keycloakmysql service sudo mkdir -p /dockerdata/volumes/keycloakmysql # avrilkeycloak service sudo mkdir -p /dockerdata/volumes/avrilkeycloak # avrilmysql service sudo mkdir -p /dockerdata/volumes/avrilmysql # avril service sudo mkdir -p /dockerdata/volumes/avril/modules/system/add-ons sudo mkdir -p /dockerdata/volumes/avril/wildfly/deployments sudo mkdir -p /dockerdata/volumes/avril/wildfly/standalone/configuration sudo mkdir -p /dockerdata/volumes/avril/wildfly/standalone/log sudo mkdir -p /dockerdata/volumes/avril/upload sudo mkdir -p /dockerdata/volumes/avril/wildfly/upload sudo mkdir -p /dockerdata/volumes/avril/modules/system/layers/base/com/mysql # avriljrserver service sudo mkdir -p /dockerdata/volumes/jrserver/license sudo mkdir -p /dockerdata/volumes/jrserver/reports # avrilrabbitmq service sudo mkdir -p /dockerdata/volumes/avrilrabbitmq/log # avrilnginx service sudo mkdir -p /dockerdata/volumes/avrilnginx/logs
Or all-in-one command → make all directories (except of volumes):
mkdir /dockerdata && mkdir /dockerdata/avril && mkdir /dockerdata/avril/upload && \ mkdir /dockerdata/avril/wildfly && mkdir /dockerdata/avril/wildfly/upload && mkdir /dockerdata/avril/wildfly/deployments && \ mkdir /dockerdata/avrilmysql && mkdir /dockerdata/keycloakmysql && \ mkdir /dockerdata/_artifacts && mkdir /dockerdata/_projects && mkdir /dockerdata/_projects/Avril && \ mkdir /dockerdata/_projects/AvrilKeycloak && mkdir /dockerdata/_projects/AvrilRabbitMQ
Move databases (zipped previously on the source system) to the new server with:
# on the old server cd /dockerdata/volumes sudo zip -r keycloakmysql.zip keycloakmysql sudo zip -r avrilmysql.zip avrilmysql # then copy zip files to the target system scp -P1002 *.zip kalaschnikow@avril2021.avril.work:/home/kalaschnikow
After that (on the new server):
mv ~/*.zip /dockerdata/_artifacts cd /dockerdata/_artifacts unzip avrilmysql.zip unzip keycloakmysql.zip # move the inflated directories to /dockerdata/volumes mv avrilmysql ../volumes mv keycloakmysql ../volumes cd ../volumes chmod -R a+w keycloakmysql
Create user-defined network avrilnet, in which all our containers will run:
sudo docker network create avrilnet
At first create the container for the keycloak database. The best option is to create it with docker-compose. So simply add the following service to the docker-compose.yml (see the avril workspace for the latest version!) :
keycloakmysql:
image: mysql:5.5
environment:
- MYSQL_DATABASE=keycloak
- MYSQL_USER=keycloak
- MYSQL_PASSWORD=keycYaopnlp=8
- MYSQL_ROOT_PASSWORD=mysqlYaopnlp=8
ports:
- "3307:3306"
volumes:
- /dockerdata/volumes/keycloakmysql:/var/lib/mysql
networks:
default:
aliases:
- keycloakmysql
#
# To deploy in docker swarm instead of 'restart' use the following:
#
# deploy:
# restart_policy:
# condition: on-failure
# delay: 5s
# max_attempts: 3
restart: on-failure
Another option is to create the container with docker run:
sudo docker run --network avrilnet -p 3307:3306 \ --name keycloakmysql -v /dockerdata/keycloakmysql:/var/lib/mysql \ -e MYSQL_DATABASE=keycloak -e MYSQL_USER=keycloak -e MYSQL_PASSWORD=keycYaopnlp=8 \ -e MYSQL_ROOT_PASSWORD=mysqlYaopnlp=8 -d mysql:5.5
# # ### On SRC server ### # # pack AvrilKeycloak image sudo docker save -o ./AvrilKeycloak.tar avrilkeycloak:latest # copy file to the DEST server scp AvrilKeycloak.tar -P1002 kalaschnikow@avril2021.avril.work:/home/kalaschnikow # # ### On DEST server ### # # copy file to _artifacts folder cd /dockerdata/_artifacts mv ~/AvrilKeycloak.tar . # load AvrilKeycloak image sudo docker load -i AvrilKeycloak.tar
Then copy standalone.xml from the old server to the new:
cd /dockerdata/volumes/avrilkeycloak scp -P1002 stand* kalaschnikow@avril2021.avril.work:/home/kalaschnikow # on the new server: cd /dockerdata/volumes/avrilkeycloak cp ~/standalone.xml .
After that start the compose:
cd /dockerdata/compose sudo docker-compose up -d
Now we should have two services running: avrilkeycloak and keycloakmysql.
Caution: it does not work 100%, so at the moment moving the image from the old server would be a better option.
Under /dockerdata/_projects/AvrilKeycloak create the file Dockerfile with the following contents:
FROM jboss/keycloak:latest COPY standalone.xml /opt/jboss/keycloak/standalone/configuration/ COPY standalone-ha.xml /opt/jboss/keycloak/standalone/configuration/ #USER jboss #RUN sed -i -e 's/<web-context>auth<\/web-context>/<web-context>keycloak\/auth<\/web-context>/' /opt/jboss/keycloak/standalone/configuration/standalone.xml #RUN sed -i -e 's/<web-context>auth<\/web-context>/<web-context>keycloak\/auth<\/web-context>/' /opt/jboss/keycloak/standalone/configuration/standalone-ha.xml CMD ["-b", "0.0.0.0", "-Djboss.socket.binding.port-offset=100"]
Old content of Dockerfile:
FROM jboss/keycloak:4.7.0.Final CMD ["-b", "0.0.0.0", "-Djboss.socket.binding.port-offset=100"]
Copy /mnt/sda4/development/workspaces/AvrilServer/DockerImages/AvrilKeycloak/src/main/resources/standalone.xml and /mnt/sda4/development/workspaces/AvrilServer/DockerImages/AvrilKeycloak/src/main/resources/standalone-ha.xml to /dockerdata/_projects/AvrilKeycloak on the new server:
cd /mnt/sda4/development/workspaces/AvrilServer/DockerImages/AvrilKeycloak/src/main/resources/ scp -P1002 standalone*.xml kalaschnikow@avril2021.avril.work:/home/kalaschnikow # then on the new server: cd /dockerdata/_projects/AvrilKeycloak sudo mv ~/Dockerfile . sudo mv ~/standalone.xml . sudo mv ~/standalone-ha.xml .
Build the image for keycloak server:
cd /dockerdata/_projects/AvrilKeycloak sudo docker image build --tag avrilkeycloak .
Add following service to docker-compose.yml (see the avril workspace for the latest version!):
avrilkeycloak:
image: avrilkeycloak
environment:
- DB_VENDOR=mysql
- DB_ADDR=keycloakmysql
- MYSQL_PORT_3306_TCP_ADDR=keycloakmysql
- MYSQL_PORT_3306_TCP_PORT=3307
- MYSQL_PASSWORD=keycYaopnlp=8
- PROXY_ADDRESS_FORWARDING=true
ports:
- "8180:8180"
volumes:
- /dockerdata/volumes/avrilkeycloak/standalone.xml:/opt/jboss/keycloak/standalone/configuration/standalone.xml
depends_on:
- keycloakmysql
networks:
default:
aliases:
- avrilkeycloak
restart: on-failure
Then copy standalone.xml from the old server to the new:
cd /dockerdata/volumes/avrilkeycloak scp -P1002 stand* kalaschnikow@avril2021.avril.work:/home/kalaschnikow # on the new server: cd /dockerdata/volumes/avrilkeycloak cp ~/standalone.xml .
After that start the compose:
cd /dockerdata/compose sudo docker-compose up -d
Now we should have two services running: avrilkeycloak and keycloakmysql.
Create a container for keycloak server and run it:
sudo docker image build --tag avrilkeycloak . sudo docker run --network avrilnet --name avrilkeycloak -p 8180:8180 -e DB_VENDOR=mysql -e DB_ADDR=keycloakmysql -e MYSQL_PORT_3306_TCP_ADDR=keycloakmysql -e MYSQL_PORT_3306_TCP_PORT=3306 -e MYSQL_PASSWORD=keycYaopnlp=8 -d avrilkeycloak
Now the containers can be started: sudo docker start keycloakmysql && sudo docker start avrilkeycloak
If necessary: open the Keycloak admin console, go to “Clients” and change “Root URL” for:
At first move all necesary config files from old server to the new
cd /dockerdata/volumes/avrilnginx scp -P1002 *.conf kalaschnikow@avril2021.avril.work:/home/kalaschnikow # then on the new server: mv ~/*.conf .
Then open the file nginx.conf in editor and change all old IPs to the new:
...
Also change lines:
ssl_certificate /etc/letsencrypt/live/avril2021.avril.work/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/avril2021.avril.work/privkey.pem;
# ssl_trusted_certificate /etc/letsencrypt/live/avril2021.avril.work/chain.pem;
Get Let's Encrypt certificates using certbot:
sudo certbot certonly --standalone -d avril2021.avril.work --email info@avril.work -n --agree-tos --expand
(maybe the better way would be to get certificates not with –standalone option but with –nginx, but I don't really know how to do it)
After that don't forget to renew the certificates before they expire (see Avril and Let's Encrypt Certificates)! So either set an appointment in Google Calendar or (better) troubleshoot the renewing (sudo certbot renew –dry-run).
The best option is to create it with docker-compose. So simply add the following service to the docker-compose.yml (see the avril workspace for the latest version!) :
avrilnginx:
image: nginx:latest
ports:
- "80:80"
- "443:443"
- "8183:8183"
volumes:
- /dockerdata/volumes/avrilnginx/nginx.conf:/etc/nginx/nginx.conf
- /dockerdata/volumes/avrilnginx/proxy_params.conf:/etc/nginx/proxy_params.conf
- /etc/letsencrypt/:/etc/letsencrypt/
- /dockerdata/volumes/avrilnginx/logs/:/var/log/nginx
restart: on-failure
Another option is to create the container with docker run:
# not yet documented... # something like: # sudo docker run --network avrilnet -p 3307:3306 \ # --name avrilnginx -v ... -d nginx
Add the following service to the /dockerdata/compose/docker-compose.yml (see the avril workspace for the latest version!):
avrilmysql:
image: mysql:5.5
environment:
- MYSQL_DATABASE=avril
- MYSQL_USER=avril
- MYSQL_PASSWORD=avrilYaopnlp=8
- MYSQL_ROOT_PASSWORD=mysqlYaopnlp=8
ports:
- "3306:3306"
volumes:
- /dockerdata/volumes/avrilmysql:/var/lib/mysql
networks:
default:
aliases:
- avrilmysql
restart: on-failure
Then start the compose:
cd /dockerdata/compose # if necessary at first shutdown the compose sudo docker-compose down # then start it sudo docker-compose up -d
(This way was not tested in august 2021.)
Create and run container for Avril application database
sudo docker run --network avrilnet -p 3306:3306 \ --name avrilmysql -v /dockerdata/avrilmysql:/var/lib/mysql \ -e MYSQL_DATABASE=avril -e MYSQL_USER=avril -e MYSQL_PASSWORD=avrilYaopnlp=8 \ -e MYSQL_ROOT_PASSWORD=mysqlYaopnlp=8 -d mysql:5.5
Under /dockerdata/_projects/Avril create the file Dockerfile with the following contents (see the avril workspace for the latest version):
FROM jboss/wildfly:15.0.0.Final # no longer necessary because we use a volume to deploy war-files # ADD AvrilDock-201712-SNAPSHOT.war /opt/jboss/wildfly/standalone/deployments/AvrilDock.war # ADD AvrilWebAdmin-201712-SNAPSHOT.war /opt/jboss/wildfly/standalone/deployments/AvrilWebAdmin.war ADD standalone-custom.xml /opt/jboss/wildfly/standalone/configuration/ EXPOSE 9990 EXPOSE 8787 #RUN /opt/jboss/wildfly/bin/add-user.sh admin masterkey --silent #CMD ["/opt/jboss/wildfly/bin/standalone.sh", "-b", "0.0.0.0", "-bmanagement", "0.0.0.0"] CMD ["/opt/jboss/wildfly/bin/standalone.sh", "-c", "standalone-custom.xml", "-b", "0.0.0.0", "-bmanagement", "0.0.0.0", "--debug"]
Copy the content of the file standalone-custom.xml from the avril workspace to the /dockerdata/_projects/Avril (or copy the file from the old system).
scp -P1002 modules.zip standalone-custom.xml kalaschnikow@avril2021.avril.work:/home/kalaschnikow scp -P1002 *.war modules.zip standalone-custom.xml kalaschnikow@avril2021.avril.work:/home/kalaschnikow
Then move *.war files to /dockerdata/_projects/Avril:
mv /home/kalaschnikow/Avril*.war /dockerdata/volumes/avril/wildfly/deployments
Then move standalone-custom.xml to /dockerdata/_projects/Avril:
sudo mv /home/kalaschnikow/standalone-custom.xml /dockerdata/_projects/Avril
Move modules.zip to /dockerdata/avril and unzip it:
sudo mv /home/kalaschnikow/modules.zip /dockerdata/avril cd /dockerdata/avril unzip modules.zip
Move content of directory /dockerdata/volumes/avril/modules/system/layers/base/com/mysql/ from source to destination system:
# on the SRC system cd /dockerdata/volumes/avril/modules/system/layers/base/com/mysql/jdbc/main scp -P1002 *.* kalaschnikow@avril2021.avril.work:/home/kalaschnikow # on the DEST system cd /dockerdata/volumes/avril/modules/system/layers/base/com/mysql/jdbc/main cp ~/module.xml . cp ~/mysql-connector-java-5.1.31-bin.* .
After that build and run avril container:
cd /dockerdata/_projects/Avril sudo docker image build --tag avril .
After that add the avril service to the /dockerdata/compose/docker-compose.yml (for latest version see the avril workspace):
avril:
image: avril
environment:
- PROXY_ADDRESS_FORWARDING=true
- "JAVA_OPTS=-server -Xdebug -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -agentlib:jdwp=transport=dt_socket,address=*:8787,server=y,suspend=n --add-exports=java.base/sun.nio.ch=ALL-UNNAMED --add-exports=jdk.unsupported/sun.misc=ALL-UNNAMED --add-exports=jdk.unsupported/sun.reflect=ALL-UNNAMED --add-modules=java.se"
ports:
- "8080:8080"
- "8787:8787"
- "9990:9990"
volumes:
- /dockerdata/volumes/avril/modules/system/add-ons:/opt/jboss/wildfly/modules/system/add-ons
- /dockerdata/volumes/avril/wildfly/deployments:/opt/jboss/wildfly/standalone/deployments
- /dockerdata/volumes/avril/wildfly/standalone/configuration/standalone-custom.xml:/opt/jboss/wildfly/standalone/configuration/standalone-custom.xml
- /dockerdata/volumes/avril/upload:/opt/avril/upload
- /dockerdata/volumes/avril/wildfly/upload:/opt/jboss/wildfly/upload
- /dockerdata/volumes/avril/modules/system/layers/base/com/mysql:/opt/jboss/wildfly/modules/system/layers/base/com/mysql
depends_on:
- avrilmysql
- avrilkeycloak
networks:
default:
aliases:
- avril
restart: on-failure
Then restart the compose:
cd /dockerdata/compose sudo docker-compose down sudo docker-compose up -d
It is also possible to run the container with docker run, but it was not tested during the installation in august 2021:
sudo docker run --network avrilnet --name avril --restart unless-stopped \ -p 8080:8080 -p 9990:9990 -p 8787:8787 \ -v /dockerdata/avril/modules/system/add-ons:/opt/jboss/wildfly/modules/system/add-ons \ -v /dockerdata/avril/wildfly/deployments:/opt/jboss/wildfly/standalone/deployments \ -v /dockerdata/avril/upload:/opt/avril/upload \ -v /dockerdata/avril/wildfly/upload:/opt/jboss/wildfly/upload \ -v /dockerdata/avril/modules/system/layers/base/com/mysql:/opt/jboss/wildfly/modules/system/layers/base/com/mysql \ -it avril
To test the Avril installation open the following URL in browser:
http://<your_server>:8080/avril
If troubleshooting will be necessary, docker logs <container_name> can be used. E.g.:
sudo docker logs compose_avril_1
For more information about wildfly logs in docker see Logging with the WildFly Docker image.
In /dockerdata/_projects/AvrilRabbitMQ create a new file definitions.json with following content (see avril workspace for the latest version):
{ "rabbit_version": "3.7.7", "users": [ { "name": "guest", "password_hash": "bsrunkbbhUNvyz/TvpC9OHn8EXXjDjJLJq8SUW1glZBDp4tx", "hashing_algorithm": "rabbit_password_hashing_sha256", "tags": "administrator" }, { "name": "avril", "password_hash": "C+PuHIUxvARVdh3iMcrla9H/QULl27va/Z4lF4yGJYqVg5bN", "hashing_algorithm": "rabbit_password_hashing_sha256", "tags": "" } ], "vhosts": [ { "name": "/" } ], "permissions": [ { "user": "guest", "vhost": "/", "configure": ".*", "write": ".*", "read": ".*" }, { "user": "avril", "vhost": "/", "configure": ".*", "write": ".*", "read": ".*" } ], "topic_permissions": [ { "user": "avril", "vhost": "/", "exchange": "", "write": ".*", "read": ".*" } ], "parameters": [], "global_parameters": [ { "name": "cluster_name", "value": "rabbit@kalaschnikow2017" } ], "policies": [], "queues": [ { "name": "mqtt-subscription-123qos1", "vhost": "/", "durable": true, "auto_delete": false, "arguments": { "x-expires": 86400000 } } ], "exchanges": [], "bindings": [] }
In /dockerdata/_projects/AvrilRabbitMQ create a new file Dockerfile with following content:
FROM rabbitmq:3.7.7-management ADD definitions.json /etc/rabbitmq/ #ADD rabbitmq.config /etc/rabbitmq/ #RUN chown rabbitmq:rabbitmq /etc/rabbitmq/rabbitmq.config /etc/rabbitmq/definitions.json RUN chown rabbitmq:rabbitmq /etc/rabbitmq/definitions.json # RUN rabbitmq-plugins enable --offline rabbitmq_management RUN rabbitmq-plugins enable --offline rabbitmq_mqtt EXPOSE 1883 15672 CMD ["rabbitmq-server"]
Now build a new image:
cd /dockerdata/_projects/AvrilRabbitMQ sudo docker image build --tag avrilrabbitmq .
Add the following code to the /dockerdata/compose/docker-compose.yml (see avril workspace for the latest version):
avrilrabbitmq:
image: avrilrabbitmq
environment:
- ConnectionString=Server=sql.data;Initial Catalog=CatalogData;User Id=sa;Password=your@password
expose:
- "80"
ports:
- "1883:1883"
- "15672:15672"
volumes:
- /dockerdata/volumes/avrilrabbitmq/log:/var/log/rabbitmq/log
networks:
default:
aliases:
- avrilrabbitmq
restart: on-failure
Then restart the compose:
cd /dockerdata/compose sudo docker-compose down sudo docker-compose up -d
The container can be run with (this option is not tested on avril2021 server):
sudo docker run --network avrilnet \ -d --hostname avril2021.avril.work --name avrilrabbitmq \ -p 15672:15672 -p 1883:1883 \ avrilrabbitmq
Using IP for hostname (like –hostname 185.162.250.65) is wrong and won't work!
(This description is unfortunately not complete. Some copies etc. are not yet described.)
From the local computer:
# cd to the install dir, where are all files cd ~/Desktop/install_jrserver # copy build.jar scp -P1002 ./build*.jar kalaschnikow@avril2021.avril.work:/home/kalaschnikow # if necessary copy the report(s) too scp -P1002 ./*.jrxml kalaschnikow@avril2021.avril.work:/home/kalaschnikow
On the server:
cp ~/build.jar /dockerdata/jrserver/src/build.jar cd /dockerdata/jrserver/ # make script executable sudo chmod a+x builddockerimage.sh # start script which will create our jrserver image(s) sudo ./builddockerimage.sh # copy reports to the volume cd /dockerdata/volumes/jrserver/reports cp ~/*.jrxml .
Add the following code to the /dockerdata/compose/docker-compose.yml (see avril workspace for the latest version):
avriljrserver:
image: jrserver/jrserver-server
# environment:
# - PROXY_ADDRESS_FORWARDING=true
# - "JAVA_OPTS=-server -Xdebug -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -agentlib:jdwp=transport=dt_socket,address=*:8787,server=y,suspend=n --add-exports=java.base/sun.nio.ch=ALL-UNNAMED --add-exports=jdk.unsupported/sun.misc=ALL-UNNAMED --add-exports=jdk.unsupported/sun.reflect=ALL-UNNAMED --add-modules=java.se"
ports:
- "8380:8080"
volumes:
- /dockerdata/volumes/jrserver/license:/src/license
- /dockerdata/volumes/jrserver/reports:/src/reports
depends_on:
- avrilmysql
- avrilkeycloak
networks:
default:
aliases:
- avriljrserver
restart: on-failure
Then restart the compose:
cd /dockerdata/compose sudo docker-compose down sudo docker-compose up -d
The container can be run with (this option is not tested on avril2021 server):
sudo docker run --network avrilnet \ -d --hostname avril2021.avril.work --name avriljrserver \ -p 8380:8380 \ avriljrserver
…
sudo mkdir /dockerdata/compose chmod -R a+w /dockerdata/compose cd /dockerdata/compose nano docker-compose.yml
Paste the content of docker-compose.yml from the avril workspace (on my machine: /mnt/sda4/development/workspaces/AvrilServer/DockerImages/docker-compose.yml) to nano and save it.
After that run the compose:
sudo docker-compose -f /dockerdata/compose/docker-compose.yml up -d # OR in the directory where docker-compose.yml is: sudo docker-compose up -d # OR for debugging purposes in "undetached" mode sudo docker-compose up
…