Version: 8.2411.x.x RR

Deployment types

nevisMeta is implemented as a web service in Java.

In case of a standalone deployment, nevisMeta is deployed as a web service including an embedded container.

The following sections describe the deployment types and their configuration.

Standalone

The standalone deployment type makes use of an embedded container. There is no need anymore to install a separate container application. The standalone deployment mode is the default.

The following configuration files control the behavior of nevisMeta in the standalone deployment type:

Configuration file: `env.conf`

Remarks:

Administration command and process environment:

JAVA_HOME (optional): Use specified JRE/JD. KNo other parameter should be changed.
- Heap size
- Garbage collector
- JSSE configuration properties
- JNDI configuration properties
- Temporary Directory
JAVA_OPTS: JVM command-line options

The JAVA_OPTS environment variable can be an expression that will be replaced.

Example 1: (using single quotes)

JAVA_OPTS=(
'-server'
'-Djavax.net.ssl.keyStorePassword=${exec:cat /var/opt/pwd.txt}'
)

Example 2: (using double quotes)

JAVA_OPTS=(
"-server"
"-Djavax.net.ssl.keyStorePassword=\${exec:cat /var/opt/pwd.txt}"
)

Old string syntax: (cannot handle spaces in jvm arguments and inline comments)

JAVA_OPTS="-server \
-Djavax.net.ssl.keyStorePassword=\${exec:cat /var/opt/pwd.txt}"

In case if you use double quotes the $ must be escaped. For details, see Standalone nevismeta.properties expression.

Configuration file: `nevismeta.properties`

Application, login, server configuration:

Back-end configuration options
Ninja authentication module configuration options
Scaling (concurrency with worker threads)
Network settings (host, port, protocol, tls, ...)

Configuration file: `log4j.xml`

Logging configuration:

Configuration of log levels for for individual components
Audit channel (if the file rotation policy or output file needs to be customized)

The configuration files are located here:

/var/opt/nevismeta/<instance>/conf

The location of the temporary files of the standalone embedded container can be changed by -[Djava.io](http://Djava.io).tmpdir=/path/to/tmpdir. This property can be provided via JAVA_OPTS in the env.conf.

Environment configuration

As the first priority, nevisMeta uses the Java installation defined in the file env.conf using the configuration property JAVA_HOME. If the JAVA_HOME property is not defined in the file env.conf, the Java version as defined in the PATH environment variable is used.

To define the usage of a specific Java installation, we recommend setting the configuration property JAVA_HOME in the file env.conf:

Example

JAVA_HOME=/etc/alternatives/jre_1.8.0

Server configuration properties

You can configure the server of the standalone deployment type through the properties in the file nevismeta.properties (see the following table).

`server.name`

Example: <instance>

`server.protocol`

Example: https

Default: https

`server.port`

Example: 8991

Default: 8991

`server.host`

Example: localhost

`server.tls.keystore`

Example: /var/opt/keybox/default/node_keystore.jks

`server.tls.keystore-passphrase`

Example: keystorepassword

`server.tls.truststore`

Example: /var/opt/keybox/default/truststore.jks

Expressed in milliseconds.

Example: 30000

Default: 30000

`database.connection.pool.idle-timeout`

Expressed in milliseconds.

Example: 600000

Default: 600000

`database.connection.pool.max-lifetime`

Expressed in milliseconds.

Example: 1800000

Default: 1800000

`database.connection.pool.minimum-idle`

Example: 10

Default: 10

`database.connection.pool.maximum-pool-size`

Example: 1000

Default: 10

`database.query.plan.cache.size`

The maximum number of cached query plans. For more details, see: https://docs.jboss.org/hibernate/orm/6.4/userguide/html_single/Hibernate_User_Guide.html#hql-query-plan-cache

Example: 512

Default: 2048

`database.query.clause.parameter.padding`

By default, the IN clause expands to include all bind parameter values. However, for database systems supporting execution plan caching, there's a better chance of hitting the cache if the number of possible IN clause parameters lowers. For this reason, we can expand the bind parameters to power-of-two: 4, 8, 16, 32, 64. This way, an IN clause with 5, 6, or 7 bind parameters will use the 8 IN clause, therefore reusing its execution plan. If you want to activate this feature, you need to set this property to true. For more details, see: https://docs.jboss.org/hibernate/orm/6.4/userguide/html_single/Hibernate_User_Guide.html#settings-query

Example: true

Default: false

Standalone - nevismeta.properties configuration file

The property values related to the server configuration in the file nevismeta.properties can be expressions that will be replaced. The next table shows the available syntax:

Syntax	Example	Remarks
`${exec:command}`	`server.tls.keystore-passphrase: ${exec:/var/opt/keys/own/instance/keypass.sh}server.host: ${exec:hostname -f}`	Executes the given command and uses its output as the value
`${env:variablename}`	`server.host: ${env:HOSTNAME}`	Uses the value of the specified environment variable.

Standalone server command-line interface

For standalone deployments, the standalone command-line interface (CLI) provides a low level interface to run the server process. It can be used by higher level tools like the administrative CLI (see The administrative command-line interface) or by the user directly.

You can use the standalone CLI to start nevisMeta without involvement of other system components like for example systemd.

You find the standalone script at /opt/nevismeta/bin/nevismeta-server. It provides the following command-line options:

Command-line argument	Remarks	Default
-c, --config PATH	Required. Path to the configuration file nevismeta.properties.	No default.
-n, --name NAME	Unique name for that Nevis component node.Overrides the value of the property server.name (in the `nevismeta.properties` file).	See the `server.name` property in the `nevismeta.properties` file.
-p, --port PORT	The HTTP/S port to listen on. TLS must be configured in the config file and not as an argument.Overrides the value of the property `server.port` (in the `nevismeta.properties` file).	See the `server.port` property in the `nevismeta.properties` file.
-H, --host HOST	The HTTP/S host to bind on. By default binds on all IPv4 and IPv6 interfaces.Overrides the value of the property `server.host` (in the `nevismeta.properties` file).	See the `server.host` property in the `nevismeta.properties` file.
--log-config PATH	Log configuration file to be used.If a log configuration is provided, nevisMeta will use the given configuration file to determine how logging should behave. If no configuration file is provided, nevisMeta will log to the console by default.	Not set.
-V, --version	Display version and exit with status code 0.
-h, --help	Show complete and detailed usage and exit with status code 0.

Command-line arguments always prevail over the configuration in the nevismeta.properties file!

Example usage of the standalone CLI

To start an existing nevisMeta instance named "default" without using systemd to manage the service, set the following commands:

# set working directory
cd /var/opt/nevismeta/default

/opt/nevismeta/bin/nevismeta-server --config /var/opt/nevismeta/default/conf/nevismeta.properties --log-config /var/opt/nevismeta/default/conf/log4j.xml

Creating Self-Signed Certificates with SAN (Subject Alternative Names)

The following commands generate certificates that can be used in a test environment using a nevisAuth instance with 2-way client authentication and hostname verification enabled.

The keytool command creates a PKCS12 keystore with two SANs (one of type DNS, the other of type IP) and then, using openssl, we generate a PEM file from it, to be used by nevisProxy, for example.

# keytool -genkeypair -keyalg RSA -alias nevisProxyClientCert -keystore /var/opt/certs/keystore.p12 -storetype pkcs12 -storepass password -validity 360 -keysize 2048 -dname "cn=siven.ch,ou=auth,o=o=nevis-security,dc=com" -noprompt -ext SAN=dns:siven.ch,ip:10.0.206.87
# openssl pkcs12 -in /var/opt/certs/keystore.p12 -nodes -out /var/opt/certs/keystore.pem

The following command creates a keystore with two SANs using openssl. Note that both server.key and server.crt are PEM formatted.

openssl genrsa -out /var/opt/certs/ca.key 2048
openssl req -new -x509 -days 365 -key /var/opt/certs/ca.key -subj "/DC=COM/O=nevis-security/OU=auth/CN=siven.ch" -out /var/opt/certs/ca.crt

openssl req -newkey rsa:2048 -nodes -keyout /var/opt/certs/server.key -subj "/DC=COM/O=nevis-security/OU=auth/CN=siven.ch" -out /var/opt/certs/server.csr
openssl x509 -req -extfile <(printf "subjectAltName=DNS:example.com,DNS:siven.ch,IP:10.0.206.87") -days 365 -in /var/opt/certs/server.csr -CA /var/opt/certs/ca.crt -CAkey /var/opt/certs/ca.key -CAcreateserial -out /var/opt/certs/server.crt

Deployment types

Standalone​

Configuration file: env.conf​

Configuration file: nevismeta.properties​

Configuration file: log4j.xml​

Environment configuration​

Example​

Server configuration properties​

server.name​

server.protocol​

server.port​

server.host​

server.tls.keystore​

server.tls.keystore-passphrase​

server.tls.truststore​

server.tls.truststore-passphrase​

server.tls.require-client-auth​

server.tls.client-auth​

server.tls.verify-hostname (optional)​

server.tls.supported-protocols​

server.tls.cipher-suites​

server.max-threads​

server.session-timeout​

management.server.port​

management.healthchecks.enabled​

database.migration.automatic​

includeSoftDeletedStatesPerDefault​

client.rest.creation.response.rfc​

client.rest.match-certificate-with-jwks​

database.connection.pool.auto-commit​

database.connection.pool.connection-timeout​

database.connection.pool.idle-timeout​

database.connection.pool.max-lifetime​

database.connection.pool.minimum-idle​

database.connection.pool.maximum-pool-size​

database.query.plan.cache.size​

database.query.clause.parameter.padding​

Standalone - nevismeta.properties configuration file​

Standalone server command-line interface​

Example usage of the standalone CLI​

Creating Self-Signed Certificates with SAN (Subject Alternative Names)​

Standalone

Configuration file: `env.conf`

Configuration file: `nevismeta.properties`

Configuration file: `log4j.xml`

Environment configuration

Example

Server configuration properties

`server.name`

`server.protocol`

`server.port`

`server.host`

`server.tls.keystore`

`server.tls.keystore-passphrase`

`server.tls.truststore`

`server.tls.truststore-passphrase`

`server.tls.require-client-auth`

`server.tls.client-auth`

`server.tls.verify-hostname` (optional)

`server.tls.supported-protocols`

`server.tls.cipher-suites`

`server.max-threads`

`server.session-timeout`

`management.server.port`

`management.healthchecks.enabled`

`database.migration.automatic`

`includeSoftDeletedStatesPerDefault`

`client.rest.creation.response.rfc`

`client.rest.match-certificate-with-jwks`

`database.connection.pool.auto-commit`

`database.connection.pool.connection-timeout`

`database.connection.pool.idle-timeout`

`database.connection.pool.max-lifetime`

`database.connection.pool.minimum-idle`

`database.connection.pool.maximum-pool-size`

`database.query.plan.cache.size`

`database.query.clause.parameter.padding`

Standalone - nevismeta.properties configuration file

Standalone server command-line interface

Example usage of the standalone CLI

Creating Self-Signed Certificates with SAN (Subject Alternative Names)