deviceops-container-readme.md

How to use the Dockerfile v0.0.13

A basic install with no authentication portal

FROM registry.rigado.com/deviceops/backend-core:0.0.13

ENV MYSQL_URL=<JDBC MySQL Conneciton String>/hawkbit
ENV RABBITMQ_HOST=<Rabbit MQ Host Name>
ENV ENABLE_USER_PASS_UI_AUTH=true
ENV MYSQL_USER_NAME=non_root_user
ENV MYSQL_PASSWORD=somethingclever

ENV MANAGEMENT_API_ID=alonganduniquestring
ENV MANAGEMENT_API_SECRET=alonganduniquesecretstring
ENV SINGLE_TENANT_NAME=yourcompany

Required

Env Var	Description
MYSQL_URL	Example: jdbc:mysql://mariadb:3306/hawkbit
RABBITMQ_HOST	Host name of RabbitMQ service
MYSQL_USER_NAME	(non-root) user, granted all permissions on above DB
MYSQL_PASSWORD	MYSQL_USER password
MANAGEMENT_API_ID	Basic Auth username for Management API
MANAGEMENT_API_SECRET	Basic Auth password for Management API
SINGLE_TENANT_NAME	Company Name

When ENABLE_USER_PASS_UI_AUTH is set to true and no oAuth credentials are configured you may log into the UI using the MANAGEMENT_API id and secret.

Production

Consider setting these when running DeviceOps outside of your local environment

Env Var	Default	Description
URL	localhost:8080	Host name used internally and for web UI. Include protocol (http | https )
ARTIFACT_HOST	localhost:8080	Host name used to construct Artifact download URL's for DeviceOps Clients
ARTIFACT_PROTOCOL	http	Protocol used to construct Artifact download URL's for DeviceOps Clients

Basic Auth (Optional - Recommended for testing/development)

For local use, not recommended for production. User: admin Password: admin

Env Var	Description
ENABLE_USER_PASS_UI_AUTH	(Default: false) When set true exposes user name and password fields on the login page

oAuth Authentication (Optional)

Requires the use of the URL env (see above)

Env Var	Description
OAUTH_CLIENT_ID	oAuth Client ID (provided by oAuth service)
OAUTH_CLIENT_SECRET	oAuth Secret (provided by oAuth service)
OAUTH_SERVER_USER_AUTHORIZATION_URI
OAUTH_SERVER_ACCESS_TOKEN_URI
OAUTH_USER_INFO_URI
OAUTH_RESOURCE_JWT_KEY	JWT signing token (any string)

Azure AD Auth

Follow Instructions Here

FROM registry.rigado.com/deviceops/backend-core:0.0.13

ENV MYSQL_URL=<JDBC MySQL Conneciton String>/hawkbit
ENV RABBITMQ_HOST=<Rabbit MQ Host Name>
ENV URL=https://yourhost.com

ENV OAUTH_CLIENT_ID=<Application ID>
ENV OAUTH_CLIENT_SECRET=<Application Key>
ENV OAUTH_SERVER_USER_AUTHORIZATION_URI=https://login.windows.net/<Directory ID>/oauth2/authorize?resource=https://graph.windows.net
ENV OAUTH_SERVER_ACCESS_TOKEN_URI=https://login.windows.net/<Directory ID>/oauth2/token
ENV OAUTH_USER_INFO_URI=https://graph.windows.net/<Directory ID>/me?api-version=1.6
ENV OAUTH_RESOURCE_JWT_KEY=<Signing key of your choice>
ENV SINGLE_TENANT_NAME=<Directory ID>

Deployment Recommendations

High Availability

Multiple instances of DeviceOps may run concurrently. RDO peers communicate events via RabbitMQ and are tolerant to load balancing. One short coming of clustering is the Web UI can sometimes become out of sync when one web session makes changes on one node and other web sessions are attached to other peers. If a user refreshes their browser they will get the most up-to-date data every time.

One solution is to proxy requests with /UI/ to only one instance of RDO and load balance all others.

To enable clustering provide a RABBITMQ_HOST and add the following to your Dockerfile

ENABLE_CLUSTERING=true
CACHE_TTL=500

Env Var	Description
CACHE_TTL	Time To Live for cache updates from database in milliseconds
ENABLE_CLUSTERING	Enables RDO clustering (Requires RABBITMQ_HOST)