Skip to content
This repository has been archived by the owner on Nov 17, 2023. It is now read-only.

Deployment of the BPE using Github Registry Images

Jump to bottom
Reto Wettstein edited this page Jun 18, 2020 · 28 revisions

Before deployment you have to get two certificates from the DFN:

  • Server-client certificate type X.509 (DFN profile 802.1X Client). This certificate can be used for server authentication against clients but also as client certificate to authenticate against the local/remote FHIR Enpoints.

Create a deployment folder named bpe_compose and copy the folder dsf-docker-test-setup ▸ ⁨bpe into it.

Proxy Configuration

  • Add the DFN CA Certificate (full chain needed), the BPE Server Client Certificate and the BPE Server Client Private Key to the folder bpe_compose ▸ ⁨proxy⁩ ▸ ssl:
  • Filenames have to be:
    • ca_certificate.pem for the ca chain
    • certificate.pem for the server certificate
    • private-key.pem for the server certificate private key

Database

  • Adapt ⁨⁨app⁩ ▸ ⁨conf⁩ ▸ config.properties with a new org.highmed.dsf.bpe.db.liquibase_user_password and org.highmed.dsf.bpe.db.server_user_password
  • Add the org.highmed.dsf.bpe.db.liquibase_user_password to db ▸ conf ▸ ⁨postgress_password⁨

App

  • Create a .p12 keystore containing the local Business Process Engine certificate using openssl pkcs12 -export -out [store.p12] -inkey [private-key.pem] -in [certificate.pem] -certfile [ca-chain.pem] and move it into ⁨bpe_compose ▸ ⁨app⁩ ▸ ⁨conf⁩

    WATCH OUT: If the application runs on a machine behind a proxy using TLS Inspection, authentication based on client certificates will not work. TLS Inspection has to be turned off.

  • Adapt the following settings in the file app⁩ ▸ ⁨conf⁩ ▸ config.properties:

    • org.highmed.dsf.bpe.fhir.local.webservice.baseUrl for the FHIR webservice interface
    • org.highmed.dsf.bpe.fhir.local.websocket.url for the FHIR websocket interface
    • keystore.p12file and the keystore.password for both, org.highmed.dsf.bpe.fhir.local.webservice and org.highmed.dsf.bpe.fhir.local.websocket
    • org.highmed.dsf.bpe.db.camunda_user_password with a new password
    • org.highmed.dsf.bpe.fhir.organization.identifier.localValue with the MeDIC identifier

  • If outgoing connections use a proxy, additionally uncomment and change the settings:

    • org.highmed.dsf.bpe.fhir.remote.webservice.proxy.schemeHostPort with the proxy protocol, url and port
    • org.highmed.dsf.bpe.fhir.remote.webservice.proxy.proxy.username
    • org.highmed.dsf.bpe.fhir.remote.webservice.proxy.proxy.password

  • For connection to the openEHR repository, change the following settings:

    • org.highmed.dsf.bpe.openehr.webservice.baseUrl
    • org.highmed.dsf.bpe.openehr.webservice.basicAuthUsername
    • org.highmed.dsf.bpe.openehr.webservice.basicAuthPassword

  • The MPI client can be selected by changing the setting org.highmed.dsf.bpe.mpi.webservice.factory.class, currently supported clients are:

    • org.highmed.mpi.client.pdq.MasterPatientIndexClientPdqFactory

  • Settings of the Jetty application server can be changed in the file ⁨app⁩ ▸ ⁨conf⁩ ▸ jetty.properties

  • If there are additional processes to be deployed, drop them packaged as jar in the folder ⁨app⁩ ▸ plugin

  • Make sure volumes can be accessed. The Application is run by a user with uid==gid==2202. That means that this user has to be able to read the conf and plugin folder and to read+write+execute the log folder.

Docker-Compose Configuration

Adapt the file ⁨⁨docker-compose.yml:

  • Adapt the entry HTTPS_SERVER_NAME_PORT with the permanent redirect url for https (:)
  • If the BPE is located on its own machine without the FHIR Endpoint:
    • Remove the network entries with the name fhir_bpe
    • Adapt the ports to of the entry proxy ▸ ports to 80:80 and 443:443
  • Replace the entry of services ▸ proxy ▸ image with docker.pkg.github.com/highmed/highmed-dsf/bpe_proxy:latest
  • Replace the entry of services ▸ app ▸ image with docker.pkg.github.com/highmed/highmed-dsf/bpe:latest

Adapt the file ⁨docker-compose.prod.yml:

  • If you need additional entries in the file /etc/hosts (e.g. if the external access ip/domain-name mapping for the local FHIR server is different then the internal network ip/domain-name mapping) add them to the field extra_hosts

Running

Run docker-compose -f docker-compose.yml -f docker-compose.prod.yml up

Clone this wiki locally