Cloud customer?
 Upgrade in MyJFrog >

Search





Overview

This page provides a guide for the different ways you can install and configure JFrog Xray, single node and high availability. Additional information on high availability can be found here.

To install Xray 3.x, you must first install JFrog Artifactory 7.x.

Xray requires a PostgreSQL database. You can choose either set up your own PostgreSQL database or have the Xray installer set it up for you as part of the installation process. For a list supported PostgreSQL database versions, refer to the System Requirements table.

Before You Install Xray

Please refer to the information regarding the supported platforms, browsers and other requirements, and the system architecture.

Installation Steps

The installation procedure involves the following main steps:

  1. Download Xray as per your required installer type (Docker Compose, RPM, Debian).
  2. Install Xray either as a single node installation, or high availability cluster.
    1. Install third party dependencies (PostgreSQL database, included in the archive)
    2. Install Xray
  3. Configure Xray basic settings:
    1. Connect to an Artifactory instance (requires a joinKey and a jfrogUrl).
    2. Optional: Configure the PostgreSQL database connection details if you have set Postgres as an external database.
  4. Start the Service using the start scripts or OS service management.
  5. Check the Service Log to check the status of the service.

Default Home Directory / $JFROG_HOME

The default Xray home directory is defined according to the installation type. For additional details see the Product Directory Structure page.

Note: This guide uses $JFROG_HOME to represent the JFrog root directory containing the deployed product.

Page Contents


Single Node Installation

The following installation methods are supported:

Interactive Script Installation (recommended)

The installer script works with all supported upgrade methods (RPM, Debian and Docker Compose). It provides you an interactive way to install Xray and its dependencies.

  1. Extract the contents of the compressed archive and go to the extracted folder.

    tar -xvf jfrog-xray-<version>-<compose|rpm|deb>.tar.gz
    cd jfrog-xray-<version>-<compose|rpm|deb>

    OS user permissions for Linux archive

    When running Xray, the installation script creates a user called xray by default which must have run and execute permissions on the installation directory.

    It is recommended to extract the Xray download file into a directory that gives run and execute permissions to all users such as /opt.

    Linux archive
    mv jfrog-xray-<version>-linux.tar.gz /opt/
    cd /opt
    tar -xf jfrog-xray-<version>-linux.tar.gz
    mv jfrog-xray-<version>-linux xray
    cd xray

    .env file included within the Docker-Compose archive

    This .env file is used by docker-compose and is updated during installations and upgrades.

    Notice that some operating systems do not display dot files by default. If you make any changes to the file, remember to backup before an upgrade.

  2. Run the installer script.
    Note: the script will prompt you with a series of mandatory inputs, including the jfrogURL (custom base URL) and joinKey.

    RPM or Debian
    ./install.sh
    Docker Compose
    ./config.sh

    Prerequisites for Linux archive

    Refer prerequisites for Xray in Linux Archive  before running install script.

    Linux archive
    ./install.sh --user <user name> --group <group name>
    
    -h | --help                                       : [optional] display usage
    -u | --user                                       : [optional] (default: xray) user which will be used to run the product, it will be created if its unavailable
    -g | --group                                      : [optional] (default: xray) group which will be used to run the product, it will be created if its unavailable
  3. Validate and customize the product configuration(optional), including the third party dependencies connection details and ports.

    Please ensure that a large file handle limit is specified before you start Xray. 

  4. Start and manage the Xray service.


    systemd OS
    systemctl start|stop xray.service

    Starting from Xray 3.8x, the stop and restart action on Xray will not be applied to RabbitMQ process. On start action of Xray, if RabbitMQ is not running, it will be started.

    If you want the script to perform stop and restart action on RabbitMQ, set shared.rabbitMq.autoStop as true in the system.yaml. Note that this flag is not consumed in docker-compose installation.

    systemv
    service xray start|stop
    Docker Compose
    cd jfrog-xray-<version>-compose
    
    # Starting from Xray 3.8x RabbitMQ has been moved to a compose file of its own, this needs to be started before starting other services
    docker-compose -p xray-rabbitmq -f docker-compose-rabbitmq.yaml up -d
    
    # Starting from 3.8.x, PostgreSQL needs to be started before starting the other services.
    docker-compose -p xray-postgres -f docker-compose-postgres.yaml up -d
    
    docker-compose -p xray up -d
    
    docker-compose -p xray ps
    docker-compose -p xray down

    Xray can be installed and managed as a service in Linux archive installation. Refer start Xray section under Linux Archive Manual Installation for more details. 

    Linux archive
    xray/app/bin/xray.sh start|stop
  5. Access Xray from your browser at: http://<jfrogUrl>/ui/, go the Security & Compliance tab in the Application module in the UI.
  6. Check Xray Log.

    tail -f $JFROG_HOME/xray/var/log/console.log

    Configuring the Log Rotation of the Console Log

    The console.log file can grow quickly since all services write to it. This file is not log rotated for Darwin installations. Learn more on how to configure the log rotation.

Manual RPM Installation

The RPM installation bundles Xray and all its dependencies. It is provided as native RPM packages, where Xray and its dependencies must be installed separately. Use this, if you are automating installations.

  1. Extract the contents of the compressed archive, and go to the extracted folder.

    tar -xvf jfrog-xray-<version>-rpm.tar.gz
    cd jfrog-xray-<version>-rpm
  2. Install PostgreSQL. You can choose to install any compatible PostgreSQL version, or use the PostgreSQL RPM bundled with the Xray installer located under /third-party/postgresql.

    PostgreSQL is required and must be installed before continuing with the next installation steps.

    For a manually installed PostgreSQL, you need to set the database connection details in the Shared Configurations section of the $JFROG_HOME/xray/var/etc/system.yaml file.

  3. Install db-util. You can use the bundled db-utils RPM found under /third-party/misc/.

    # This will install db-util if db_dump is not available
    hash db_dump 2>/dev/null || rpm -ivh --replacepkgs ./third-party/misc/<db-utils version>.x86_64.rpm
  4. Install RabbitMQ dependencies.

    # Note : Use rpms with el6 when installing on Centos 6 and RHEL 6. Run the following from the extracted folder.
    rpm -ivh --replacepkgs ./third-party/rabbitmq/socat-<version>.x86_64.rpm
    rpm -ivh --replacepkgs ./third-party/rabbitmq/erlang-<version>.x86_64.rpm
  5. Install Xray. You must run as a root user.

    rpm -Uvh --replacepkgs ./xray/xray.rpm
  6. Customize the product configuration.

    1. Set the Artifactory connection details.

    2. Customize the PostgreSQL Database connection details. (optional)

    3. Set any additional configurations (for example: ports, node id) using the Xray system.yaml configuration file.

      Please ensure that a large file handle limit is specified before you start Xray. 

  7. Start and manage the Xray service.

    systemd OS
    systemctl start|stop xray.service
    systemv OS
    service xray start|stop|status|restart
  8. Access Xray from your browser at: http://<jfrogUrl>/ui/, go the Security & Compliance tab in the Application module in the UI.
  9. Check Xray Log.

    Linux
    tail -f $JFROG_HOME/xray/var/log/console.log

Manual Debian Installation

The Debian installation bundles Xray and all its dependencies. It is provided as native Debian packages, where Xray and its dependencies must be installed separately. Use this, if you are automating installations.

  1. Extract the contents of the compressed archive, and go to the extracted folder.

    tar -xvf jfrog-xray-<version>-deb.tar.gz
    cd jfrog-xray-<version>-deb
  2. Install PostgreSQL.

    PostgreSQL is required and must be installed before continuing with the next installation steps.

    Set your PostgreSQL connection details in the Shared Configurations section of the $JFROG_HOME/xray/etc/system.yaml file.

  3. Install db-util.

    db-util allows us to interact with the Berkley DB that contains information about RPM-based Docker images. This way, JFrog Xray can index OS packages for these images.

    Ubuntu
    dpkg -i ./third-party/misc/db5.<version>.deb
    dpkg -i ./third-party/misc/db-util_<version>.deb
    Debian 8
    dpkg -i ./third-party/misc/db5.<version>.deb
    dpkg -i ./third-party/misc/db-util_<version>.deb
    Debian 9
    dpkg -i ./third-party/misc/db5.<version>.deb
    dpkg -i ./third-party/misc/db-util_<version>_all.deb
  4. Install RabbitMQ dependencies.

    ubuntu 16.04 (xenial)
    dpkg -i ./third-party/rabbitmq/libss<version>.deb
    dpkg -i ./third-party/rabbitmq/socat_<version>.deb
    dpkg -i ./third-party/rabbitmq/esl-erlang_<version>.deb
    ubuntu 18.04 (bionic)
    dpkg -i ./third-party/rabbitmq/socat_<version>.deb
    dpkg -i ./third-party/rabbitmq/esl-erlang_<version>.deb
    ubuntu 20.04 (focal)
    dpkg -i ./third-party/rabbitmq/socat_<version>.deb
    dpkg -i ./third-party/rabbitmq/esl-erlang_<version>.deb
    Debian 8 (jessie)
    # Before installing Erlang dependencies
    mv /etc/apt/sources.list.d/backports.list /etc/apt >/dev/null
    
    apt-get update
    dpkg -i ./third-party/rabbitmq/libss<version>.deb
    dpkg -i ./third-party/rabbitmq/socat_<version>.deb
    dpkg -i ./third-party/rabbitmq/esl-erlang_<version>.deb
    
    # After installing Erlang dependencies
    mv /etc/apt/backports.list /etc/apt/sources.list.d/backports.list >/dev/null
    apt-get update
    Debian 9 (stretch)
    dpkg -i ./third-party/rabbitmq/socat_<version>.deb
    dpkg -i ./third-party/rabbitmq/esl-erlang_<version>.deb
    Debian 10 (buster)
    dpkg -i ./third-party/rabbitmq/socat_<version>.deb
    dpkg -i ./third-party/rabbitmq/esl-erlang_<version>.deb

    Run the following commands if you have any issues running the above commands to install the dependencies. These will include any missing dependencies from your system.

    Install any missing dependancies
    apt-get update
    apt-get install -f -y
    apt-get update
  5. Install Xray. You must run as a root user.

    dpkg -i ./xray/xray.deb
  6. Customize the product configuration.

    1. Set the Artifactory connection details.

    2. Customize the PostgreSQL Database connection details. (optional)

    3. Set any additional configurations (for example: ports, node id) using the Xray system.yaml configuration file

      Please ensure that a large file handle limit is specified before you start Xray. 

  7. Start and manage the Xray service.

    systemd OS
    systemctl start|stop xray.service
    systemv OS
    service xray start|stop|status|restart
  8. Access Xray from your browser at: http://<jfrogUrl>/ui/, go the Security & Compliance tab in the Application module in the UI.
  9. Check Xray Log.

    Linux
    tail -f $JFROG_HOME/xray/var/log/console.log

Manual Linux Archive Installation

Prerequisites

The following prerequisites must be installed independently of the Xray archive installation. Please make sure to install them before staring your Xray service.

  • PostgreSQL

  • Erlang - Packaged as RPM (or DEB) within the archive.

  • Db-Utils - Packaged as RPM (or DEB) within the archive.

For your convenience, they are included within the archive.

Install Steps

  1. Extract the contents of the compressed archive and move it into xray directory.

    tar -xvf jfrog-xray-<version>-linux.tar.gz
    mv jfrog-xray-<version>-linux xray

    PostgreSQL is required and must be installed before continuing with the next installation steps.

    Set your PostgreSQL connection details in the Shared Configurations section of the $JFROG_HOME/xray/var/etc/system.yaml file.

  2. Start PostgreSQL.

  3. Customize the product configuration.
    1. Set the Artifactory connection details.
    2. Customize the PostgreSQL Database connection details. (optional)
    3. Set any additional configurations (for example: ports, node id) using the Xray system.yaml configuration file.
  4. Start and manage the Xray service as the user who extracted the tar.
    As a process

    Daemon Process
    xray/app/bin/xray.sh start

    Manage the process.

    xray/app/bin/xray.sh start|stop|status|restart

    As a service

    Xray is packaged as an archive file and an install script that can be used to install it as a service running under a custom user. Currently supported on Linux systems.

    OS User Permissions

    When running Xray as a service, the installation script creates a user called xray (by default) which must have run and execute permissions on the installation directory.

    It is recommended to extract the Xray download file into a directory that gives run and execute permissions to all users such as /opt.

    To install Xray as a service, execute the following command as root: 

    User and group can be passed through xray/var/etc/system.yaml as shared.user and shared.group. This takes precedence over values passed through command line on install. 

    xray/app/bin/installService.sh --user <enter user, default value is xray> --group <enter group, default value is xray>
    
    -u | --user                                       : [optional] (default: xray) user which will be used to run the product, it will be created if its unavailable
    -g | --group                                      : [optional] (default: xray) group which will be used to run the product, it will be created if its unavailable

    The user and group will be stored in xray/var/etc/system.yaml at the end of installation.

    To manage the service, use systemd or init.d commands depending on your system. 

    Using systemd
     systemctl <start|stop|status> xray.service
    Using init.d
    service xray <start|stop|status>
  5. Access Xray from your browser at: http://<jfrogUrl>/ui/, go the Dashboard tab in the Application module in the UI.
  6. Check Xray Log.

    tail -f xray/var/log/console.log

Helm Installation

Deploying Artifactory for Small, Medium or Large Installations

In the chart directory, include three values files, one for each installation type - small/medium/large. These values files are recommendations for setting resources requests and limits for your installation. You can find the files in the corresponding chart directory.

  1. Add the ChartCenter Helm repository to your Helm client.

    helm repo add center https://repo.chartcenter.io
    
  2. Update the repository.

    helm repo update
  3. Next, create a unique master key; JFrog Xray requires a unique master key to be used by all micro-services in the same cluster. By default the chart has one set in values.yaml (xray.masterKey).

    For production grade installations it is strongly recommended to use a custom master key. If you initially use the default master key it will be very hard to change the master key at a later stage This key is for demo purpose and should not be used in a production environment.

  4. Generate a unique key and pass it to the template during installation/upgrade.

    # Create a key
    export MASTER_KEY=$(openssl rand -hex 32)
    echo ${MASTER_KEY}
    
    # Pass the created master key to Helm
    helm upgrade --install --set xray.masterKey=${MASTER_KEY} --namespace xray center/jfrog/xray

    Alternatively, you can create a secret containing the master key manually and pass it to the template during installation/upgrade.

    # Create a key
    export MASTER_KEY=$(openssl rand -hex 32)
    echo ${MASTER_KEY}
    
    # Create a secret containing the key. The key in the secret must be named master-key
    kubectl create secret generic my-secret --from-literal=master-key=${MASTER_KEY}
    
    # Pass the created secret to Helm
    helm upgrade --install xray --set xray.masterKeySecretName=my-secret --namespace xray center/jfrog/xray

    In either case, make sure to pass the same master key on all future calls to helm install and helm upgrade. In the first case, this means always passing --set xray.masterKey=${MASTER_KEY}. In the second, this means always passing --set xray.masterKeySecretName=my-secret and ensuring the contents of the secret remain unchanged.

  5. Customize the product configuration (optional) including database, Java Opts, and filestore.

    Unlike other installations, Helm Chart configurations are made to the values.yaml and are then applied to the system.yaml.

    Follow these steps to apply the configuration changes.

    1. Make the changes to values.yaml. 
    2. Run the command.

      helm upgrade --install xray --namespace xray -f values.yaml

  6. Access Xray from your browser at: http://<jfrogUrl>/ui/, then go to the Security & Compliance tab in the Application module in the UI.

  7. Check the status of your deployed helm releases.

    helm status xray

For advanced installation options, see Helm Charts Installers for Advanced Users.


HA Installation

The following describes how to set up an Xray HA cluster with two or more nodes. For more information, see the System Architecture.

Prerequisites

All nodes within the same Xray HA installation must be running the same Xray version.

Database

Xray HA requires an external PostgreSQL database. Make sure to install it before proceeding to install the first node. There are several ways to setup PostgreSQL for redundancy. Including: HA, Load Balancing and Replication. For more information, see the PostgreSQL documentation.

RabbitMQ is automatically installed as part of the Xray installation for every node. In case of HA architecture, it uses queue mirroring between the different RabbitMQ nodes, automatically setup.

Licensing

Xray HA is supported with an Enterprise License. Each node in the cluster must be activated with a different license.

Network

  • All the Xray HA components (Xray cluster nodes, database server and RabbitMQ) must be within the same fast LAN.

  • All the HA nodes must communicate with each other through dedicated TCP ports.

The following installation methods are supported:

Linux Archive / RPM/ Debian Installation

First node installation steps:

  1. Install the first node. The installation is identical to the single node installation. Important: make sure not to start Xray.
  2. Configure the system.yaml file with the database and first node configuration details. For example,

    First node system.yaml
    shared:
      database:
        type: postgresql
        driver: org.postgresql.Driver
        url: postgres://<ip:port>/xraydb?sslmode=disable
        username: xray
        password: xray
      jfrogUrl: <JFrog URL>
      security:
        joinKey: <Artifactory Join Key>
  3. Start and manage the Xray service.

    systemd OS
    systemctl start|stop xray.service
    Systemv OS
    service xray start|stop
  4. Access Xray from your browser at: http://<jfrogUrl>/ui/, go the Security & Compliance tab in the Application module in the UI.
  5. Check Xray Log.

    Linux
    tail -f $JFROG_HOME/xray/var/log/console.log

Additional node installation steps:

In order for a node to join a cluster, the node must have the same database configuration and the Master Key.

  1. Install all additional nodes using the same steps described above
  2. Configure PostgreSQL to allow external IP connections. This will ensure PostgreSQL is reachable by this node.
  3. Configure the system.yaml file for the additional node with master key, database and active node configurations. For example,

    Additional node system.yaml
    shared:
      database:
        type: postgresql
        driver: org.postgresql.Driver
        url: postgres://<ip:port>/xraydb?sslmode=disable
        username: xray
        password: xray
      jfrogUrl: <JFrog URL>
      security:
        joinKey: <Artifactory Join Key>
      rabbitMq:
        active:
          node:
            name: 
            ip: 
  4. Copy the master.key from the first node to the additional node located at $JFROG_HOME/xray/var/etc/security/master.key.
  5. Start the additional node.

  6. Access Xray from your browser at: http://<jfrogUrl>/ui/, go the Security & Compliance tab in the Application module in the UI.
  7. Check Xray Log.

    Linux
    tail -f $JFROG_HOME/xray/var/log/console.log

Docker Compose Installation

First node installation steps:

  1. Extract the contents of the compressed archive and go to the extracted folder.

    tar -xvf jfrog-xray-<version>-compose.tar.gz
    cd jfrog-xray-<version>-compose

    .env file included within the Docker-Compose archive

    This .env file is used by docker-compose and is updated during installations and upgrades.

    Notice that some operating systems do not display dot files by default. If you make any changes to the file, remember to backup before an upgrade.

  2. Run the config.sh script to setup folders with required ownership. Note: the script will prompt you with a series of mandatory inputs, including if this is part of a cluster, and configure the needed system.yaml.

    ./config.sh
  3. Validate and customize the product configuration (optional), including the third party dependencies connection details and ports.
  4. Start and manage Xray using docker-compose commands. Note: Run this command only from the extracted folder.

    cd jfrog-xray-<version>-compose
    
    # Starting from Xray 3.8x RabbitMQ has been moved to a compose file of its own, this needs to be started before starting other services
    docker-compose -p xray-rabbitmq -f docker-compose-rabbitmq.yaml up -d
    
    # Starting from Xray 3.8x, PostgreSQL needs to be started before starting the other services.
    docker-compose -p xray-postgres -f docker-compose-postgres.yaml up -d
    
    docker-compose -p xray up -d
    
    docker-compose -p xray logs
    docker-compose -p xray ps
    docker-compose -p xray down
  5. Access Xray from your browser at: http://<jfrogUrl>/ui/, go the Security & Compliance tab in the Application module in the UI.

  6. Check Xray Log.

    docker-compose -p xray logs

Additional node installation steps:

  1. Extract the contents of the compressed archive and go to the extracted folder.

    tar -xvf jfrog-xray-<version>-compose.tar.gz
    cd jfrog-xray-<version>-compose
  2. Run the config.sh script to setup folders with required ownership. Note: the script will prompt you with a series of mandatory inputs, including if this is part of a cluster, and configure the needed system.yaml.

    ./config.sh
    
  3. Validate and customize the product configuration (optional), including the third party dependencies connection details and ports.
  4. Start and manage Xray using docker-compose commands. Note: Run this command only from  the extracted folder.

    cd jfrog-xray-<version>-compose
    
    # Starting from Xray 3.8x RabbitMQ has been moved to a compose file of its own, this needs to be started before starting other services
    docker-compose -p xray-rabbitmq -f docker-compose-rabbitmq.yaml up -d
    docker-compose -p xray up -d
    
    docker-compose -p xray logs
    docker-compose -p xray ps
    docker-compose -p xray down
  5. Access Xray from your browser at: http://<jfrogUrl>/ui/, go the Security & Compliance tab in the Application module in the UI.

  6. Check Xray Log.

    docker-compose -p xray logs

Helm Installation 

Deploying Artifactory for Small, Medium or Large Installations

In the chart directory, include three values files, one for each installation type - small/medium/large. These values files are recommendations for setting resources requests and limits for your installation. You can find the files in the corresponding chart directory.

High Availability

To set Xray for high availability, set the replicaCount in the values.yaml file to >1 (the recommended is 3). It is highly recommended to also set RabbitMQ to run as an HA cluster.

 Start Xray with 3 replicas per service and 3 replicas for RabbitMQ.

helm upgrade --install xray --namespace xray --set replicaCount=3  --set rabbitmq-ha.replicaCount=3 center/jfrog/xray
  1. Add the ChartCenter Helm repository to your Helm client.

    helm repo add center https://repo.chartcenter.io
    
  2. Update the repository.

    helm repo update
  3. Next, create a unique master key; JFrog Xray requires a unique master key to be used by all micro-services in the same cluster. By default the chart has one set in values.yaml (xray.masterKey).

    For production grade installations it is strongly recommended to use a custom master key. If you initially use the default master key it will be very hard to change the master key at a later stage This key is for demo purpose and should not be used in a production environment.

    Generate a unique key and pass it to the template during installation/upgrade.

    # Create a key
    export MASTER_KEY=$(openssl rand -hex 32)
    echo ${MASTER_KEY}
    
    # Pass the created master key to Helm
    helm upgrade --install --set xray.masterKey=${MASTER_KEY} --namespace xray center/jfrog/xray
  4. Alternatively, you can create a secret containing the master key manually and pass it to the template during installation/upgrade.

    # Create a key
    export MASTER_KEY=$(openssl rand -hex 32)
    echo ${MASTER_KEY}
    
    # Create a secret containing the key. The key in the secret must be named master-key
    kubectl create secret generic my-secret --from-literal=master-key=${MASTER_KEY}
    
    # Pass the created secret to Helm
    helm upgrade --install xray --set xray.masterKeySecretName=my-secret --namespace xray center/jfrog/xray

    In either case, make sure to pass the same master key on all future calls to helm install and helm upgrade. In the first case, this means always passing --set xray.masterKey=${MASTER_KEY}. In the second, this means always passing --set xray.masterKeySecretName=my-secret and ensuring the contents of the secret remain unchanged.

  5. Customize the product configuration (optional) including database, Java Opts, and filestore.

    Unlike other installations, Helm Chart configurations are made to the values.yaml and are then applied to the system.yaml.

    Follow these steps to apply the configuration changes.

    1. Make the changes to values.yaml. 
    2. Run the command.

      helm upgrade --install xray --namespace xray -f values.yaml

  6. Access Xray from your browser at: http://<jfrogUrl>/ui/, then go to the Security & Compliance tab in the Application module in the UI.
  7. Check the status of your deployed helm releases.

    helm status xray

For advanced installation options, see Helm Charts Installers for Advanced Users.



Product Configuration

After installing and before running Xray, you may set the following configurations.

Where to find the system configurations?

You can configure all your system settings using the system.yaml file located in the $JFROG_HOME/xray/var/etc folder. For more information, see Xray System YAML.

If you don't have a System YAML file in your folder, copy the template available in the folder and name it system.yaml.

For the Helm charts, the system.yaml file is managed in the chart’s values.yaml.

Artifactory Connection Details

Xray requires a working Artifactory server and a suitable license. The Xray connection to Artifactory requires 2 parameters:

  • jfrogUrl - URL to the machine where JFrog Artifactory is deployed, or the load balancer pointing to it. It is recommended to use DNS names rather than direct IPs. For example: "http://jfrog.acme.com or http://10.20.30.40:8082". Note that /artifactory context is not longer required.
    Set it in the Shared Configurations section of the $JFROG_HOME/xray/var/etc/system.yaml file.
  • join.key - This is the "secret" key required by Artifactory for registering and authenticating the Xray server.
    You can fetch the Artifactory joinKey (join Key) from the JPD UI in the Administration module | Security | Settings | Join Key
    Set the join.key used by your Artifactory server in the Shared Configurations section of the $JFROG_HOME/xray/var/etc/system.yaml file.

Changing PostgreSQL Database Credentials

Xray comes bundled with a postgreSQL Database out-of-the-box, which come pre-configured with default credentials.

To change the default credentials:

# Access PostgreSQL as the Xray user adding the optional -W flag to invoke the password prompt
$ psql -d xraydb -U xray -W
 
# Securely change the password for user "xray". Enter and then retype the password at the prompt.
\password xray
 
# Verify the update was successful by logging in with the new credentials
$ psql -d xraydb -U xray -W

Set your PostgreSQL connection details in the Shared Configurations section of the $JFROG_HOME/xray/var/etc/system.yaml file.

Changing RabbitMQ Database Credentials

Xray comes pre-installed with RabbitMQ, by setting the erlang cookie value as the rabbitmq password for guest users.

Docker Compose

To change the default credentials.

  1. Set the new password in the <MOUNT_DIR>/app/third-party/rabbitmq/rabbitmq.conffile.

    default_pass = <new password>
  2. Set your Rabbitmq password in the Shared Configurations section of the $JFROG_HOME/xray/var/etc/system.yaml file.
  3. Restart all services.

    cd jfrog-xray-<version>-compose 
    
     docker-compose -p xray restart

RPM/Debian

To change the default credentials.

  1. Set the new password in the$JFROG_HOME/app/bin/rabbitmq/rabbitmq.conffile.

    default_pass = <new password>
  2.  Set your Rabbitmq password in the Shared Configurations section of the $JFROG_HOME/xray/var/etc/system.yaml file.
  3. Restart all services.

    service xray restart / systemctl restart xray.service

Linux Archive

To change the default credentials.

  1. Set the new password in the$JFROG_HOME/app/bin/rabbitmq/rabbitmq.conffile.

    default_pass = <new password>
  2. Set your Rabbitmq password in the Shared Configurations section of the $JFROG_HOME/xray/var/etc/system.yaml file.
  3. Restart all services.

    xray/app/bin/xray.sh restart 

Third Party Log Collector

Xray enables using an external log collector such as Sumologic or Splunk.

To adjust the permissions to allow the log collection service perform read operations on the generated log files:

  1. Add the log collection service user to the relevant group if needed (the user and group that installed and started Xray)
  2. Apply the user and group permissions as needed on the $JFROG_HOME/xray/var/log directory using:

    $ chmod -R 640 $JFROG_HOME/xray/var/log
  3. Adjust the group read inheritance permissions setgid bit using:

    $ chmod -R 2755 $JFROG_HOME/xray/var/log 

    This will cause the generated log files to inherit the folder's group permissions.


Third Party Applications

PostgreSQL Performance Improvements

It is recommended to increase the maximum connections setting in the PostgreSQL configuration file.

Open the $JFROG_HOME/xray/var/lib/pgsql/data/postgresql.conf configuration file, and add or edit the max_connections property.

max_connections = 300

Restart the database to enable this change.

Installing PostgreSQL

RPM

  1. Install PostgreSQL.

    # Run the following commands from the extracted jfrog-xray-<version>-rpm directory.
    # Note : Use postgreSQL rpms with el6 when installing on Centos 6 and RHEL 6 and use postgresql12-12.3-1 packages 
    # Note : Use postgreSQL rpms with el8 when installing on Centos 8 and RHEL 8
    
    mkdir -p /var/opt/postgres/data
    
    rpm -ivh --replacepkgs ./third-party/postgresql/libicu-50.2-3.el7.x86_64.rpm (only AWS instance)
    rpm -ivh --replacepkgs ./third-party/postgresql/postgresql12-libs-12.3-5PGDG.rhel7.x86_64.rpm
    rpm -ivh --replacepkgs ./third-party/postgresql/postgresql12-12.3-5PGDG.rhel7.x86_64.rpm
    rpm -ivh --replacepkgs ./third-party/postgresql/postgresql12-server-12.3-5PGDG.rhel7.x86_64.rpm
    
    chown -R postgres:postgres /var/opt/postgres
    
    export PGDATA="/var/opt/postgres/data"
    export PGSETUP_INITDB_OPTIONS="-D /var/opt/postgres/data"
    
    # For centos 7&8 / rhel 7&8 
    sed -i "s~^Environment=PGDATA=.*~Environment=PGDATA=/var/opt/postgres/data~" /lib/systemd/system/postgresql-12.service
    systemctl daemon-reload
    /usr/pgsql-12/bin/postgresql-12-setup initdb
    
    # For centos 6 / rhel 6
    sed -i "s~^PGDATA=.*~PGDATA=/var/opt/postgres/data~" /etc/init.d/postgresql-12
    service postgresql-12 initdb
    
    Replace "ident" and "peer" with "trust" in postgres hba configuration files ie /var/opt/postgres/data/pg_hba.conf
    
  2. Configure PostgreSQL to allow external IP connections. 

  3. By default PostgreSQL will only allow localhost clients communications. To enable different IPs to communicate with the database you will need to configure the pg_hba.conf file.

    File location according to installation type

    • Docker-compose$JFROG_HOME/xray/var/data/postgres/data
    • Native installations: /var/opt/postgres/data

    To grant all IPs access you may add the below, under the IPv4 local connections section.

    host    all             all             0.0.0.0/0               trust

     Add the following line to /var/opt/postgres/data/postgresql.conf.

    listen_addresses='*'
    port=5432


  4. Start PostgreSQL.

    systemctl start postgresql-12.service 
    
    or 
    
    service postgresql-12 start


  5. Setup the database and user.

    ## run the script to seed the tables and schemas needed by Xray
    cp -f ./third-party/postgresql/createPostgresUsers.sh /tmp
    source /etc/locale.conf
    
    cd /tmp && su postgres -c "POSTGRES_PATH=/usr/pgsql-12/bin PGPASSWORD=postgres DB_PASSWORD=password bash /tmp/createPostgresUsers.sh"

Debian   

Prerequisites

It is recommended to ensure your apt-get libraries are up-to-date, using the following commands.

Install any missing dependancies
apt-get update
apt-get install -f -y
apt-get update
# Create the file repository configuration to pull postgresql dependencies

cp -f /etc/apt/sources.list /etc/apt/sources.list.origfile
sh -c 'echo "deb http://ftp.de.debian.org/debian/ $(lsb_release -cs) main non-free contrib" >> /etc/apt/sources.list'
sh -c 'echo "deb-src http://ftp.de.debian.org/debian/ $(lsb_release -cs) main non-free contrib" >> /etc/apt/sources.list'  
  
cp -f /etc/apt/sources.list.d/pgdg.list /etc/apt/sources.list.d/pgdg.list.origfile
sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs)-pgdg main" >> /etc/apt/sources.list.d/pgdg.list'
sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ precise-pgdg main" >> /etc/apt/sources.list.d/pgdg.list'

wget --no-check-certificate --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
Install Steps
  1. Install PostgreSQL.
    Run the following commands from the extracted jfrog-xray-<version>-deb directory.

    mkdir -p /var/opt/postgres/data
    
    
    Ubuntu 16.04 (xenial)
    dpkg -i ./third-party/postgresql/postgresql-12_12.3-1.pgdg16.04+1_amd64.deb
    Ubuntu 18.04 (bionic)
    dpkg -i ./third-party/postgresql/postgresql-12_12.3-1.pgdg18.04+1_amd64.deb
    Ubuntu 20.04 (focal)
    dpkg -i ./third-party/postgresql/postgresql-12_12.3-1.pgdg20.04+1_amd64.deb
    Debian 8 (jessie)
    ## Before installing Postgres dependencies
    mv /etc/apt/sources.list.d/backports.list /etc/apt >/dev/null
    apt-get update
    dpkg -i ./third-party/postgresql/postgresql-12_12.3-1.pgdg80+1_amd64.deb
    
    # After installing Postgres dependencies
    mv /etc/apt/backports.list /etc/apt/sources.list.d/backports.list >/dev/null
    apt-get update
    Debian 9 (stretch)
    dpkg -i ./third-party/postgresql/postgresql-12_12.3-1.pgdg90+1_amd64.deb
    Debian 10 (buster)
    apt update -y 
    apt-get install wget sudo -y 
    apt-get install -y gnupg gnupg1 gnupg2 
    dpkg -i ./third-party/postgresql/postgresql-12_12.3-1.pgdg100+1_amd64.deb

    Stop the Xray service.

    systemctl stop postgresql.service

    Change permissions for the postgres folder.

    chown -R postgres:postgres /var/opt/postgres
    
    sed -i "s~^data_directory =.*~data_directory = '/var/opt/postgres/data'~" "/etc/postgresql/12/main/postgresql.conf"
    sed -i "s~^hba_file =.*~hba_file = '/var/opt/postgres/data/pg_hba.conf'~" "/etc/postgresql/12/main/postgresql.conf"
    sed -i "s~^ident_file =.*~ident_file = '/var/opt/postgres/data/pg_ident.conf'~" "/etc/postgresql/12/main/postgresql.conf"
    
    su postgres -c "/usr/lib/postgresql/12/bin/initdb --pgdata=/var/opt/postgres/data"
  2. Configure PostgreSQL to allow external IP connections. 

  3. By default PostgreSQL will only allow localhost clients communications. To enable different IPs to communicate with the database you will need to configure the pg_hba.conf file.

    File Location According to Installation Type

    • Docker-compose$JFROG_HOME/xray/var/data/postgres/data
    • Native installations: /var/opt/postgres/data

    To grant all IPs access you may add the below, under the IPv4 local connections section:

    host    all             all             0.0.0.0/0               trust

    Add the following line to /etc/postgresql/12/main/postgresql.conf

    listen_addresses='*'
  4.  Start PostgreSQL 

    systemctl start postgresql.service 
    
    or 
    
    service postgresql start
  5. Setup the database and user

    ## run the script to seed the tables and schemas needed by Xray
    cp -f ./third-party/postgresql/createPostgresUsers.sh /tmp
    source /etc/default/locale
    
    cd /tmp && su postgres -c "POSTGRES_PATH=/usr/lib/postgresql/12/bin PGPASSWORD=postgres DB_PASSWORD=password bash /tmp/createPostgresUsers.sh"

    Putting back the original pgdg.list

    mv /etc/apt/sources.list.d/pgdg.list /etc/apt/sources.list.d/pgdg.list.tmp &&
    cp -f /etc/apt/sources.list.d/pgdg.list.origfile /etc/apt/sources.list.d/pgdg.list

    Removing backup files

    rm -f /etc/apt/sources.list.d/pgdg.list.tmp
    rm -f /etc/apt/sources.list.d/pgdg.list.origfile

    Putting back the original sources.list

    mv /etc/apt/sources.list /etc/apt/sources.list.tmp &&
    cp -f /etc/apt/sources.list.origfile /etc/apt/sources.list

    Removing backup files

    rm -f /etc/apt/sources.list.tmp &&
    rm -f /etc/apt/sources.list.origfile

 Linux Archive

Postgres binaries are no longer bundled with linux archive installer for Xray. Please install Postgres manually.  

    

 
# Create the psql database (the script "xray/app/third-party/postgresql/createPostgresUsers.sh" , responsible for seeding Postgres assumes this database exists)
<pgsql bin path>/psql template1
<postgres prompt>: CREATE DATABASE <user_name>;
<postgres prompt>: \q
 
## run the script to seed the tables and schemas needed by Xray
POSTGRES_PATH=<pgsql bin path> xray/app/third-party/postgresql/createPostgresUsers.sh

Installing Erlang

RPM

# Note : Use the following rpm files with el6 when installing on CentOS 6 and RHEL 6. Run the following commands from the extracted folder.
rpm -ivh --replacepkgs xray/app/third-party/rabbitmq/socat-<version>.rpm
rpm -ivh --replacepkgs xray/app/third-party/rabbitmq/erlang-<version>.rpm

Debian

It is recommended to make sure your apt-get libraries are up to date, using the following commands.

Install any missing dependancies
apt-get update
apt-get install -f -y
apt-get update
ubuntu 16.04 (xenial)
dpkg -i xray/app/third-party/rabbitmq/libss<version>.deb
dpkg -i xray/app/third-party/rabbitmq/socat_<version>.deb
dpkg -i xray/app/third-party/rabbitmq/esl-erlang_<version>.deb
ubuntu 18.04 (bionic)
dpkg -i xray/app/third-party/rabbitmq/socat_<version>.deb
dpkg -i xray/app/third-party/rabbitmq/esl-erlang_<version>.deb
Debian 8 (jessie)
# Before installing Erlang dependencies
mv /etc/apt/sources.list.d/backports.list /etc/apt >/dev/null

apt-get update
dpkg -i xray/app/third-party/rabbitmq/libss<version>.deb
dpkg -i xray/app/third-party/rabbitmq/socat_<version>.deb
dpkg -i xray/app/third-party/rabbitmq/esl-erlang_<version>.deb

# After installing Erlang dependencies
mv /etc/apt/backports.list /etc/apt/sources.list.d/backports.list >/dev/null
apt-get update
Debian 9 (stretch)
dpkg -i xray/app/third-party/rabbitmq/socat_<version>.deb
dpkg -i xray/app/third-party/rabbitmq/esl-erlang_<version>.deb

Installing Db-Util

db-util allows us to interact with the Berkley DB that contains information about RPM-based Docker images. This way, JFrog Xray can index OS packages for these images.

RPM

# This will install db-util if db_dump is not available
hash db_dump 2>/dev/null || rpm -ivh --replacepkgs xray/app/third-party/misc/db4-utils-<version>.rpm

DEB

Ubuntu
dpkg -i xray/app/third-party/misc/db5.3-util_<version>.deb
dpkg -i xray/app/third-party/misc/db-util_<version>.deb
Debian 8
dpkg -i xray/app/third-party/misc/db5.3-util_<version>.deb
dpkg -i xray/app/third-party/misc/db-util_<version>.deb
Debian 9
dpkg -i xray/app/third-party/misc/db5.3-util_<version>.deb
dpkg -i xray/app/third-party/misc/db-util_<version>.deb

For Advanced Users

Manual Docker Compose Installation

  1. Extract the contents of the compressed archive and go to the extracted folder.

    tar -xvf jfrog-xray-<version>-compose.tar.gz

    .env file included within the Docker-Compose archive

    This .env file is used by docker-compose and is updated during installations and upgrades.

    Notice that some operating systems do not display dot files by default. If you've made any changes to the file, remember to backup before an upgrade.

  2. Create the following folder structure under $JFROG_HOME/xray.

    |-- [        ]  app
    |   `-- [    ]  third-party
            `-- [999   999    ]  rabbitmq 
    `-- [1035     1035    ]  var
        |-- [1035     1035    ]  data
        |-- [1035     1035    ]  etc
  3. Copy the appropriate docker-compose templates from the templates folder to the extracted folder. Rename it as docker-compose.yaml.

    RequirementTemplate
    Xraydocker-compose.yaml
    RabbitMQdocker-compose-rabbitmq.yaml
    PostgreSQLdocker-compose-postgres.yaml
  4. Update the .env file.

    ## The Installation directory for Xray. IF not entered, the script will prompt you for this input. Default [$HOME/.jfrog/xray]
    ROOT_DATA_DIR=
    
    # Host ID. Other nodes in the cluster will use this ID to identify this node
    HOST_ID=
    
    # ID of the active node. Please leave the value as "None" for active nodes. (shared.rabbitMq.active.node.name).  
    JF_SHARED_RABBITMQ_ACTIVE_NODE_NAME=None 
    
    # IP of the active node. (shared.rabbitMq.active.node.ip)
    JF_SHARED_RABBITMQ_ACTIVE_NODE_IP=127.0.0.1
    
    # Bind IP for Internal ports of Third party applications
    JF_THIRD_PARTY_BIND_IP=127.0.0.1
  5. Customize the product configuration.
    1. Set the Artifactory connection details.
    2. Customize the PostgreSQL Database connection details. (optional)
    3. Set any additional configurations (for example: ports, node id) using the Xray system.yaml configuration file.

      Ensure the host's ID and IP are added to the system.yaml. This is important to ensure that other products and Platform Deployments can reach this instance

  6. Customize any additional product configuration (optional) including, Java Opts and filestore.

  7. Copy the rabbitmq.conf and setRabbitCluster.sh files to the folder: app/third-party/rabbitmq. Ensure both are owned by 999:999 (rabbitmq uid/gid)
  8. Start Xray and PostgreSQL using docker-compose commands.

    ## RabbitMQ needs to be started before starting other services
    docker-compose -p xray-rabbitmq -f docker-compose-rabbitmq.yaml up -d
      
    ## From Xray 3.8.x, PostgreSQL needs to be started before starting the other services.
    docker-compose -p xray-postgres -f docker-compose-postgres.yaml up -d
     
    docker-compose -p xray up -d
     
    ## Check whether service is up
    docker-compose -p xray ps
  9. Access Artifactory from your browser at: http://SERVER_HOSTNAME/ui/. For example, on your local machine: http://localhost/ui/.

  10. Check Distribution log.

    docker ps
    docker-compose -p xray logs

    Configuring the Log Rotation of the Console Log

    The console.log file can grow quickly since all services write to it. The installation scripts add a cron job to log rotate the console.log file every hour.

    This is not  done for manual Docker Compose installations. Learn more on how to configure the log rotation.


Watch the Screencast

  • No labels
Copyright © 2020 JFrog Ltd.