Red Hat JBoss Enterprise Application Platform Administration I

You can change the file handler called welcome-content to have the application path.

It is possible to replace the welcome-content file handler by using the management CLI tool:

/subsystem=undertow/configuration=handler/file=welcome-content:\
write-attribute(name=path,value="/path/to/application")

The previous command defines a Jakarta EE application path. The application must be available in the file system on all the hosts that belong to the domain. This requirement makes the deployment more complicated when you use the managed domain mode.

/:reload-servers

To achieve the same goal using the managed domain, just add the /profile=full-ha level at the beginning of the CLI command.

You can use a deployed application to act as the default web application for the host by changing the default-web-module attribute. This attribute makes easier to manage the deployment in a managed domain, than changing the file handler.

/subsystem=undertow/server=default-server/host=default-host write-attribute(name=default-web-module,value=myapp.war )    

In some scenarios, it is required to remove the JBoss welcome application without replacing the default root web application. This can be accomplished by removing the / location entry for the default-host:

/subsystem=undertow/server=default-server/host=\
default-host/location=\/:remove

After reloading the server, any request using the root context receives a 404 error page.

Since JBoss EAP 7.1, the default legacy security subsystem configuration generates a self-signed certificate to use the 8443 secure port to serve applications. The following XML snippets remarks the HTTPS default configuration for the application port:

<server xmlns="urn:jboss:domain:16.0">
...output omitted...
    <management>
        <security-realms>
            <security-realm name="ManagementRealm">
...output omitted...
            <security-realm name="ApplicationRealm">
                <server-identities>
                    <ssl>
                        <keystore path="application.keystore"
                          relative-to="jboss.server.config.dir"
                          keystore-password="password"
                          alias="server"
                          key-password="password"
                          generate-self-signed-certificate-host="localhost"/>
                    </ssl>
                </server-identities>
                <authentication>
...output omitted...
    <profile>
         <subsystem xmlns="urn:jboss:domain:undertow:12.0"
           default-server="default-server"
           default-virtual-host="default-host"
           default-servlet-container="default"
           default-security-domain="other"
           statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
...output omitted...
            <server name="default-server">
                <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
                <https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>
                <host name="default-host" alias="localhost">
                    <location name="/" handler="welcome-content"/>
                    <http-invoker security-realm="ApplicationRealm"/>
                </host>
            </server>
...output omitted...

For production environments, use certificates signed by recognized certificate authorities (CAs). You can use the elytron security subsystem, or the legacy security subsystem to configure an HTTPS port for serving applications. To learn more about configuring HTTPS by using the elytron security subsystem, see the references section.

The Java Standard Edition (Java SE) defines the format of the Java KeyStore. A Java KeyStore (JKS) is a storage facility for cryptographic keys and certificates. A JKS can store several types of public and private keys, such as the certificates used for a HTTPS connection.

The Java Development Kit (JDK) provides the keytool command to manage JKS repositories. To create a new JKS by importing a CA signed certificate, use the following command:

keytool -v -importkeystore -srckeystore signed-cert.p12 -srcstoretype PKCS12 -destkeystore identity.jks -deststoretype JKS

After creating the keystore, you must create a security realm for each host:

/host=servera/core-service=management/security-realm=HTTPSRealm:add()

Configure the security realm to load the JKS:

/host=servera/core-service=management/security-realm=HTTPSRealm/server-identity=\
ssl:add(keystore-path=/path/identity.jks,keystore-password=changeit,alias=appserver)

Reload the server to apply the changes:

/:reload-servers

Create a HTTPS listener, which uses the new security realm:

/profile=full/subsystem=undertow/server=default-server/https-listener=https:\
add(socket-binding=https,security-realm=HTTPSRealm)

The buffer cache stores static files handled by the undertow subsystem.

<subsystem xmlns="urn:jboss:domain:undertow:12.0">
  <buffer-cache name="default" buffer-size="1024" buffers-per-region="1024" max-regions="10">
...output omitted...
</subsystem>

You can update the buffer size using the management CLI:

/subsystem=undertow/buffer-cache=default:\
write-attribute(name=buffer-size,value=2048)

If a cache is not required, then you can remove it:

/subsystem=undertow/buffer-cache=default:remove

A servlet container instance is defined by the <servlet-container> tag:

<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" ...>
...output omitted...
  <servlet-container name="default">
    <jsp-config/>
    <websockets/>
  </servlet-container>
...output omitted...

You can use the read-resource operation from the CLI to inspect the available attributes for a servlet container:

/subsystem=undertow/servlet-container=default:read-resource
{
    "outcome" => "success",
    "result" => {
        "allow-non-standard-wrappers" => false,
        "default-buffer-cache" => "default",
        "default-cookie-version" => 0,
        "default-encoding" => undefined,
        "default-session-timeout" => 30,
        "directory-listing" => undefined,
        "disable-caching-for-secured-pages" => true,
        "disable-file-watch-service" => false,
        "disable-session-id-reuse" => false,
        "eager-filter-initialization" => false,
        "file-cache-max-file-size" => 10485760,
        "file-cache-metadata-size" => 100,
        "file-cache-time-to-live" => undefined,
        "ignore-flush" => false,
        "max-sessions" => undefined,
        "preserve-path-on-forward" => false,
        "proactive-authentication" => true,
        "session-id-length" => 30,
        "stack-trace-on-error" => "local-only",
        "use-listener-encoding" => false,
        "mime-mapping" => undefined,
        "setting" => {
            "jsp" => undefined,
            "websockets" => undefined
        },
        "welcome-file" => undefined
    }
}

Notice that is possible to define the default buffer cache with the default-buffer-cache attribute.

The session can be managed in the servlet container. Three properties are available for sessions configuration:

To set the default session timeout to one hour, use the following operation:

/subsystem=undertow/servlet-container=default:write-attribute(name=default-session-timeout,value=60)

You can configure the JSP technology for the servlet container. To list the available attributes for the JSP configuration, use the following CLI command:

/subsystem=undertow/servlet-container=default/setting=jsp:read-resource

JBoss EAP provides two types of handlers:

File handlers serve static files. Each file handler must be attached to a location in a virtual host.

To create a new file handler, use the following CLI command:

/subsystem=undertow/configuration=handler/file=photos\
:add(path=/var/photos, directory-listing=true)

Attach the new file handler to a location in a virtual host:

/subsystem=undertow/server=default-server/host=default-host/location=photos\
:add(handler=photos)

This content is available by using the http://ip:port/context/photos URL.

The reverse proxy handler allows JBoss EAP to act as a high performance reverse proxy. This topic is discussed later in this course.

By default, JBoss EAP does not configure any filters. To include a new filter, use the following CLI command:

/subsystem=undertow/configuration=filter/gzip=gzip:add()

You can define the following types of filters: