From b46dd33508fc97f50ee9e76d795e98b633afbb96 Mon Sep 17 00:00:00 2001 From: Nicolas Albert Date: Tue, 15 Sep 2026 17:49:53 +0200 Subject: [PATCH 1/6] Updated documentation for Convertigo 8.4.4 --- convertigo/content.md | 233 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 189 insertions(+), 44 deletions(-) diff --git a/convertigo/content.md b/convertigo/content.md index e6d4da35fef9..237a84c8f22a 100644 --- a/convertigo/content.md +++ b/convertigo/content.md @@ -26,22 +26,62 @@ You can access the Server admin console on `http://[dockerhost]:28080/convertigo The Server can also be accessed by HTTPS on `https://[dockerhost]:28443/convertigo` if SSL is configured (see the **HTTPS** section below). -## Link Convertigo to a CouchDB database for FullSync (Convertigo EE only) +## Connect Convertigo to a CouchDB database for FullSync (Convertigo EE only) -Convertigo FullSync module uses Apache CouchDB 3.2.2 as NoSQL repository. You can use the **[couchdb](https://hub.docker.com/_/couchdb/)** docker image and link to it convertigo this way +Convertigo FullSync uses Apache CouchDB 3.2.2 as its NoSQL repository. -Launch CouchDB container and name it 'fullsync' +For modern Docker setups, prefer one of these approaches: + +- another container on the same Docker network +- a service running directly on the Docker host + +### CouchDB running on the Docker host + +With Docker Desktop, `host.docker.internal` is available by default: ```console -$ docker run -d --name fullsync couchdb:3.2.2 +docker run -d --name C8O \ + -e JAVA_OPTS="-Dconvertigo.engine.fullsync.couch.url=http://host.docker.internal:5984" \ + -p 28080:28080 %%IMAGE%% ``` -Then launch Convertigo and link it to the running 'fullsync' container. Convertigo Low Code sever will automatically use it as its fullsync repository. +On Docker Engine for Linux, add: + +```console +--add-host host.docker.internal:host-gateway +``` + +Example: + +```console +docker run -d --name C8O \ + --add-host host.docker.internal:host-gateway \ + -e JAVA_OPTS="-Dconvertigo.engine.fullsync.couch.url=http://host.docker.internal:5984" \ + -p 28080:28080 %%IMAGE%% +``` + +### CouchDB running in another container + +Create a user-defined Docker network and run both containers on it: + +```console +docker network create c8o-net +``` + +```console +docker run -d --name fullsync --network c8o-net couchdb:3.2.2 +``` ```console -$ docker run -d --name C8O --link fullsync:couchdb -p 28080:28080 %%IMAGE%% +docker run -d --name C8O --network c8o-net \ + -e JAVA_OPTS="-Dconvertigo.engine.fullsync.couch.url=http://fullsync:5984" \ + -p 28080:28080 %%IMAGE%% ``` +The legacy `--link` option may still work, but it is no longer the recommended Docker approach. + +For compatibility with existing deployments, the image also detects a resolvable host named `couchdb` at startup and configures it as `http://couchdb:5984`. Prefer an explicit `JAVA_OPTS` setting and a user-defined network for new deployments. + ## Use embedded PouchDB as FullSync engine (not for production) Convertigo FullSync is designed to use CouchDB server or cluster. Convertigo FullSync is also compatible with PouchDB but only for little projects or tests. Internet access is required to enable this feature. @@ -49,43 +89,130 @@ Convertigo FullSync is designed to use CouchDB server or cluster. Convertigo Ful It can be enabled directly at startup: ```console -$ docker run -d --name C8O -e JAVA_OPTS="-Dconvertigo.engine.fullsync.pouchdb=true" -p 28080:28080 %%IMAGE%% +docker run -d --name C8O -e JAVA_OPTS="-Dconvertigo.engine.fullsync.pouchdb=true" -p 28080:28080 %%IMAGE%% ``` -## Link Convertigo Low Code Server to a Billing & Analytics database +## Connect Convertigo Low Code Server to a Billing & Analytics database ### MySQL -MySQL is the recommended database for holding Convertigo Low Code server analytics. You can use this command to run convertigo and link it to a running MySQL container. Change `[mysql-container]` to the container name, and `[username for the c8oAnalytics db]`, `[password for specified db user]` with the values for your MySQL configuration. +MySQL is the recommended database for holding Convertigo analytics data. + +If the database runs on the Docker host, use `host.docker.internal`: ```console -$ docker run -d --name C8O --link [mysql-container]:mysql -p 28080:28080 \ - -e JAVA_OPTS="-Dconvertigo.engine.billing.enabled=true \ - -Dconvertigo.engine.billing.persistence.jdbc.username=[username for the c8oAnalytics db] \ - -Dconvertigo.engine.billing.persistence.jdbc.password=[password for specified db user] \ - -Dconvertigo.engine.billing.persistence.jdbc.url=jdbc:mysql://mysql:3306/c8oAnalytics" \ -%%IMAGE%% +docker run -d --name C8O \ + --add-host host.docker.internal:host-gateway \ + -e JAVA_OPTS="-Dconvertigo.engine.billing.enabled=true \ + -Dconvertigo.engine.billing.persistence.jdbc.username=[username for the c8oAnalytics db] \ + -Dconvertigo.engine.billing.persistence.jdbc.password=[password for specified db user] \ + -Dconvertigo.engine.billing.persistence.jdbc.url=jdbc:mysql://host.docker.internal:3306/c8oAnalytics" \ + -p 28080:28080 %%IMAGE%% ``` +If the database runs in another container, connect both containers to the same user-defined Docker network and use the container name in the JDBC URL. + ## Where is Convertigo Low Code server storing deployed projects Projects are deployed in the Convertigo workspace, a simple file system directory. You can map the docker container **/workspace** to your physical system by using: ```console -$ docker run --name C8O -v $(pwd):/workspace -d -p 28080:28080 %%IMAGE%% +docker run --name C8O -v $(pwd):/workspace -d -p 28080:28080 %%IMAGE%% ``` You can share the same workspace by all Convertigo containers. In this case, when you deploy a project on a Convertigo container, it will be seen by others. This is the best way to build multi-instance load balanced Convertigo server farms. **Be sure to have a really fast file sharing between instances !!! We have experienced that Azure File Share is not fast enough** -To avoid log and cache mixing, you have to add 2 variables for instance specific paths: +Shared-workspace deployments can also propagate a subset of administration changes at runtime without restarting every instance. This synchronization is disabled by default and must only be enabled when all instances really share the same Convertigo workspace (for example via NFS or another RWX volume). + +Enable it with: + +```console +-Dconvertigo.engine.session.shared_workspace.sync.enabled=true +``` + +Current runtime synchronization scope: + +- project deploy / import URL / delete +- global symbols +- `engine.properties` runtime replay, including logger levels +- users / roles definitions (`user_roles.db`) for future logins +- cache configure / cache clear + +This shared-workspace sync does **not** cover separate workspaces per pod, Redis-specific notifications, certificates, scheduler, or broader clustered admin forwarding. + +The shared workspace is intended for projects, configuration, and runtime sync markers. Logs and file cache must not be shared between instances. + +For plain Docker multi-instance setups sharing the same `/workspace` mount, use instance-specific paths: ```console -Dconvertigo.engine.cache_manager.filecache.directory=/workspace/cache/[instance name] --Dconvertigo.engine.log4j.appender.CemsAppender.File=/workspace/logs/[instance name]/engine.log +-Dlog.directory=/workspace/logs/[instance name] ``` +For Kubernetes and Helm deployments, prefer pod-local paths such as `/tmp/convertigo-cache` and `/tmp/convertigo-logs` instead of shared-workspace subdirectories. + +Recommended multi-instance example: + +```console +docker run --name C8O1 -v /my-shared-workspace:/workspace -d -p 28081:28080 \ + -e JAVA_OPTS="-Dconvertigo.engine.session.shared_workspace.sync.enabled=true \ + -Dconvertigo.engine.cache_manager.filecache.directory=/workspace/cache/server1 \ + -Dlog.directory=/workspace/logs/server1" \ + %%IMAGE%% +``` + +```console +docker run --name C8O2 -v /my-shared-workspace:/workspace -d -p 28082:28080 \ + -e JAVA_OPTS="-Dconvertigo.engine.session.shared_workspace.sync.enabled=true \ + -Dconvertigo.engine.cache_manager.filecache.directory=/workspace/cache/server2 \ + -Dlog.directory=/workspace/logs/server2" \ + %%IMAGE%% +``` + +## Add custom Java libraries or classes + +At each container start, the image copies the contents of these workspace directories into the Convertigo web application before Tomcat starts: + +- `/workspace/lib/` to `WEB-INF/lib/` for JAR files and their dependencies +- `/workspace/classes/` to `WEB-INF/classes/` for compiled classes and resources + +The directory structure is preserved and overlays the files provided by the image; it does not remove existing web-application files. For classes, keep the package directory structure below `/workspace/classes/` (for example, `com/example/MyClass.class`). Restart or recreate the container after adding or updating these files. To remove an injected file, remove it from the workspace and recreate the container, since a restart does not delete files already copied into the web application. + +For example, prepare a workspace and mount it into the container: + +```console +mkdir -p workspace/lib workspace/classes/com/example +cp my-driver.jar workspace/lib/ +cp build/classes/java/main/com/example/MyClass.class workspace/classes/com/example/ +docker run --name C8O -v "$(pwd)/workspace:/workspace" -d -p 28080:28080 %%IMAGE%% +``` + +This is also useful when iterating on a custom Java extension without building a derived Convertigo image. Ensure that the mounted workspace is writable by the container at startup. + +## Trust custom certificate authorities + +To trust private root or intermediate certificate authorities, mount a dedicated directory at `/cacerts`. At startup, the image copies the JDK default truststore to a temporary location, imports every regular file in this directory with `keytool`, then configures the JVM to use the generated truststore. Certificate files must be X.509 certificates in a format accepted by `keytool` (typically PEM or DER). + +For example: + +```console +mkdir -p custom-ca +cp company-root-ca.pem custom-ca/ +cp partner-intermediate-ca.crt custom-ca/ +docker run --name C8O \ + -v "$(pwd)/workspace:/workspace" \ + -v "$(pwd)/custom-ca:/cacerts:ro" \ + -d -p 28080:28080 convertigo +``` + +Keep this directory outside the Convertigo workspace and mount it read-only. In Kubernetes, mount a ConfigMap or Secret read-only at `/cacerts`. The image only reads custom CAs from this dedicated mount; files in `/workspace` are not considered. + +The standard JDK certificate authorities are retained. The generated truststore is not persisted: restart or recreate the container after adding, replacing, or removing a certificate. If a file cannot be imported, the image logs a warning and continues to start with the certificates successfully imported so far. + +This configuration is independent from the Tomcat HTTPS server certificate configured through `/ssl`. + ## Make image with pre-deployed projects If you want to make a vertical image ready to start with your application inside, you have to have your built projects **.car** files next to your `Dockerfile`: @@ -122,17 +249,31 @@ These accounts can be configured through the **administration console** and save You can change the default administration account : ```console -$ docker run -d --name C8O -e CONVERTIGO_ADMIN_USER=administrator -e CONVERTIGO_ADMIN_PASSWORD=s3cret -p 28080:28080 %%IMAGE%% +docker run -d --name C8O -e CONVERTIGO_ADMIN_USER=administrator -e CONVERTIGO_ADMIN_PASSWORD=s3cret -p 28080:28080 %%IMAGE%% ``` +These variables are startup conveniences. If `/workspace/configuration/engine.properties` already defines `admin.username` or `admin.password`, the matching environment variable is ignored to preserve the persisted configuration. + ### `CONVERTIGO_ANONYMOUS_DASHBOARD` Environment variable You can allow anonymous access to `/convertigo/dashboard/` by setting: ```console -$ docker run -d --name C8O -e CONVERTIGO_ANONYMOUS_DASHBOARD=true -p 28080:28080 %%IMAGE%% +docker run -d --name C8O -e CONVERTIGO_ANONYMOUS_DASHBOARD=true -p 28080:28080 %%IMAGE%% +``` + +If `/workspace/configuration/engine.properties` already defines `anonymous.dashboard`, `CONVERTIGO_ANONYMOUS_DASHBOARD` is ignored. + +### `PUBLIC_DOMAINS` Environment variable + +For production CORS configuration, you can replace the default `cors.policy = =Origin` behavior with an explicit list of public origins: + +```console +docker run -d --name C8O -e PUBLIC_DOMAINS="https://app.example.com#https://admin.example.com" -p 28080:28080 %%IMAGE%% ``` +Values must match the full browser `Origin` header, including scheme and optional port. Multiple origins are separated with `#`. If `/workspace/configuration/engine.properties` already defines `cors.policy`, `PUBLIC_DOMAINS` is ignored. Use `JAVA_OPTS=-Dconvertigo.engine.cors.policy=...` only when you need an explicit JVM-level override. + ## HTTPS / SSL Configuration In many cases, the Convertigo instance is behind a reverse proxy that handles HTTPS / SSL configuration. But you can configure the container to manage existing SSL certificates or dynamically generate one. @@ -148,13 +289,13 @@ If you have an existing certificate and a private key, you can put them in **PEM - `chain.pem` : the optional chain of certificates not included in `cert.pem` using the PEM format ```console -$ docker run -d --name C8O -v :/ssl -p 28443:28443 %%IMAGE%% +docker run -d --name C8O -v :/ssl -p 28443:28443 %%IMAGE%% ``` If you want to expose both **HTTP** and **HTTPS** you can expose both **ports**: ```console -$ docker run -d --name C8O -v :/ssl -p 28080:28080 -p 28443:28443 %%IMAGE%% +docker run -d --name C8O -v :/ssl -p 28080:28080 -p 28443:28443 %%IMAGE%% ``` ### Provide existing certificate using environment variables @@ -166,10 +307,10 @@ If you cannot mount a volume, you can probably add environment variables of prev - `SSL_CHAIN_B64` : the optional chain of certificates not included in `cert.pem` using the base64 PEM format ```console -$ SSL_KEY_B64=$(base64 key.pem) -$ SSL_CERT_B64=$(base64 cert.pem) -$ SSL_CHAIN_B64=$(base64 chain.pem) -$ docker run -d --name C8O -e SSL_KEY_B64="$SSL_KEY_B64" -e SSL_CERT_B64="$SSL_CERT_B64" -e SSL_CHAIN_B64="$SSL_CHAIN_B64" -p 28443:28443 %%IMAGE%% +SSL_KEY_B64=$(base64 key.pem) +SSL_CERT_B64=$(base64 cert.pem) +SSL_CHAIN_B64=$(base64 chain.pem) +docker run -d --name C8O -e SSL_KEY_B64="$SSL_KEY_B64" -e SSL_CERT_B64="$SSL_CERT_B64" -e SSL_CHAIN_B64="$SSL_CHAIN_B64" -p 28443:28443 %%IMAGE%% ``` ### Generate and use a self-signed certificate @@ -179,23 +320,23 @@ If you don't have certificate file, you can dynamically generate one for the fir Use the `SSL_SELFSIGNED` environment variable to indicate for what domain you want generate certificate. ```console -$ docker run -d --name C8O -e SSL_SELFSIGNED=mycomputer -p 28443:28443 %%IMAGE%% +docker run -d --name C8O -e SSL_SELFSIGNED=mycomputer -p 28443:28443 %%IMAGE%% ``` Generated files can be retrieved if the `/ssl` mount point is configured on folder without `cert.pem` nor `key.pem`. ```console -$ docker run -d --name C8O -v :/ssl -e SSL_SELFSIGNED=mycomputer -p 28443:28443 %%IMAGE%% +docker run -d --name C8O -v :/ssl -e SSL_SELFSIGNED=mycomputer -p 28443:28443 %%IMAGE%% ``` ## `JAVA_OPTS` Environment variable -Convertigo is based on a **Java** process with some defaults **JVM** options. You can override our defaults **JVM** options with you own. +Convertigo is based on a **Java** process with default **JVM** options. You can add your own JVM options with this variable; the image keeps its required runtime options. Add any **Java JVM** options such as -D[something] : ```console -$ docker run -d --name C8O -e JAVA_OPTS="-DjvmRoute=server1" -p 28080:28080 %%IMAGE%% +docker run -d --name C8O -e JAVA_OPTS="-DjvmRoute=server1" -p 28080:28080 %%IMAGE%% ``` [Here the list of convertigo specific properties](https://www.convertigo.com/documentation/latest/operating-guide/appendixes/#list-of-convertigo-java-system-properties) (don't forget the `-Dconvertigo.engine.` prefix). @@ -207,17 +348,19 @@ Convertigo generates many logs in a **engine.log** file that can be consulted vi Log file still exists until you add the `LOG_FILE=false` environment variable : ```console - docker run -d --name C8O -e LOG_STDOUT=true -e LOG_FILE=false -p 28080:28080 convertigo +docker run -d --name C8O -e LOG_STDOUT=true -e LOG_FILE=false -p 28080:28080 %%IMAGE%% ``` ## `JXMX` Environment variable -Convertigo tries to allocate this amount of memory in the container and will automatically reduce it until the value is compatible for the Docker memory constraints. Once the best value found, it is used as `-Xmx=${JXMX}m` parameter for the JVM. +Set `JXMX` to define the JVM heap size in MiB. The image then adds `-Xms128m -Xmx=${JXMX}m` to the JVM options. Make sure the container memory limit leaves room for memory outside the Java heap. -The default `JXMX` value is `2048` and can be defined : +When `JXMX` is not set, the image uses `-XX:MaxRAMPercentage=80` instead. + +For example: ```console -$ docker run -d --name C8O -e JXMX="4096" -p 28080:28080 %%IMAGE%% +docker run -d --name C8O -e JXMX="4096" -p 28080:28080 %%IMAGE%% ``` ## `COOKIE_PATH` Environment variable @@ -227,7 +370,7 @@ Convertigo generates a `JSESSIONID` to maintain the user session and stores in a The default `COOKIE_PATH` value is `/` and can be defined : ```console -$ docker run -d --name C8O -e COOKIE_PATH="/convertigo" -p 28080:28080 %%IMAGE%% +docker run -d --name C8O -e COOKIE_PATH="/convertigo" -p 28080:28080 %%IMAGE%% ``` ## `COOKIE_SECURE` Environment variable @@ -239,7 +382,7 @@ The Secure flag can be enabled by setting the `COOKIE_SECURE` environment variab The default `COOKIE_SECURE` value is `false` and can be defined : ```console -$ docker run -d --name C8O -e COOKIE_SECURE="true" -p 28080:28080 %%IMAGE%% +docker run -d --name C8O -e COOKIE_SECURE="true" -p 28080:28080 %%IMAGE%% ``` **Note :** if you have set the **SSL** configuration and you access the **HTTPS 28443** port, cookies are automatically `Secure`. @@ -251,7 +394,7 @@ Allow to configure the **SameSite** parameter for generated cookies. Can be empt The default `COOKIE_SAMESITE` value is **empty** and can be defined this way: ```console -$ docker run -d --name C8O -e COOKIE_SAMESITE=lax -p 28080:28080 %%IMAGE%% +docker run -d –name C8O -e COOKIE_SAMESITE=lax -p 28080:28080 %%IMAGE%% ``` ## `SESSION_TIMEOUT` Environment variable @@ -261,7 +404,7 @@ Allow to configure the default Tomcat **session-timeout** in minutes. This value The default `SESSION_TIMEOUT` value is **30** and can be defined this way: ```console -$ docker run -d --name C8O -e SESSION_TIMEOUT=5 -p 28080:28080 %%IMAGE%% +docker run -d –name C8O -e SESSION_TIMEOUT=5 -p 28080:28080 %%IMAGE%% ``` ## `DISABLE_SUDO` Environment variable @@ -271,7 +414,7 @@ The image includes **sudo** command line, configured to allow the **convertigo** The default `DISABLE_SUDO` value is **empty** and can be defined this way: ```console -$ docker run -d --name C8O -e DISABLE_SUDO=true -p 28080:28080 %%IMAGE%% +docker run -d –name C8O -e DISABLE_SUDO=true -p 28080:28080 %%IMAGE%% ``` ## `ENABLE_JDWP_DEBUG` Environment variable @@ -281,18 +424,20 @@ Convertigo operates using the JVM (Java Virtual Machine). To enable remote debug The default `ENABLE_JDWP_DEBUG` value is **false** and can be defined this way: ```console -$ docker run -d –name C8O -e ENABLE_JDWP_DEBUG=true -p 28080:28080 %%IMAGE%% +docker run -d --name C8O -e ENABLE_JDWP_DEBUG=true -p 28080:28080 -p 8000:8000 %%IMAGE%% ``` +Do not expose port 8000 outside a trusted development network. + ## Pre configurated `docker compose` stack You can use this [README](https://github.com/convertigo/docker/tree/compose) to run a complete Convertigo Low Code server. ```console -$ mkdir convertigo -$ cd convertigo -$ curl -sL https://github.com/convertigo/docker/archive/refs/heads/compose.tar.gz | tar xvz --strip-components=1 -$ docker compose up -d +mkdir convertigo +cd convertigo +curl -sL https://github.com/convertigo/docker/archive/refs/heads/compose.tar.gz | tar xvz --strip-components=1 +docker compose up -d ``` ## Convertigo Helm chart From 0f8a7e1d6c883d3e7dc9f560fe88bd97ffde838d Mon Sep 17 00:00:00 2001 From: Nicolas Albert Date: Tue, 15 Sep 2026 18:10:31 +0200 Subject: [PATCH 2/6] Updated documentation for Convertigo 8.4.4 --- convertigo/content.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/convertigo/content.md b/convertigo/content.md index 237a84c8f22a..ab53bb2cfe71 100644 --- a/convertigo/content.md +++ b/convertigo/content.md @@ -175,8 +175,8 @@ docker run --name C8O2 -v /my-shared-workspace:/workspace -d -p 28082:28080 \ At each container start, the image copies the contents of these workspace directories into the Convertigo web application before Tomcat starts: -- `/workspace/lib/` to `WEB-INF/lib/` for JAR files and their dependencies -- `/workspace/classes/` to `WEB-INF/classes/` for compiled classes and resources +- `/workspace/lib/` to `WEB-INF/lib/` for JAR files and their dependencies +- `/workspace/classes/` to `WEB-INF/classes/` for compiled classes and resources The directory structure is preserved and overlays the files provided by the image; it does not remove existing web-application files. For classes, keep the package directory structure below `/workspace/classes/` (for example, `com/example/MyClass.class`). Restart or recreate the container after adding or updating these files. To remove an injected file, remove it from the workspace and recreate the container, since a restart does not delete files already copied into the web application. From ebb708bab8a35905a890c4130c5c8275dbf258e8 Mon Sep 17 00:00:00 2001 From: Nicolas Albert Date: Wed, 16 Sep 2026 10:45:04 +0200 Subject: [PATCH 3/6] Updated documentation for Convertigo 8.4.4 --- convertigo/content.md | 78 ++++++++++++++++++++++--------------------- 1 file changed, 40 insertions(+), 38 deletions(-) diff --git a/convertigo/content.md b/convertigo/content.md index ab53bb2cfe71..060d1c6ba4b3 100644 --- a/convertigo/content.md +++ b/convertigo/content.md @@ -40,7 +40,7 @@ For modern Docker setups, prefer one of these approaches: With Docker Desktop, `host.docker.internal` is available by default: ```console -docker run -d --name C8O \ +$ docker run -d --name C8O \ -e JAVA_OPTS="-Dconvertigo.engine.fullsync.couch.url=http://host.docker.internal:5984" \ -p 28080:28080 %%IMAGE%% ``` @@ -54,7 +54,7 @@ On Docker Engine for Linux, add: Example: ```console -docker run -d --name C8O \ +$ docker run -d --name C8O \ --add-host host.docker.internal:host-gateway \ -e JAVA_OPTS="-Dconvertigo.engine.fullsync.couch.url=http://host.docker.internal:5984" \ -p 28080:28080 %%IMAGE%% @@ -65,15 +65,15 @@ docker run -d --name C8O \ Create a user-defined Docker network and run both containers on it: ```console -docker network create c8o-net +$ docker network create c8o-net ``` ```console -docker run -d --name fullsync --network c8o-net couchdb:3.2.2 +$ docker run -d --name fullsync --network c8o-net couchdb:3.2.2 ``` ```console -docker run -d --name C8O --network c8o-net \ +$ docker run -d --name C8O --network c8o-net \ -e JAVA_OPTS="-Dconvertigo.engine.fullsync.couch.url=http://fullsync:5984" \ -p 28080:28080 %%IMAGE%% ``` @@ -101,7 +101,7 @@ MySQL is the recommended database for holding Convertigo analytics data. If the database runs on the Docker host, use `host.docker.internal`: ```console -docker run -d --name C8O \ +$ docker run -d --name C8O \ --add-host host.docker.internal:host-gateway \ -e JAVA_OPTS="-Dconvertigo.engine.billing.enabled=true \ -Dconvertigo.engine.billing.persistence.jdbc.username=[username for the c8oAnalytics db] \ @@ -117,7 +117,7 @@ If the database runs in another container, connect both containers to the same u Projects are deployed in the Convertigo workspace, a simple file system directory. You can map the docker container **/workspace** to your physical system by using: ```console -docker run --name C8O -v $(pwd):/workspace -d -p 28080:28080 %%IMAGE%% +$ docker run --name C8O -v $(pwd):/workspace -d -p 28080:28080 %%IMAGE%% ``` You can share the same workspace by all Convertigo containers. In this case, when you deploy a project on a Convertigo container, it will be seen by others. This is the best way to build multi-instance load balanced Convertigo server farms. @@ -156,7 +156,7 @@ For Kubernetes and Helm deployments, prefer pod-local paths such as `/tmp/conver Recommended multi-instance example: ```console -docker run --name C8O1 -v /my-shared-workspace:/workspace -d -p 28081:28080 \ +$ docker run --name C8O1 -v /my-shared-workspace:/workspace -d -p 28081:28080 \ -e JAVA_OPTS="-Dconvertigo.engine.session.shared_workspace.sync.enabled=true \ -Dconvertigo.engine.cache_manager.filecache.directory=/workspace/cache/server1 \ -Dlog.directory=/workspace/logs/server1" \ @@ -164,7 +164,7 @@ docker run --name C8O1 -v /my-shared-workspace:/workspace -d -p 28081:28080 \ ``` ```console -docker run --name C8O2 -v /my-shared-workspace:/workspace -d -p 28082:28080 \ +$ docker run --name C8O2 -v /my-shared-workspace:/workspace -d -p 28082:28080 \ -e JAVA_OPTS="-Dconvertigo.engine.session.shared_workspace.sync.enabled=true \ -Dconvertigo.engine.cache_manager.filecache.directory=/workspace/cache/server2 \ -Dlog.directory=/workspace/logs/server2" \ @@ -183,10 +183,10 @@ The directory structure is preserved and overlays the files provided by the imag For example, prepare a workspace and mount it into the container: ```console -mkdir -p workspace/lib workspace/classes/com/example -cp my-driver.jar workspace/lib/ -cp build/classes/java/main/com/example/MyClass.class workspace/classes/com/example/ -docker run --name C8O -v "$(pwd)/workspace:/workspace" -d -p 28080:28080 %%IMAGE%% +$ mkdir -p workspace/lib workspace/classes/com/example +$ cp my-driver.jar workspace/lib/ +$ cp build/classes/java/main/com/example/MyClass.class workspace/classes/com/example/ +$ docker run --name C8O -v "$(pwd)/workspace:/workspace" -d -p 28080:28080 %%IMAGE%% ``` This is also useful when iterating on a custom Java extension without building a derived Convertigo image. Ensure that the mounted workspace is writable by the container at startup. @@ -198,10 +198,10 @@ To trust private root or intermediate certificate authorities, mount a dedicated For example: ```console -mkdir -p custom-ca -cp company-root-ca.pem custom-ca/ -cp partner-intermediate-ca.crt custom-ca/ -docker run --name C8O \ +$ mkdir -p custom-ca +$ cp company-root-ca.pem custom-ca/ +$ cp partner-intermediate-ca.crt custom-ca/ +$ docker run --name C8O \ -v "$(pwd)/workspace:/workspace" \ -v "$(pwd)/custom-ca:/cacerts:ro" \ -d -p 28080:28080 convertigo @@ -209,6 +209,8 @@ docker run --name C8O \ Keep this directory outside the Convertigo workspace and mount it read-only. In Kubernetes, mount a ConfigMap or Secret read-only at `/cacerts`. The image only reads custom CAs from this dedicated mount; files in `/workspace` are not considered. +`/cacerts` is a convenience to add private or corporate certificate authorities to the standard JDK trust anchors, typically behind a corporate proxy performing TLS inspection, without modifying the JDK installation (the container may run as an arbitrary non-root user). Users who need full control can still provide their own complete JVM truststore through the standard Java configuration, for example `-e JAVA_OPTS="-Djavax.net.ssl.trustStore=/path/to/truststore -Djavax.net.ssl.trustStorePassword=..."`: when `javax.net.ssl.trustStore` is already set in `JAVA_OPTS`, the image keeps that configuration unchanged and ignores `/cacerts` (an informational message is logged at startup). + The standard JDK certificate authorities are retained. The generated truststore is not persisted: restart or recreate the container after adding, replacing, or removing a certificate. If a file cannot be imported, the image logs a warning and continues to start with the certificates successfully imported so far. This configuration is independent from the Tomcat HTTPS server certificate configured through `/ssl`. @@ -249,7 +251,7 @@ These accounts can be configured through the **administration console** and save You can change the default administration account : ```console -docker run -d --name C8O -e CONVERTIGO_ADMIN_USER=administrator -e CONVERTIGO_ADMIN_PASSWORD=s3cret -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e CONVERTIGO_ADMIN_USER=administrator -e CONVERTIGO_ADMIN_PASSWORD=s3cret -p 28080:28080 %%IMAGE%% ``` These variables are startup conveniences. If `/workspace/configuration/engine.properties` already defines `admin.username` or `admin.password`, the matching environment variable is ignored to preserve the persisted configuration. @@ -259,7 +261,7 @@ These variables are startup conveniences. If `/workspace/configuration/engine.pr You can allow anonymous access to `/convertigo/dashboard/` by setting: ```console -docker run -d --name C8O -e CONVERTIGO_ANONYMOUS_DASHBOARD=true -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e CONVERTIGO_ANONYMOUS_DASHBOARD=true -p 28080:28080 %%IMAGE%% ``` If `/workspace/configuration/engine.properties` already defines `anonymous.dashboard`, `CONVERTIGO_ANONYMOUS_DASHBOARD` is ignored. @@ -269,7 +271,7 @@ If `/workspace/configuration/engine.properties` already defines `anonymous.dashb For production CORS configuration, you can replace the default `cors.policy = =Origin` behavior with an explicit list of public origins: ```console -docker run -d --name C8O -e PUBLIC_DOMAINS="https://app.example.com#https://admin.example.com" -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e PUBLIC_DOMAINS="https://app.example.com#https://admin.example.com" -p 28080:28080 %%IMAGE%% ``` Values must match the full browser `Origin` header, including scheme and optional port. Multiple origins are separated with `#`. If `/workspace/configuration/engine.properties` already defines `cors.policy`, `PUBLIC_DOMAINS` is ignored. Use `JAVA_OPTS=-Dconvertigo.engine.cors.policy=...` only when you need an explicit JVM-level override. @@ -289,13 +291,13 @@ If you have an existing certificate and a private key, you can put them in **PEM - `chain.pem` : the optional chain of certificates not included in `cert.pem` using the PEM format ```console -docker run -d --name C8O -v :/ssl -p 28443:28443 %%IMAGE%% +$ docker run -d --name C8O -v :/ssl -p 28443:28443 %%IMAGE%% ``` If you want to expose both **HTTP** and **HTTPS** you can expose both **ports**: ```console -docker run -d --name C8O -v :/ssl -p 28080:28080 -p 28443:28443 %%IMAGE%% +$ docker run -d --name C8O -v :/ssl -p 28080:28080 -p 28443:28443 %%IMAGE%% ``` ### Provide existing certificate using environment variables @@ -310,7 +312,7 @@ If you cannot mount a volume, you can probably add environment variables of prev SSL_KEY_B64=$(base64 key.pem) SSL_CERT_B64=$(base64 cert.pem) SSL_CHAIN_B64=$(base64 chain.pem) -docker run -d --name C8O -e SSL_KEY_B64="$SSL_KEY_B64" -e SSL_CERT_B64="$SSL_CERT_B64" -e SSL_CHAIN_B64="$SSL_CHAIN_B64" -p 28443:28443 %%IMAGE%% +$ docker run -d --name C8O -e SSL_KEY_B64="$SSL_KEY_B64" -e SSL_CERT_B64="$SSL_CERT_B64" -e SSL_CHAIN_B64="$SSL_CHAIN_B64" -p 28443:28443 %%IMAGE%% ``` ### Generate and use a self-signed certificate @@ -320,13 +322,13 @@ If you don't have certificate file, you can dynamically generate one for the fir Use the `SSL_SELFSIGNED` environment variable to indicate for what domain you want generate certificate. ```console -docker run -d --name C8O -e SSL_SELFSIGNED=mycomputer -p 28443:28443 %%IMAGE%% +$ docker run -d --name C8O -e SSL_SELFSIGNED=mycomputer -p 28443:28443 %%IMAGE%% ``` Generated files can be retrieved if the `/ssl` mount point is configured on folder without `cert.pem` nor `key.pem`. ```console -docker run -d --name C8O -v :/ssl -e SSL_SELFSIGNED=mycomputer -p 28443:28443 %%IMAGE%% +$ docker run -d --name C8O -v :/ssl -e SSL_SELFSIGNED=mycomputer -p 28443:28443 %%IMAGE%% ``` ## `JAVA_OPTS` Environment variable @@ -336,7 +338,7 @@ Convertigo is based on a **Java** process with default **JVM** options. You can Add any **Java JVM** options such as -D[something] : ```console -docker run -d --name C8O -e JAVA_OPTS="-DjvmRoute=server1" -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e JAVA_OPTS="-DjvmRoute=server1" -p 28080:28080 %%IMAGE%% ``` [Here the list of convertigo specific properties](https://www.convertigo.com/documentation/latest/operating-guide/appendixes/#list-of-convertigo-java-system-properties) (don't forget the `-Dconvertigo.engine.` prefix). @@ -348,7 +350,7 @@ Convertigo generates many logs in a **engine.log** file that can be consulted vi Log file still exists until you add the `LOG_FILE=false` environment variable : ```console -docker run -d --name C8O -e LOG_STDOUT=true -e LOG_FILE=false -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e LOG_STDOUT=true -e LOG_FILE=false -p 28080:28080 %%IMAGE%% ``` ## `JXMX` Environment variable @@ -360,7 +362,7 @@ When `JXMX` is not set, the image uses `-XX:MaxRAMPercentage=80` instead. For example: ```console -docker run -d --name C8O -e JXMX="4096" -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e JXMX="4096" -p 28080:28080 %%IMAGE%% ``` ## `COOKIE_PATH` Environment variable @@ -370,7 +372,7 @@ Convertigo generates a `JSESSIONID` to maintain the user session and stores in a The default `COOKIE_PATH` value is `/` and can be defined : ```console -docker run -d --name C8O -e COOKIE_PATH="/convertigo" -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e COOKIE_PATH="/convertigo" -p 28080:28080 %%IMAGE%% ``` ## `COOKIE_SECURE` Environment variable @@ -382,7 +384,7 @@ The Secure flag can be enabled by setting the `COOKIE_SECURE` environment variab The default `COOKIE_SECURE` value is `false` and can be defined : ```console -docker run -d --name C8O -e COOKIE_SECURE="true" -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e COOKIE_SECURE="true" -p 28080:28080 %%IMAGE%% ``` **Note :** if you have set the **SSL** configuration and you access the **HTTPS 28443** port, cookies are automatically `Secure`. @@ -394,7 +396,7 @@ Allow to configure the **SameSite** parameter for generated cookies. Can be empt The default `COOKIE_SAMESITE` value is **empty** and can be defined this way: ```console -docker run -d –name C8O -e COOKIE_SAMESITE=lax -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e COOKIE_SAMESITE=lax -p 28080:28080 %%IMAGE%% ``` ## `SESSION_TIMEOUT` Environment variable @@ -404,7 +406,7 @@ Allow to configure the default Tomcat **session-timeout** in minutes. This value The default `SESSION_TIMEOUT` value is **30** and can be defined this way: ```console -docker run -d –name C8O -e SESSION_TIMEOUT=5 -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e SESSION_TIMEOUT=5 -p 28080:28080 %%IMAGE%% ``` ## `DISABLE_SUDO` Environment variable @@ -414,7 +416,7 @@ The image includes **sudo** command line, configured to allow the **convertigo** The default `DISABLE_SUDO` value is **empty** and can be defined this way: ```console -docker run -d –name C8O -e DISABLE_SUDO=true -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e DISABLE_SUDO=true -p 28080:28080 %%IMAGE%% ``` ## `ENABLE_JDWP_DEBUG` Environment variable @@ -424,7 +426,7 @@ Convertigo operates using the JVM (Java Virtual Machine). To enable remote debug The default `ENABLE_JDWP_DEBUG` value is **false** and can be defined this way: ```console -docker run -d --name C8O -e ENABLE_JDWP_DEBUG=true -p 28080:28080 -p 8000:8000 %%IMAGE%% +$ docker run -d --name C8O -e ENABLE_JDWP_DEBUG=true -p 28080:28080 -p 8000:8000 %%IMAGE%% ``` Do not expose port 8000 outside a trusted development network. @@ -434,10 +436,10 @@ Do not expose port 8000 outside a trusted development network. You can use this [README](https://github.com/convertigo/docker/tree/compose) to run a complete Convertigo Low Code server. ```console -mkdir convertigo -cd convertigo -curl -sL https://github.com/convertigo/docker/archive/refs/heads/compose.tar.gz | tar xvz --strip-components=1 -docker compose up -d +$ mkdir convertigo +$ cd convertigo +$ curl -sL https://github.com/convertigo/docker/archive/refs/heads/compose.tar.gz | tar xvz --strip-components=1 +$ docker compose up -d ``` ## Convertigo Helm chart From 318f94322fe4afa28c26f83b427b30e02e98a115 Mon Sep 17 00:00:00 2001 From: Nicolas Albert Date: Mon, 21 Sep 2026 15:05:15 +0200 Subject: [PATCH 4/6] Updated documentation for Convertigo 8.4.4 --- convertigo/content.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/convertigo/content.md b/convertigo/content.md index 060d1c6ba4b3..555e7648ad23 100644 --- a/convertigo/content.md +++ b/convertigo/content.md @@ -89,7 +89,7 @@ Convertigo FullSync is designed to use CouchDB server or cluster. Convertigo Ful It can be enabled directly at startup: ```console -docker run -d --name C8O -e JAVA_OPTS="-Dconvertigo.engine.fullsync.pouchdb=true" -p 28080:28080 %%IMAGE%% +$ docker run -d --name C8O -e JAVA_OPTS="-Dconvertigo.engine.fullsync.pouchdb=true" -p 28080:28080 %%IMAGE%% ``` ## Connect Convertigo Low Code Server to a Billing & Analytics database From 3ab4f7cd0b3d200b1064ea574911bfee23480c44 Mon Sep 17 00:00:00 2001 From: Nicolas Albert Date: Mon, 21 Sep 2026 15:18:47 +0200 Subject: [PATCH 5/6] Updated documentation for Convertigo 8.4.4 --- convertigo/content.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/convertigo/content.md b/convertigo/content.md index 555e7648ad23..f5c2322ae99b 100644 --- a/convertigo/content.md +++ b/convertigo/content.md @@ -309,9 +309,9 @@ If you cannot mount a volume, you can probably add environment variables of prev - `SSL_CHAIN_B64` : the optional chain of certificates not included in `cert.pem` using the base64 PEM format ```console -SSL_KEY_B64=$(base64 key.pem) -SSL_CERT_B64=$(base64 cert.pem) -SSL_CHAIN_B64=$(base64 chain.pem) +$ SSL_KEY_B64=$(base64 key.pem) +$ SSL_CERT_B64=$(base64 cert.pem) +$ SSL_CHAIN_B64=$(base64 chain.pem) $ docker run -d --name C8O -e SSL_KEY_B64="$SSL_KEY_B64" -e SSL_CERT_B64="$SSL_CERT_B64" -e SSL_CHAIN_B64="$SSL_CHAIN_B64" -p 28443:28443 %%IMAGE%% ``` From d268aa311078180e5842bd50dba8c5111d430e0f Mon Sep 17 00:00:00 2001 From: Nicolas Albert Date: Tue, 22 Sep 2026 10:41:07 +0200 Subject: [PATCH 6/6] Updated documentation for Convertigo 8.4.4 --- convertigo/content.md | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/convertigo/content.md b/convertigo/content.md index f5c2322ae99b..19665775cf6c 100644 --- a/convertigo/content.md +++ b/convertigo/content.md @@ -193,27 +193,21 @@ This is also useful when iterating on a custom Java extension without building a ## Trust custom certificate authorities -To trust private root or intermediate certificate authorities, mount a dedicated directory at `/cacerts`. At startup, the image copies the JDK default truststore to a temporary location, imports every regular file in this directory with `keytool`, then configures the JVM to use the generated truststore. Certificate files must be X.509 certificates in a format accepted by `keytool` (typically PEM or DER). - -For example: +The image is based on the Eclipse Temurin JDK image, which ships an entrypoint able to add certificate authorities to the JVM truststore. It is opt-in: set the `USE_SYSTEM_CA_CERTS` environment variable and mount the certificates, in PEM format with a `.crt` extension, in the `/certificates` directory. A file may contain several certificates. ```console $ mkdir -p custom-ca -$ cp company-root-ca.pem custom-ca/ +$ cp company-root-ca.crt custom-ca/ $ cp partner-intermediate-ca.crt custom-ca/ $ docker run --name C8O \ - -v "$(pwd)/workspace:/workspace" \ - -v "$(pwd)/custom-ca:/cacerts:ro" \ + -e USE_SYSTEM_CA_CERTS=1 \ + -v "$(pwd)/custom-ca:/certificates:ro" \ -d -p 28080:28080 convertigo ``` -Keep this directory outside the Convertigo workspace and mount it read-only. In Kubernetes, mount a ConfigMap or Secret read-only at `/cacerts`. The image only reads custom CAs from this dedicated mount; files in `/workspace` are not considered. - -`/cacerts` is a convenience to add private or corporate certificate authorities to the standard JDK trust anchors, typically behind a corporate proxy performing TLS inspection, without modifying the JDK installation (the container may run as an arbitrary non-root user). Users who need full control can still provide their own complete JVM truststore through the standard Java configuration, for example `-e JAVA_OPTS="-Djavax.net.ssl.trustStore=/path/to/truststore -Djavax.net.ssl.trustStorePassword=..."`: when `javax.net.ssl.trustStore` is already set in `JAVA_OPTS`, the image keeps that configuration unchanged and ignores `/cacerts` (an informational message is logged at startup). - -The standard JDK certificate authorities are retained. The generated truststore is not persisted: restart or recreate the container after adding, replacing, or removing a certificate. If a file cannot be imported, the image logs a warning and continues to start with the certificates successfully imported so far. +At startup, the certificates are imported into a copy of the JDK truststore (the JDK installation is not modified, so this also works with an arbitrary non-root user) and the JVM is configured to use that copy through `JAVA_TOOL_OPTIONS`. The system certificate authorities of the image are imported as well. When the container runs as `root`, the certificates are also added to the system trust store, so command-line tools such as `curl` trust them too. In Kubernetes, mount a ConfigMap or Secret read-only at `/certificates`. The truststore is rebuilt at every container start: restart or recreate the container after adding, replacing or removing a certificate. The JVM reports the truststore it uses with a `Picked up JAVA_TOOL_OPTIONS` line at startup. -This configuration is independent from the Tomcat HTTPS server certificate configured through `/ssl`. +This mechanism is documented by the [Eclipse Temurin image](https://hub.docker.com/_/eclipse-temurin) and is meant for the common case of a private or corporate certificate authority, typically behind a proxy performing TLS inspection. Users who need full control can provide their own complete JVM truststore through the standard Java configuration instead, for example `-e JAVA_OPTS="-Djavax.net.ssl.trustStore=/path/to/truststore -Djavax.net.ssl.trustStorePassword=..."`: options given in `JAVA_OPTS` take precedence over `JAVA_TOOL_OPTIONS`. ## Make image with pre-deployed projects