Configuring the WAPT Server¶
The WAPT Server configuration file on GNU/ Linux systems is found
in /opt/wapt/conf/waptserver.ini.
The WAPT Server configuration file on Windows systems is found
in C:\wapt\conf\waptserver.ini.
Attention
Modification of these files is reserved for advanced users!!
Section [option]¶
Several options can be defined in the section:
[options]
Options |
Description |
|---|---|
|
Defines whether websocket connections should be authenticated |
|
Allows the initial registration of the WAPT agent using a login and password |
|
Debug only - Allows unsigned status data from agent |
|
Set custom WAPT server application root path (ex: wapt) |
|
Related to user ACLs |
|
Host certificate lifetime |
|
Websocket client timeout |
|
Host certificates signing cert |
|
Host certificates signing CRL day |
|
Host certificates signing CRL |
|
Host certificates signing CRL URL |
|
Host certificates signing key |
|
Maximum allowed delay before WAPT agent requests timeout |
|
Maximum allowed delay before PostgreSQL queries timeout |
|
Address of the PostgreSQL server (empty by default, it will use a local Unix Socket). |
|
Maximum simultaneous connections to the PostgreSQL database |
|
Name of the PostgreSQL database that the WAPT Server will connect to. |
|
Password for authenticating the user on the PostgreSQL database (default: empty, it will use a local UNIX socket) |
|
Port of the PostgreSQL server |
|
Database stale timeout, default to 300 seconds |
|
Name of the PostgreSQL user connecting to the database (default: empty, it will use a local UNIX socket). |
|
Enables WAPT Store Webui (WAPT Enterprise only) |
|
Encrypt host package with client certificate |
|
Adds basic authentication to WAPT Server |
|
Defines the proxy server to allow the WAPT server to recover its CRL |
|
Adds additional knowed CA for certificate validation |
|
Defines LDAP authentication base DN |
|
Defines LDAP authentication server |
|
Sets SSL auth on LDAP connections |
|
Debug level. default level is warning |
|
Sets maximum simultaneous WAPT clients connection |
|
Sets minimum admin password length |
|
Defines Nginx http port (Windows only) |
|
Defines Nginx https port (Windows only) |
|
Enable remote repositories diff |
|
Enables remote repositories functionnality on WAPT Server |
|
Enables websocket communication with remote repositories agents |
|
Random string for initializing the Python Flask application server. It is generated when first installing the WAPT Server and is unique for every WAPT Server. |
|
WAPT Server UUID (this anonymous id is used for WAPT statistics). |
|
Maximum allowed time difference for the websockets |
|
Authentication token lifetime |
|
Path to trusted signers certificate directory |
|
Path to trusted users CA certificate directory |
|
Requires a Kerberos authentication when first registering the WAPT agent. |
|
Enables client certification authentication |
|
LDAP DN of Active Directory User Group allowed to connect to WAPT console |
|
CN of Active Directory User Group allowed to connect to WAPT console |
|
Directory of the WAPT repository. |
|
Path to database that handles tasks |
|
SuperAdmin password for connecting to the WAPT console. |
|
Specify WAPT Server python service port, default to |
|
Defines the SuperAdmin username in the WAPT console. |
|
Location of WAPT WUA folder |
|
List of WakeOnLAN UDP ports to send magic packets to |
|
Define how to listen to the waptserver service |
Configuring Nginx¶
The default Nginx configuration is as follows:
server {
listen 80;
listen 443 ssl;
server_name _;
ssl_certificate "/opt/wapt/waptserver/ssl/cert.pem";
ssl_certificate_key "/opt/wapt/waptserver/ssl/key.pem";
ssl_protocols TLSv1.2;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_prefer_server_ciphers on;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_stapling on;
ssl_stapling_verify on;
ssl_session_cache none;
ssl_session_tickets off;
index index.html;
location ~ ^/wapt.* {
proxy_set_header Cache-Control "store, no-cache, must-revalidate, post-check=0, pre-check=0";
proxy_set_header Pragma "no-cache";
proxy_set_header Expires "Sun, 19 Nov 1978 05:00:00 GMT";
root "/var/www";
}
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
location ~ ^/(api/v3/upload_packages|api/v3/upload_hosts/|upload_waptsetup) {
proxy_pass http://127.0.0.1:8080;
client_max_body_size 4096m;
client_body_timeout 1800;
}
location /wapt-host/Packages {
return 403;
}
location /wapt-host/add_host_kerberos {
return 403;
}
location / {
proxy_pass http://127.0.0.1:8080;
}
location /socket.io {
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_pass http://127.0.0.1:8080/socket.io;
}
}
}