Installing Insight

Single Node Installation

The following installation methods are supported:

• Interactive Script (recommended)
• Linux Archive
• Manual RPM
• Manual Debian
• Helm

Interactive Script Installation (recommended)

All install types are supported, including: Docker Compose, Linux Archive, RPM and Debian.

The installer script provides you an interactive way to install Insight and its dependencies. All install types are supported. This installer should be used for Docker Compose.

1. Download Insight.

2. Extract the contents of the compressed archive and go to the extracted folder.
   

   tar -xvf jfrog-insight--.tar.gz cd jfrog-insight--

   OS user permissions for Linux archive

   When running Insight, the installation script creates a user called insight by defaultwhich must have run and execute permissions on the installation directory.

   It is recommended to extract the Insight download file into a directory that gives run and execute permissions to all users such as/opt.

   Linux archive

   mv jfrog-insight--linux.tar.gz /opt/ cd /opt tar -xf jfrog-insight--linux.tar.gz mv jfrog-insight--linux insight cd insight

   .env file included within the Docker-Compose archive

   This .env file is used bydocker-composeand is updated during installations and upgrades.

   Notice that some operating systems do not display dot files by default. If you've made any changes to the file, remember to backup before an upgrade.

3. Run the installer script.
   Note: the script will prompt you with a series of mandatory inputs, including thejfrogURL(custom base URL)andjoinKey.
   

   Docker Compose

   ./config.sh

   RPM/DEB

   ./install.sh

   Prerequisites for Linux archive

   Refer toprerequisites for Insight in Linux Archivebefore running the install script.

   Linux archive

   ./install.sh --user  --group  -h | --help : [optional] display usage -u | --user : [optional] (default: insight) user which will be used to run the product, it will be created if its unavailable -g | --group : [optional] (default: insight) group which will be used to run the product, it will be created if its unavailable

4. Validate and customize the product configuration(optional), including the third party dependencies connection details and ports.

5. Start and manage the Insight service.

   systemd OS

   systemctl start|stop insight.service

   systemv

   service insight start|stop

   Docker Compose

   cd jfrog-insight--compose docker-compose -p insight up -d docker-compose -p insight ps docker-compose -p insight down

   Insight can be installed and managed as a service in a Linux archive installation. Referstart Insight section under Linux Archive Manual Installationfor more details.

   Linux archive

   insight/app/bin/insight.sh start|stop

6. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI.

7. Check the Insight log.
   

   tail -f $JFROG_HOME/insight/var/log/console.log

   Configuring the Log Rotation of the Console Log

   Theconsole.logfile can grow quickly since all services write to it. This file is not log rotated for Darwin installations. Learn more on how toconfigure the log rotation.

Linux Archive Installation

1. Download Insight.

2. Extract the contents of the compressed archive and move it into /insight directory..

   tar -xvf jfrog-insight--linux.tar.gz mv jfrog-insight--linux insight

3. Install PostgreSQL.
   

   PostgreSQL is required and must be installed before continuing with the next installation steps.

   Set your PostgreSQL connection details in theShared Configurationssection of the$JFROG_HOME/insight/var/etc/system.yamlfile

4. Prepare for the Elasticsearch Installation by increasing the map count. For additional information refer to theElastic Search documentation.
   

   sudo sysctl -w vm.max_map_count=262144

   To make this change permanent, remember to update thevm.max_map_countsetting in/etc/sysctl.conf.

5. Install Elasticsearch. Instructions to install Elasticsearch are availablehere.
   

   You can install the package available at /insight/app/third-party/elasticsearch/elasticsearch-.tar.gzor you can download a compatible version of Elasticsearch from thispage.
   
   

   1. Install Search Guard. The Search Guard package can be located in the extracted contents at/mc/app/third-party/elasticsearch/search-guard-.tar.gz. For installation steps, refer to theSearch Guard documentation.
      

      Important

      Youmustinstall the Search Guard plugin to ensure secure communication with Elasticsearch.

      
      

      1. Add an admin user to Search Guard, to ensure authenticated communication with Elasticsearch.
         The Search Guard configuration accepts a hashed password. Use the following command to generate the hash for the password.
         
         

         /insight/app/third-party/elasticsearch/elasticsearch-/plugins/search-guard-7/tools/hash.sh -p  #This will output a hashed password (), make a copy of it

      2. Prepare the configuration snippet to add a new(admin) user with the hashed password obtained from previous step.
         

         : hash: "" backend_roles: - "admin" description: "Insight Elastic admin user"

      3. Paste the above snippet to the end of this file “sg_internal_users.yml” located at <JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-/plugins/search-guard-7/sgconfig/.
         
         

   2. Enable the anonymous access to_cluster/healthendpoint. This is required to check the health of Elasticsearch cluster.
      Enable the anonymous auth in this filesg_config.ymlat <JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-/plugins/search-guard-7/sgconfig/.
      

      sg_config: dynamic: http: anonymous_auth_enabled: true #set this to true

   3. Map the anonymous usersg_anonymousto the backend role "sg_anonymous_backendrole" in this file "sg_roles_mapping.yml" at <JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-/plugins/search-guard-7/sgconfig/.
      

      sg_anonymous: backend_roles: - sg_anonymous_backendrole

   4. Add the following snippet to the end of this filesg_roles.ymllocated at<JFROG_HOME>/insight/app/third-party/elasticsearch/elasticsearch-/plugins/search-guard-7/sgconfig/.

      sg_anonymous: cluster_permissions: - cluster:monitor/health

6. Add the following in the shared section of$JFROG_HOME/insight/var/etc/system.yamlfile. Refer toShared Configurationssection.

   shared: elasticsearch: external: true url: : username:  password: 

   If you use Amazon Elasticsearch Service, enter the following in the shared section of the YAML file.

   shared: elasticsearch: url: : external: true aes: signed: true serviceName:  region:  accessKey:  secretKey: 

   If you use the Amazon Elasticsearch Service, you must log in to the service using your Amazon AWS credentials.

7. Start PostgreSQL and Elasticsearch
   

8. Customize the product configuration.
   1. Set the Artifactory connection details.
      
   2. Customize the PostgreSQL Database connection details (optional).
   3. Set any additional configurations (for example: ports, node id) using theInsightsystem.yamlconfiguration file.
      
      

9. Start and manage the Insight service as the user who extracted the tar.
   As a process
   

   Daemon Process

   insight/app/bin/insight.sh start

   Manage the process.

   insight/app/bin/insight.sh start|stop|status|restart

   As a service
   了解包装作为存档文件和一个本月all script that can be used to install it as a service running under a custom user. Currently supported on Linux systems.
   

   OS User Permissions

   When running Insight as a service, the installation script creates a user calledinsight(by default)which must have run and execute permissions on the installation directory.

   It is recommended to extract the Insight download file into a directory that gives run and execute permissions to all users such as/opt.

   To install Insight as a service,execute the following command as root:

   User and group can be passed throughinsight/var/etc/system.yamlasshared.userandshared.group. This takes precedence over values passed through command line on install.

   insight/app/bin/installService.sh --user  --group  -u | --user : [optional] (default: insight) user which will be used to run the product, it will be created if its unavailable -g | --group : [optional] (default: insight) group which will be used to run the product, it will be created if its unavailable

   The user and group will be stored in theinsight/var/etc/system.yamlat the end of the installation.
   To manage the service, use thesystemdorinit.dcommands depending on your system.
   

   Using systemd

   systemctl  insight.service

   Using init.d

   service insight 

10. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI

11. Check the Insight log.
    

    tail -f $JFROG_HOME/insight/var/log/console.log

Manual RPM Installation

The RPM installation bundles Insight and all its dependencies. It is provided as native RPM packages, where Insight and its dependencies must be installed separately. Use this, if you are automating installations.

1. Download Insight.

2. Extract the contents of the compressed archive, and go to the extracted folder:
   

   tar -xvf jfrog-insight--rpm.tar.gz cd jfrog-insight--rpm

3. Install Insight. You must run as a root user.
   

   rpm -Uvh --replacepkgs ./insight/insight.rpm

4. InstallPostgreSQLand start the PostgreSQL service.
   

   PostgreSQL is required and must be installed before continuing with the next installation steps.

   Set your PostgreSQL connection details in theShared Configurationssection of the$JFROG_HOME/insight/var/etc/system.yamlfile.

5. Install Elasticsearch. Instructions to install Elasticsearch are availablehere.
   
   

   You can install the package available atjfrog-insight--rpm/third-party/elasticsearch/elasticsearch-.tar.gzor you can download a compatible version of Elasticsearch from thispage.

   When connecting an external instance of Elasticsearch to Insight, add the following flag in the Shared Configurations of$JFROG_HOME/insight/var/etc/system.yamlfile.
   

   shared: elasticsearch: external: true

   
   

   1. Install Search Guard. The Search Guard package can be located in the extracted contents atjfrog-insight--rpm/third-party/elasticsearch/search-guard-.tar.gz. For installation steps, refer to theSearch Guard documentation.
      

      Important

      Youmustinstall the Search Guard plugin to ensure secure communication with Elasticsearch.

      
      

      1. Add an admin user to Search Guard, to ensure authenticated communication with Elasticsearch.
         The Search Guard configuration accepts a hashed password. Use the following command to generate the hash for the password.
         
         

         /etc/elasticsearch/plugins/search-guard-7/tools/hash.sh -p  #This will output a hashed password (), make a copy of it

      2. Prepare the configuration snippet to add a new(admin) user with the hashed password obtained from previous step.
         

         : hash: "" backend_roles: - "admin" description: "Insight Elastic admin user"

      3. Paste the above snippet to the end of this file “sg_internal_users.yml” located at/etc/elasticsearch/plugins/search-guard-7/sgconfig/.
         
         

   2. Enable the anonymous access to_cluster/healthendpoint. This is required to check the health of Elasticsearch cluster.
      Enable the anonymous auth in this filesg_config.ymlat/etc/elasticsearch/plugins/search-guard-7/sgconfig/.
      

      sg_config: dynamic: http: anonymous_auth_enabled: true #set this to true

   3. Map the anonymous usersg_anonymousto the backend role "sg_anonymous_backendrole" in this file "sg_roles_mapping.yml" at/etc/elasticsearch/plugins/search-guard-7/sgconfig.
      

      sg_anonymous: backend_roles: - sg_anonymous_backendrole

   4. Add the following snippet to the end of this filesg_roles.ymllocated at/etc/elasticsearch/plugins/search-guard-7/sgconfig/.

      sg_anonymous: cluster_permissions: - cluster:monitor/health

6. Add the following in the shared section of$JFROG_HOME/insight/var/etc/system.yamlfile. Refer toShared Configurationssection.

   shared: elasticsearch: url: : username:  password: 

   If you use Amazon Elasticsearch Service, enter the following in the shared section of the YAML file.

   shared: elasticsearch: url: : external: true aes: signed: true serviceName:  region:  accessKey:  secretKey: 

   If you use the Amazon Elasticsearch Service, you must log in to the service using your Amazon AWS credentials.

   
   

   
   

7. Customize the product configuration.
   
   

   1. Set the Artifactory connection details.
      
   2. Customize the PostgreSQL Database connection details. (optional)
   3. Set any additional configurations (for example: ports, node id) using theInsightsystem.yamlconfiguration file.
      
      

8. Start and manage the Insight service.
   

   systemd OS

   systemctl start|stop insight.service

   systemv OS

   service insight start|stop|status|restart

9. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI

10. Check the Insight log.
    

    Linux

    tail -f $JFROG_HOME/insight/var/log/console.log

Manual Debian Installation

The Debian installation bundles Insight and all its dependencies. It is provided as native Debian packages, where Insight and its dependencies must be installed separately. Use this, if you are automating installations.

1. Download Insight.

2. Extract the contents of the compressed archive, and go to the extracted folder:
   

   tar -xvf jfrog-insight--deb.tar.gz cd jfrog-insight--deb

3. Install Insight.You must run as a root user.
   

   dpkg -i ./insight/insight.deb

4. InstallPostgreSQL.
   

   PostgreSQL is required and must be installed before continuing with the next installation steps.
   

   Set your PostgreSQL connection details in theShared Configurationssection of the$JFROG_HOME/insight/var/etc/system.yamlfile.

5. Install Elasticsearch. Instructions to install Elasticsearch are availablehere.
   

   
   You can install the package available atjfrog-insight--deb/third-party/elasticsearch/elasticsearch-.tar.gzor you can download a compatible version of Elasticsearch from thispage.
   
   

   1. Install Search Guard. The Search Guard package can be located in the extracted contents atjfrog-insight--deb/third-party/elasticsearch/search-guard-.tar.gz. For installation steps, refer to theSearch Guard documentation.
      

      Important

      Youmustinstall the Search Guard plugin to ensure secure communication with Elasticsearch.

      
      

      1. Add an admin user to Search Guard, to ensure authenticated communication with Elasticsearch.
         The Search Guard configuration accepts a hashed password. Use the following command to generate the hash for the password.
         
         

         /usr/share/elasticsearch/plugins/search-guard-7/tools/hash.sh -p  #This will output a hashed password (), make a copy of it

      2. Prepare the configuration snippet to add a new(admin) user with the hashed password obtained from previous step.
         

         : hash: "" backend_roles: - "admin" description: "Insight Elastic admin user"

      3. Paste the above snippet to the end of this file “sg_internal_users.yml” located at/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/.
         
         

   2. Enable the anonymous access to_cluster/healthendpoint. This is required to check the health of Elasticsearch cluster.
      Enable the anonymous auth in this filesg_config.ymlat/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/.
      

      sg_config: dynamic: http: anonymous_auth_enabled: true #set this to true

   3. Map the anonymous usersg_anonymousto the backend role "sg_anonymous_backendrole" in this file "sg_roles_mapping.yml" at/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/.
      

      sg_anonymous: backend_roles: - sg_anonymous_backendrole

   4. Add the following snippet to the end of this filesg_roles.ymllocated at/usr/share/elasticsearch/plugins/search-guard-7/sgconfig/.

      sg_anonymous: cluster_permissions: - cluster:monitor/health

      
      
      

6. Add the following in the shared section of$JFROG_HOME/insight/var/etc/system.yamlfile. Refer toShared Configurationssection.

   shared: elasticsearch: url: : username:  password: 

   If you use Amazon Elasticsearch Service, enter the following in the shared section of the YAML file.

   shared: elasticsearch: url: : external: true aes: signed: true serviceName:  region:  accessKey:  secretKey: 

   If you use the Amazon Elasticsearch Service, you must log in to the service using your Amazon AWS credentials.

7. Customize the product configuration.
   

   1. Set the Artifactory connection details.
      
   2. Customize the PostgreSQL Database connection details. (optional)
   3. Set any additional configurations (for example: ports, node id) using theInsightsystem.yamlconfiguration file.
      
      

8. Start and manage the Insight service.
   

   systemd OS

   systemctl start|stop insight.service

   systemv OS

   service insight start|stop|status|restart

9. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI.

10. Check the Insight log.
    

    Linux

    tail -f $JFROG_HOME/insight/var/log/console.log

Helm Chart Installation

1. Add thehttps://charts.jfrog.ioto your Helm client.
   

   helm repo add jfrog https://charts.jfrog.io

2. Update the repository.

   helm repo update

3. Initiate installation by providing ajoin key and JFrog url as a parameter to the Insight chart installation.

   helm upgrade --install insight --set insightServer.joinKey= \ --set insightServer.jfrogUrl= --namespace insight jfrog/insight

   Alternatively, you can manually create a secret containing the join key and then pass it to the template during install/upgrade. The key must be named join-key.
   

   kubectl create secret generic my-secret --from-literal=join-key= # Pass the created secret to helm helm upgrade --install insight --set insightServer.joinKeySecretName=my-secret --namespace insight jfrog/insight

   In either case, make sure to pass the same join key on all future calls tohelm installandhelm upgrade! This means always passing--set insightServer.joinKey=. In the second, this means always passing--set insightServer.joinKeySecretName=my-secretand ensuring the contents of the secret remain unchanged.

4. Customize the product configuration(optional)including database, Java Opts, and filestore.
   

   Unlike other installations, Helm Chart configurations are made to thevalues.yamland are then applied to thesystem.yaml.

   Follow these steps to apply the configuration changes.

   1. Make the changes tovalues.yaml.

   2. Run the command.
      

      helm upgrade --installinsight --namespace insight -f values.yaml

   3. Restart Insight to apply the changes.

5. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI.

6. Check the status of your deployed Helm releases.
   

   helm status insight

HA Installation

The following describes how to set up a Insight HA cluster with more than one node. For more information about HA, seeSystem Architecture.

Prerequisites

All nodes within the same Insight HA installation must be running the same Artifactory version.

Database

Insight HA requires an external PostgreSQL database. Make sure to install it before proceeding to install the first node. There are several ways to setup PostgreSQL for redundancy. Including: HA, Load Balancing and Replication. For moreinformation, see thePostgreSQL documentation

Network

• All the Insight HA components (Insight cluster nodes, database server and Elasticsearch) must be within the same fast LAN.

• All the HA nodes must communicate with each other through dedicated TCP ports.

The following installation methods are supported:

• Interactive Script
• Linux Archive
• Helm

Interactive Script

All install types are supported, including: Docker Compose, Linux Archive, RPM, and Debian.

The installer script provides you an interactive way to install Insight and its dependencies. All install types are supported. Use this installer for Docker Compose.

1. Install the first node. The installation is identical to thesingle node installation.
   

   Do not start the Insight service.

2. Start the Insight service.

   systemd OS

   systemctl start insight.service

   systemv

   service insight start

   Docker Compose

   cd jfrog-insight--compose docker-compose -p insight up -d

   You can install and manage Insight as a service in a Linux archive installation. Referthe Start Insight section under Manual Linux Archive Installationfor more details.

   Linux Archive

   insight/app/bin/insight.sh start

3. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI.
   
   

4. Check the Insight log.

   tail -f $JFROG_HOME/insight/var/log/console.log

   Docker Compose

   docker-compose -p insight logs

Installing Additional Nodes

For a node to join a cluster, the node must have the same database configuration and the master key.

1. If you installed Search Guard along with Elasticsearch , you must copy the client and node certificates from Elasticsearch's configuration folder in the primary node to all the additional nodes.
   If you want to use the bundled Elasticsearch installation with Insight in RPM and Debian installations, copy the client and node certificates from Elasticsearch's configuration folder from the master node to a new directory named as "sg-certs" under the extracted folder on additional node.
   
   

   RPM

   Create the folder,sg-certsinside the installer folder,jfrog-insight--rpm.

   Copy localhost.key, localhost.pem, and root-ca.pem from the Elasticsearch source folder,/etc/elasticsearch/,to jfrog-insight--rpm/sg-certs.

   Debian

   Create the folder,sg-certsinside the installer folder,jfrog-insight--deb.

   Copy localhost.key, localhost.pem, and root-ca.pem from the Elasticsearch source folder,/etc/elasticsearch/,to jfrog-insight--deb/sg-certs.

   Docker Compose

   Docker Compose installer uses pre-generated certificates for Search Guard. You do not need to manually copy the client and node certificates.

2. Install the additional node. The installation is identical to thesingle node installationwith the following differences:
   • Enter Y when the installer prompts whether to join a cluster.
   • Enter the database connection string of the primary node.
   • 如果你使用捆绑PostgreSQL数据库,输入the database name asinsight.
   • Enter the master key of the primary Insight node.
     The master key is available at$JFROG_HOME/etc/security/master.key.
     
     
3. Start the additional node.
   
   
4. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI.
   
   

5. Check the Insight log.
   

   Linux

   tail -f $JFROG_HOME/insight/var/log/console.log

   Docker Compose

   docker-compose -p insight logs

Manual Linux Archive Installation

Installing the First Node

1. Install the first node. The installation is identical to thesingle node installation.
   

   Do not start the Insight service.

2. Configure thesystem.yamlfile withthe database and first node configuration details. For example,
   

   First node system.yaml

   shared: database: type: postgresql driver: org.postgresql.Driver url: jdbc:postgresql:///insight?sslmode=disable username:  password:  jfrogUrl:  security: joinKey: 

3. Start and manage the Insight service.
   

   systemd OS

   systemctl start|stop insight.service

   Systemv OS

   service insight start|stop

   
   

   
   

4. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI
   
   

5. Check the Insight log.
   

   Linux

   tail -f $JFROG_HOME/insight/var/log/console.log

Installing Additional Nodes

For a node to join a cluster, the node must have the same database configuration and the master key. Install all additional nodes using the same steps described above, with the following additional steps:

1. Configure thesystem.yamlfile for the additional node with master key, database and active node configurations.
   For example:

   Additional node system.yaml

   shared: database: type: postgresql driver: org.postgresql.Driver url: jdbc:postgresql:///insight?sslmode=disable username:  password:  jfrogUrl:  security: joinKey:  # Configure the following property values when Elasticsearch is installed from the bundled Insight package. elasticsearch: clusterSetup: "YES" unicastFile: "$JFROG_HOME/insight/data/elasticsearch/config/unicast_hosts.txt"

2. Copy themaster.keyfrom the first node to the additional node located at $JFROG_HOME/insight/var/etc/security/master.key.
3. Add the username and password as configured for Elasticsearch on master node on the additional node too. Add it to theShared Configurationssection in$JFROG_HOME/insight/var/etc/system.yamlfile.

4. If you installed Search Guard along with Elasticsearch, copy the client and node certificates from Elasticsearch's config folder from the primary node to a new directory,sg-certs, under the extracted folder on the additional node.

5. Start the additional node.

6. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI.

7. Check the Insight log.
   

   Linux

   tail -f $JFROG_HOME/insight/var/log/console.log

Helm Installation HA

helm upgrade --install insight --namespace insight --set replicaCount=3 jfrog/insight

1. Add thehttps://charts.jfrog.ioto your Helm client.
   

   helm repo add jfrog https://charts.jfrog.io

2. Update the repository.
   

   helm repo update

3. Initiate installation by providing ajoin key and JFrog url as a parameter to the Insight chart installation.
   

   helm upgrade --install insight --set insight.joinKey= \ --set insightServer.jfrogUrl= --namespace insight jfrog/insight

   Alternatively, you can manually create a secret containing the join key and then pass it to the template during install/upgrade. the key must be named join-key.
   

   # Create a secret containing the key: kubectl create secret generic my-secret --from-literal=join-key= # Pass the created secret to helm helm upgrade --install insight --set insight.joinKeySecretName=my-secret --namespace insight jfrog/insight

   In either case, make sure to pass the same join key on all future calls tohelm installandhelm upgrade! This means always passing--set insight.joinKey=. In the second, this means always passing--set missionControl.joinKeySecretName=my-secretand ensuring the contents of the secret remain unchanged.

4. Customize the product configuration(optional)including database, Java Opts, and filestore.
   

   Unlike other installations, Helm Chart configurations are made to thevalues.yamland are then applied to thesystem.yaml.

   Follow these steps to apply the configuration changes.

   1. Make the changes tovalues.yaml.

   2. Run the command.
      

      helm upgrade --installinsight--namespace insight -f values.yaml

   3. Restart Insight to apply the changes.

5. Access Insight from your browser at:http:///ui/and go to theDashboardtab in theApplicationmodule in the UI

6. Check the status of your deployed Helm releases.
   

   helm status insight

Product Configuration

安装和运行前了解后,你米ay set the following configurations.

Artifactory Connection Details

Insight requires a working Artifactory server and a suitable license. The Insight connection to Artifactory requires 2 parameters:

• jfrogUrl——URL的机器JFrog Artifactory is deployed, or the load balancer pointing to it. It is recommended to use DNS names rather than direct IPs. For example:http://jfrog.acme.comorhttp://10.20.30.40:8082
  Set it in theShared Configurationssection of the$JFROG_HOME/insight/etc/system.yamlfile.
• join.key- This is the "secret" key required by Artifactory for registering and authenticating the Insight server.
  You can fetch the ArtifactoryjoinKey(join Key) from the JPD UI in theAdministration module | User Management | Settings | Join Key.
  Set thejoin.keyused by your Artifactory server in theShared Configurationssection of the$JFROG_HOME/insight/etc/system.yamlfile.

Changing PostgreSQL Database Credentials

Insight comes bundled with a PostgreSQL Database out-of-the-box,which comes pre-configured with default credentials.

To change the default credentials:

#Change password for Insight user # Access PostgreSQL as the insight user adding the optional -W flag to invoke the password prompt $ psql -d insight -U insight -W # Securely change the password for user "mission_control". Enter and then retype the password at the prompt. \password insight # Verify the update was successful by logging in with the new credentials $ psql -d insight -U insight -W

Changing Elasticsearch Credentials

Search Guard tool is used to manage authentication. To change password for the default user, Search Guard accepts a hash password to be provided in the configuration.

1. Obtain the username used to access Elasticsearch from$JFROG_HOME/insight/var/etc/system.yaml available at elasticsearch.username

2. Generate the hash password by providing the password(in text format) as input

   $ELASTICSEARCH_HOME/plugins/search-guard-/tools/hash.sh -p 

3. The output from the previous step should be updated in the configurationfor the default user

   Other flavours

   vi ELASTICSEARCH_HOME美元/ plugins / search-guard - <专业_version_number>/sgconfig/sg_internal_users.yml #Scroll in the file to find an entry for the username of the default user #Update the value for "hash" with the hash content obtained from previous step : hash: 

4. Run the command to initialise Search Guard.

Changing Elasticsearch Credentials in Docker-Compose

1. Stop Docker services.

   docker-compose -p insight down

2. Change the password in docker-compose.yaml and system.yaml to the new password.

   In docker-compose.yaml under: - ELASTICSEARCH_PASSWORD= In system.yaml under: shared.elasticsearch.password

3. Move the following file to a backup directory.

   mv /insight/var/data/elasticsearch/sgconfig/sg_internal_users.yml /$HOME/sg_internal_users.yml.backup

4. Restart Docker services.

   docker-compose -p insight up -d

   
   

Add certificates to connect to external Elasticsearch over SSL

To use an external Elasticsearch over an SSL connection, you must copy the certificate files to the trusted folder in the Insight installation ($JFROG_HOME/insight/var/etc/security/keys/trusted) and restart Insight services.

Set your PostgreSQL and Elasticsearch connection details in theShared Configurationssection of the$JFROG_HOME/insight/var/etc/system.yamlfile.

Load a Custom Certificate to Elasticsearch Search Guard

If you prefer to use the custom certificates when Search Guard enabled with tls in Elasticsearch, you can use thesearch-guard-tlstoolto generate Search Guard certificates.

Thetool to generate Search Guard certificates is be available in$JFROG_HOME/app/third-party/elasticsearch/search-guard-tlstool-1.6.tar.gz. For more information about generating certificates, seeSearch Guard TLS Tool.

1. Run the tool to generate the certificates.
   

   tar -xvf $JFROG_HOME/app/third-party/elasticsearch/search-guard-tlstool-1.6.tar.gz cp $JFROG_HOME/app/third-party/elasticsearch/config/tlsconfig.yml $JFROG_HOME/app/third-party/elasticsearch/search-guard-tlstool-1.8/config cd $JFROG_HOME/app/third-party/elasticsearch/search-guard-tlstool-1.8/tools ./sgtlstool.sh -c ../config/tlsconfig.yml -ca -crt # folder named "out" will be created with all the required certificates, cd out

2. Copy the generated certificates [[localhost.key, localhost.pem, root-ca.pem, sgadmin.key, sgadmin.pem]] to the target location based on the installer type.

   Native

   cp localhost.key localhost.pem root-ca.pem sgadmin.key sgadmin.pem /etc/elasticsearch/certs/

   Docker Compose

   cp localhost.key localhost.pem root-ca.pem sgadmin.key sgadmin.pem $JFROG_HOME/insight/var/data/elasticsearch/certs

Configuring a Custom Elasticsearch Role

The Search Guard tool is used to manage authentication. By default, an admin user is required to authenticate Elasticsearch. As an alternative to this, a new user can be configured to authenticate Elasticsearch by assigning a custom role with permissions for the application to work.

1. Add the following snippet to define a new role with custom permissions:
   

   vi ELASTICSEARCH_HOME美元/ plugins / search-guard - <专业_version_number>/sgconfig/sg_roles.yml #Add the following snippet to define a new role with custom permissions : cluster_permissions: - cluster:monitor/health - cluster:monitor/main - cluster:monitor/state - "indices:admin/template/get" - "indices:admin/template/delete" - "indices:admin/template/put" - "indices:admin/aliases" - "indices:admin/create" index_permissions: - index_patterns: - "active_*" allowed_actions: - "indices:monitor/health" - "indices:monitor/stats" - "indices:monitor/settings/get" - "indices:admin/aliases/get" - "indices:admin/get" - "indices:admin/aliases" - "indices:admin/create" - "indices:admin/delete" - "indices:admin/rollover" - SGS_CRUD

   
   

2. Add the following snippet to add a new user:

   vi ELASTICSEARCH_HOME美元/ plugins / search-guard - <专业_version_number>/sgconfig/sg_roles.yml/sg_internal_users.yml # Add the following snippet to add a new user : hash:  backend_roles: - "" //role_name defined in previous step description: ""

   
   

   1. Run the following command to generate a hash password:
      

      $ELASTICSEARCH_HOME/plugins/search-guard-/tools/hash.sh -p 

3. Add the following snippet to map the new username to the role defined in the previous step:
   

   vi ELASTICSEARCH_HOME美元/ plugins / search-guard - <专业_version_number>/sgconfig/sg_roles.yml/sg_roles_mapping.yml # Add the following snippet to map the new username to the role defined in the previous step : users: - ""

4. Initialize Search Guard to upload the above changes made in the configuration.

5. Set the new credentials in$JFROG_HOME/insight/etc/system.yaml文件:

   shared: elasticsearch: username:  password: 

6. Restart Insight services.

Installing PostgreSQL

RPM

1. Install PostgreSQL.
   

   # Run the following commands from the extracted jfrog-xray--rpm directory. # Note : Use postgreSQL rpms with el6 when installing on Centos 6 and RHEL 6 and use postgresql13-13.2-1 packages # Note : Use postgreSQL rpms with el8 when installing on Centos 8 and RHEL 8 mkdir -p /var/opt/postgres/data rpm -ivh --replacepkgs ./third-party/postgresql/libicu-50.2-3.el7.x86_64.rpm (only AWS instance) rpm -ivh --replacepkgs ./third-party/postgresql/postgresql13-libs-13.2-5PGDG.rhel7.x86_64.rpm rpm -ivh --replacepkgs ./third-party/postgresql/postgresql13-13.2-5PGDG.rhel7.x86_64.rpm rpm -ivh --replacepkgs ./third-party/postgresql/postgresql13-server-13.2-5PGDG.rhel7.x86_64.rpm chown -R postgres:postgres /var/opt/postgres export PGDATA="/var/opt/postgres/data" export PGSETUP_INITDB_OPTIONS="-D /var/opt/postgres/data" # For centos 7&8 / rhel 7&8 sed -i "s~^Environment=PGDATA=.*~Environment=PGDATA=/var/opt/postgres/data~" /lib/systemd/system/postgresql-13.service systemctl daemon-reload /usr/pgsql-13/bin/postgresql-13-setup initdb # For centos 6 / rhel 6 sed -i "s~^PGDATA=.*~PGDATA=/var/opt/postgres/data~" /etc/init.d/postgresql-13 service postgresql-13 initdb Replace "ident" and "peer" with "trust" in postgres hba configuration files ie /var/opt/postgres/data/pg_hba.conf

2. Configure PostgreSQL to allow external IP connections.

3. By default PostgreSQL will only allow localhost clients communications. To enable different IPs to communicate with the database you will need toconfigure thepg_hba.conffile.
   

   File location according to installation type

   • Docker-compose:$JFROG_HOME/xray/var/data/postgres/data
   • Native installations:/var/opt/postgres/data

   To grant all IPs access you may add the below, under the IPv4 local connections section.
   

   host all all 0.0.0.0/0 trust

   Add the following line to/var/opt/postgres/data/postgresql.conf.
   

   listen_addresses='*' port=5432

4. Start PostgreSQL.
   

   systemctl start postgresql-13.service or service postgresql-13 start

5. Setup the database anduser.
   

   ## run the script to seed the tables and schemas needed by Xray cp -f ./third-party/postgresql/createPostgresUsers.sh /tmp source /etc/locale.conf cd /tmp && su postgres -c "POSTGRES_PATH=/usr/pgsql-13/bin PGPASSWORD=postgres DB_PASSWORD=password bash /tmp/createPostgresUsers.sh"

Debian

Prerequisites

It is recommended to ensure yourapt-getlibraries are up-to-date, using the following commands.

apt-get update apt-get install -f -y apt-get update

# Create the file repository configuration to pull postgresql dependencies cp -f /etc/apt/sources.list /etc/apt/sources.list.origfile sh -c 'echo "deb http://ftp.de.debian.org/debian/ $(lsb_release -cs) main non-free contrib" >> /etc/apt/sources.list' sh -c 'echo "deb-src http://ftp.de.debian.org/debian/ $(lsb_release -cs) main non-free contrib" >> /etc/apt/sources.list' cp -f /etc/apt/sources.list.d/pgdg.list /etc/apt/sources.list.d/pgdg.list.origfile sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs)-pgdg main" >> /etc/apt/sources.list.d/pgdg.list' sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ precise-pgdg main" >> /etc/apt/sources.list.d/pgdg.list' wget --no-check-certificate --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -

Install Steps

1. Install PostgreSQL.
   Run the following commands from the extracted jfrog-xray--deb directory.

   mkdir -p /var/opt/postgres/data

   Ubuntu 16.04 (xenial)

   dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg16.04+1_amd64.deb

   Ubuntu 18.04 (bionic)

   dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg18.04+1_amd64.deb

   Ubuntu 20.04 (focal)

   dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg20.04+1_amd64.deb

   Debian 8 (jessie)

   ## Before installing Postgres dependencies mv /etc/apt/sources.list.d/backports.list /etc/apt >/dev/null apt-get update dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg80+1_amd64.deb # After installing Postgres dependencies mv /etc/apt/backports.list /etc/apt/sources.list.d/backports.list >/dev/null apt-get update

   Debian 9 (stretch)

   dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg90+1_amd64.deb

   Debian 10 (buster)

   apt update -y apt-get install wget sudo -y apt-get install -y gnupg gnupg1 gnupg2 dpkg -i ./third-party/postgresql/postgresql-13_13.2-1.pgdg100+1_amd64.deb

2. Stop the Xray service.
   

   systemctl stop postgresql.service

3. Change permissions for the postgres folder.

   乔恩- r postgres:职位gres /var/opt/postgres sed -i "s~^data_directory =.*~data_directory = '/var/opt/postgres/data'~" "/etc/postgresql/13/main/postgresql.conf" sed -i "s~^hba_file =.*~hba_file = '/var/opt/postgres/data/pg_hba.conf'~" "/etc/postgresql/13/main/postgresql.conf" sed -i "s~^ident_file =.*~ident_file = '/var/opt/postgres/data/pg_ident.conf'~" "/etc/postgresql/13/main/postgresql.conf" su postgres -c "/usr/lib/postgresql/13/bin/initdb --pgdata=/var/opt/postgres/data"

4. Configure PostgreSQL to allow external IP connections.

5. By default PostgreSQL will only allow localhost clients communications. To enable different IPs to communicate with the database you will need toconfigure thepg_hba.conffile.
   

   File Location According to Installation Type

   • Docker-compose:$JFROG_HOME/xray/var/data/postgres/data
   • Native installations:/var/opt/postgres/data

   To grant all IPs access you may add the below, under the IPv4 local connections section:
   

   host all all 0.0.0.0/0 trust

   Add the following line to /etc/postgresql/13/main/postgresql.conf

   listen_addresses='*'

6. Start PostgreSQL
   

   systemctl start postgresql.service or service postgresql start

7. Set up the database anduser.
   

   ## run the script to seed the tables and schemas needed by Xray cp -f ./third-party/postgresql/createPostgresUsers.sh /tmp source /etc/default/locale cd /tmp && su postgres -c "POSTGRES_PATH=/usr/lib/postgresql/13/bin PGPASSWORD=postgres DB_PASSWORD=password bash /tmp/createPostgresUsers.sh"

8. Put back the original pgdg.list.
   

   mv /etc/apt/sources.list.d/pgdg.list /etc/apt/sources.list.d/pgdg.list.tmp && cp -f /etc/apt/sources.list.d/pgdg.list.origfile /etc/apt/sources.list.d/pgdg.list

9. Remove backup files.

   rm -f /etc/apt/sources.list.d/pgdg.list.tmp rm -f /etc/apt/sources.list.d/pgdg.list.origfile

10. Put back the original sources.list.

    mv /etc/apt/sources.list /etc/apt/sources.list.tmp && cp -f /etc/apt/sources.list.origfile /etc/apt/sources.list

11. Remove the backup files.

    rm -f /etc/apt/sources.list.tmp && rm -f /etc/apt/sources.list.origfile

Linux Archive

# Create the psql database (the script "insight/app/third-party/postgresql/createPostgresUsers.sh" , responsible for seeding Postgres assumes this database exists) /psql template1 : CREATE DATABASE ; : \q ## run the script to seed the tables and schemas needed by Xray POSTGRES_PATH= insight/app/third-party/postgresql/createPostgresUsers.sh

Setting up Your PostgreSQL Databases, Users and Schemas

1. Log in to the PostgreSQL database as an admin and execute the following commands.

   PostgreSQL Database and User Creation

   CREATE DATABASE insight WITH ENCODING='UTF8' TABLESPACE=pg_default; # Exit from current login \q # Login to $DB_NAME database using admin user (by default its postgres) psql -U postgres insight CREATE USER insight WITH PASSWORD 'password'; GRANT ALL ON DATABASE insight TO insight;

2. Configure thesystem.yamlfile with the database configuration details according to the information above. For example.

   shared: database: type: postgresql driver: org.postgresql.Driver url: jdbc:postgresql://localhost:5432/insight username: insight password: password

For Advanced Users

Manual Docker Compose Installation

1. Extract the contents of the compressed archive and go to the extracted folder.

   tar -xvf jfrog-insight--compose.tar.gz

   .env file included within the Docker-Compose archive

   This .env file is used bydocker-composeand is updated during installations and upgrades.

   Notice that some operating systems do not display dot files by default. If you've made any changes to the file, remember to backup before an upgrade.

2. Create the following folder structure under$JFROG_HOME/insight.

   $JFROG_HOME/insight/var $JFROG_HOME/insight/var/data $JFROG_HOME/insight/var/etc $JFROG_HOME/insight/var/data/elasticsearch $JFROG_HOME/insight/var/data/postgres

3. Provide folder permissions to the folders as follows.
   
   

   chown -R 1040:1040 $JFROG_HOME/insight/var chown -R 1040:1040 $JFROG_HOME/insight/var/data chown -R 1040:1040 $JFROG_HOME/insight/var/etc chown -R 1000:1000 $JFROG_HOME/insight/var/data/elasticsearch chown -R 999:999 $JFROG_HOME/insight/var/data/postgres

4. Copy the appropriate docker-compose templates from the templates folder to the extracted folder. Rename it asdocker-compose.yaml.

   NOTE: The commands below assume you are using the template:docker-compose-postgres-es.yaml


   Requirement	Template
   Insight with externalised databases	docker-compose.yaml
   Insight with Elasticsearch and PostgreSQL	docker-compose-postgres-es.yaml

   Docker for Mac

   When you use Docker Compose in Mac,/etc/localtimemight not work as expected since it might not be a shared location in the docker-for-mac settings.

   You can remove the following line from the selecteddocker-compose.yamlfile to avoid installation issues.
   

   - /etc/localtime:/etc/localtime:ro

   
   

   
   

5. Update the.envfile

   ## The Installation directory for Insight. IF not entered, the script will prompt you for this input. Default [$HOME/.jfrog/insight] ROOT_DATA_DIR= ## Public IP of this machine HOST_IP=

6. Customize the product configuration.
   1. Set the Artifactory connection details.
      
   2. Customize the PostgreSQL Database connection details. (optional)

   3. Set any additional configurations (for example: ports, node id) using theInsightsystem.yamlconfiguration file.
      

      Verify that the host's ID and IP are added to thesystem.yaml. This is important to ensure that other products and Platform Deployments can reach this instance.

7. For Elasticsearch to work correctly, increase the map count. For additional information, seeElasticsearch documentation.

8. Create the necessary tables and users using the script: "createPostgresUsers.sh".

   • Start the PostgreSQL container.

     docker-compose -p insight up -d postgres

9. Start Insight using docker-compose commands.
   

   docker-compose -p insight logs docker-compose -p insight ps docker-compose -p insight up -d docker-compose -p insight down

10. Access Insight from your browser at:http://SERVER_HOSTNAME/ui/. For example, on your local machine:http://localhost/ui/.
    

11. Check the Insight log.

    docker-compose -p insight logs

    Configuring the Log Rotation of the Console Log

    Theconsole.logfile can grow quickly since all services write to it. The installation scripts add a cron job to log rotate theconsole.logfile every hour.

    This isnotdone for manual Docker Compose installations. Learn more on how toconfigure the log rotation.