The steps for Kron PAM Server (within the Secure Zone) and Kron PAM Mobile App Server (on the DMZ)
1) ((PAM)) All required PAM services (including pam-commons) should be started on 10.10.0.1 (PAM server).
The following command restarts all the services; this step might be skipped!!!
sudo -u pamuser bash -c 'export PATH=/home/pamuser/.local/bin:/usr/local/bin:$PATH; if podman compose version > /dev/null 2>&1; then PC="podman compose"; elif /usr/bin/python3.14 -m podman_compose version > /dev/null 2>&1; then PC="/usr/bin/python3.14 -m podman_compose"; else echo "calisan podman-compose bulunamadi, islem yapilmadi"; exit 1; fi; echo "compose: $PC"; C=/pam/docker-mgmt/docker-compose.yml; P="--profile kron-commons --profile kron-redis --profile pam-commons --profile pam-addons --profile pam-mcp-bridge --profile pam-superset"; DBP=$(grep -E "^PAM_DB_PORT=" /pam/docker-mgmt/.env 2>/dev/null | cut -d= -f2); DBP=${DBP:-5444}; timeout 3 bash -c "</dev/tcp/127.0.0.1/$DBP" 2>/dev/null && echo "DB ($DBP) erisilebilir" || { echo "DB ($DBP) kapali! Once postgresql-15 servisini baslat, islem yapilmadi"; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); for name in $(podman ps -a --format "{{.Names}}" | grep -vxF "${KC:-__none__}") $KC; do podman stop $name > /dev/null 2>&1; podman rm -f $name > /dev/null 2>&1 && echo "$name stopped" || echo "$name stop failed"; done; echo "ALL SERVICES STOPPED"; $PC -f $C $P up -d kron-commons > /tmp/pam_restart.log 2>&1 && echo "kron-commons started" || { echo "kron-commons failed"; tail -30 /tmp/pam_restart.log; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); [ -z "$KC" ] && { echo "kron-commons container not found"; exit 1; }; SECONDS=0; until podman healthcheck run $KC > /dev/null 2>&1; do [ $SECONDS -ge 600 ] && { echo "kron-commons 600s icinde healthy olmadi"; podman logs --tail 50 $KC; exit 1; }; sleep 5; echo "kron-commons healthy waiting... (${SECONDS}s, $(podman inspect $KC --format "state={{.State.Status}} restarts={{.RestartCount}}"))"; done; echo "kron-commons healthy"; $PC -f $C $P up -d > /tmp/pam_restart.log 2>&1 && echo "ALL SERVICES STARTED" || { echo "ALL SERVICES FAILED"; tail -30 /tmp/pam_restart.log; }'
2) ((DMZ)) All required PAM services should be stopped and the pam-commons service should be started on 10.10.0.2 (mobile app server).
The following command stops all the services; but starts pam-commons service!!!
sudo -u pamuser bash -c 'SERVICE="pam-commons"; export PATH=/home/pamuser/.local/bin:/usr/local/bin:$PATH; if podman compose version > /dev/null 2>&1; then PC="podman compose"; elif /usr/bin/python3.14 -m podman_compose version > /dev/null 2>&1; then PC="/usr/bin/python3.14 -m podman_compose"; else echo "calisan podman-compose bulunamadi, islem yapilmadi"; exit 1; fi; echo "compose: $PC"; C=/pam/docker-mgmt/docker-compose.yml; P="--profile kron-commons --profile kron-redis --profile pam-commons --profile pam-addons --profile pam-mcp-bridge --profile pam-superset"; DBP=$(grep -E "^PAM_DB_PORT=" /pam/docker-mgmt/.env 2>/dev/null | cut -d= -f2); DBP=${DBP:-5444}; timeout 3 bash -c "</dev/tcp/127.0.0.1/$DBP" 2>/dev/null && echo "DB ($DBP) erisilebilir" || { echo "DB ($DBP) kapali! Once postgresql-15 servisini baslat, islem yapilmadi"; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); for name in $(podman ps -a --format "{{.Names}}" | grep -vxF "${KC:-__none__}") $KC; do podman stop $name > /dev/null 2>&1; podman rm -f $name > /dev/null 2>&1 && echo "$name stopped" || echo "$name stop failed"; done; echo "ALL SERVICES STOPPED"; $PC -f $C $P up -d kron-commons > /tmp/pam_restart.log 2>&1 && echo "kron-commons started" || { echo "kron-commons failed"; tail -30 /tmp/pam_restart.log; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); [ -z "$KC" ] && { echo "kron-commons container not found"; exit 1; }; SECONDS=0; until podman healthcheck run $KC > /dev/null 2>&1; do [ $SECONDS -ge 600 ] && { echo "kron-commons 600s icinde healthy olmadi"; podman logs --tail 50 $KC; exit 1; }; sleep 5; echo "kron-commons healthy waiting... (${SECONDS}s, $(podman inspect $KC --format "state={{.State.Status}} restarts={{.RestartCount}}"))"; done; echo "kron-commons healthy"; $PC -f $C $P up -d $SERVICE > /tmp/pam_restart.log 2>&1 && echo "$SERVICE STARTED" || { echo "$SERVICE FAILED"; tail -30 /tmp/pam_restart.log; }'
3) ((PAM)) On the System Configuration Man. page of the Kron PAM Web GUI (10.10.0.1), mobile.tomcat.url should be set with Kron PAM Mobile App Server’s info. (E.g., https://10.10.0.2:9443/mobile-api/rest OR https://mobile129.kron.com.tr:9443/mobile-api/rest)
4) ((PAM)) The following jobs related to push notification system should be defined on the Kron PAM Web GUI (10.10.0.1): SCPolicyNotifierJob, SendPushMessageJob.
5) ((DMZ)) The following lines should be changed on .env file on 10.10.0.2.
vi /pam/docker-mgmt/.env
· COMPOSE_PROFILES=kron-commons,kron-redis,pam-commons,pam-addons,pam-nginx,pam-superset,pam-mcp-bridge ===> COMPOSE_PROFILES=kron-commons,pam-commons
· HOST_GATEWAY=10.10.0.2 ====> HOST_GATEWAY=10.10.0.1
· APP_INT_SPRING_BOOT_ADMIN_URL=https://kron-commons-aggregator:8443 ====> APP_INT_SPRING_BOOT_ADMIN_URL=""
· PAM_DB_PASSWORD='{cipher}10.10.0.2’s DB PASSWORD as ciphertext' ====> PAM_DB_PASSWORD='{cipher}10.10.0.1’s DB PASSWORD as ciphertext’
· PAM_COMMONS_AUTH_ENABLED=true ====> PAM_COMMONS_AUTH_ENABLED=false
· APP_INT_PAM_APPLICATION_URL=https://host.docker.internal ===> APP_INT_PAM_APPLICATION_URL=https://10.10.0.1
6) ((DMZ))---optional for certificate--- If the customer has their own valid certificate for mobile service:
If the customer uses its own certificate for accessing mobile URL, the certificate should be uploaded to /pam/gui/conf/cert (e.g., kron.com.tr.jks). Note that, the purpose of using this certificate is different from the self signed certificate to access a specific docker service on the Kron PAM Server.
· Put the jks (e.g. kron.com.tr.jks) file to /pam/gui/conf/cert on 10.10.0.2.
· Edit the following lines of vi /pam/docker-mgmt/.env located under /pam/docker-mgmt/on 10.10.0.2:
PAM_CERT_FILE={CUSTOMER’s JKS FILE NAME}
PAM_CERT_FILE_ALIAS={CUSTOMER’s ALIAS-NAME}
PAM_CERT_FILE_STORE_PASSWORD={CUSTOMER’s STORE PASSWORD}
PAM_CERT_FILE_PASSWORD={CUSTOMER’s SSL PASSWORD}
PAM_CERT_FILE_STORE_TYPE=jks
MOBILE_API_CERT={CUSTOMER’s JKS FILE NAME}
E.g.:
PAM_CERT_FILE=kron.com.tr.jks
PAM_CERT_FILE_ALIAS=kron
PAM_CERT_FILE_STORE_PASSWORD=kr10ipsla
PAM_CERT_FILE_PASSWORD=kr10ipsla
PAM_CERT_FILE_STORE_TYPE=jks
*LISTING the certificates’ configurations: on 10.10.0.2
sudo keytool -list -v -keystore /pam/gui/conf/cert/kron.com.tr.jks -storepass kr10ipsla
7) ((PAM)) The following line should be changed on .env file on 10.10.0.1.
vi /pam/docker-mgmt/.env
· KRON_COMMONS_CONFIG_PORT="127.0.0.1:8001" ===> KRON_COMMONS_CONFIG_PORT="0.0.0.0:8001"
8) ((DMZ)) The following docker-compose.yml file should be used on 10.10.0.2 under /pam/docker-mgmt/.
------------------------------------------------------------------------------------------
x-int-paths:
log: &p-log /app/logs
cold-log: &p-cold-log /app/cold-logs
log-config: &p-log-config /app/config-repo/log4j2.xml
security-config: &p-security-config /app/security/security.properties
license: &p-license /app/license
license-path: &p-license-path /app/license/licence.properties
tools: &p-tools /app/tools
reports: &p-reports /app/reports
uploads: &p-uploads /app/uploads
templates: &p-templates /app/templates
config-repo: &p-config-repo /app/config-repo
db-certs: &p-db-certs /app/db-certs
certs: &p-certs /app/certs
metadata: &p-metadata /app/metadata
pam-certs: &p-pam-certs /app/pam-certs
pam-commons-cert-path: &p-pam-commons-cert-path /app/pam-certs/${PAM_COMMONS_CERT}
pam-commons-key-store: &p-pam-commons-key-store file:/app/pam-certs/${PAM_COMMONS_CERT}
key-store: &p-key-store file:/app/certs/aioc.jks
trust-store: &p-trust-store file:/app/certs/aioc.p12
trust-store-path: &p-trust-store-path /app/certs/aioc.p12
x-volumes:
config-repo: &vol-config-repo
type: bind
source: ${CONFIG_REPO_DIRECTORY}
target: *p-config-repo
certs: &vol-certs
type: bind
source: ${APPLICATION_CERTS_DIRECTORY}
target: *p-certs
db-certs: &vol-db-certs
type: bind
source: ${DATABASE_CERTS_DIRECTORY}
target: *p-db-certs
security-config: &vol-security-config
type: bind
source: ${SECURITY_FILES_DIRECTORY}
target: *p-security-config
log4j2: &vol-log4j2
type: bind
source: ${LOG4J2_PATH}
target: *p-log-config
logs: &vol-logs
type: bind
source: ${LOG_DIRECTORY_PATH}
target: *p-log
cold-logs: &vol-cold-logs
type: bind
source: ${COLD_LOG_DIRECTORY_PATH}
target: *p-cold-log
license: &vol-license
type: bind
source: ${LICENSE_FILE_DIRECTORY}${LICENSE_FILE_NAME}
target: *p-license-path
templates: &vol-templates
type: bind
source: ${MAIL_TEMPLATES_DIRECTORY}
target: *p-templates
pam-certs: &vol-pam-certs
type: bind
source: ${PAM_CERTS_DIRECTORY}
target: *p-pam-certs
pam-commons-cert: &vol-pam-commons-cert
type: bind
source: ${PAM_COMMONS_SSL_KEY_STORE_PATH}
target: *p-pam-commons-cert-path
x-container-local-directories: &container-local-directories
APP_INT_LOG_DIRECTORY_PATH: *p-log
APP_INT_COLD_LOG_DIRECTORY_PATH: *p-cold-log
APP_INT_LOG_CONFIG_FILE_PATH: *p-log-config
APP_INT_SECURITY_CONFIG_PATH: *p-security-config
APP_INT_LICENSE_PATH: *p-license
APP_INT_TOOL_PATH: *p-tools
APP_INT_REPORTS_PATH: *p-reports
APP_INT_UPLOAD_DIRECTORY_PATH: *p-uploads
APP_INT_TEMPLATE_FOLDER: *p-templates
APP_INT_CONFIG_REPO_DIR: *p-config-repo
APP_INT_DB_CERTS_PATH: *p-db-certs
APP_INT_CERTS_PATH: *p-certs
APP_INT_METADATA_DB_DIRECTORY: *p-metadata
APP_INT_PAM_CERTS_PATH: *p-pam-certs
x-pam-common-directories: &pam-common-directories
<<: *container-local-directories
LOG_DIRECTORY_PATH: *p-log
COLD_LOG_DIRECTORY_PATH: *p-cold-log
LOG_CONFIG_FILE_PATH: *p-log-config
SECURITY_CONFIG_PATH: *p-security-config
TOOL_PATH: *p-tools
REPORTS_PATH: *p-reports
UPLOAD_DIRECTORY_PATH: *p-uploads
TEMPLATE_FOLDER: *p-templates
CONFIG_REPO_DIR: *p-config-repo
LICENSE_PATH: *p-license-path
PAM_COMMONS_SSL_KEY_STORE: *p-pam-commons-key-store
x-pam-common-variables: &pam-common-variables
<<: *pam-common-directories
INSTANCE_NAME: ${INSTANCE_NAME}
TZ: ${TIME_ZONE}
SPRING_PROFILES_ACTIVE: ${ACTIVE_SPRING_PROFILES}
LIQUIBASE_ENABLED: ${LIQUIBASE_ENABLED:-false}
APPLICATION_PORT: 8443
MANAGEMENT_PORT: 8091
###-------------------------------
###CHANGE THIS: CONFIG_SERVER_URI
###-------------------------------
# Config Server Environment Values
CONFIG_SERVER_URI: https://10.10.0.1:8001
CONFIG_USER: aioc
CONFIG_PASSWORD: aioc
# SSL Environment Values
SSL_ENABLE: true
SSL_KEY_STORE_TYPE: PKCS12
KEY_ALIAS: aioc
KEY_STORE: *p-key-store
TRUST_STORE: *p-trust-store
TRUSTSTORE_RESOURCE_FILE: *p-trust-store-path
KEYSTORE_RESOURCE_FILE: *p-trust-store-path
#KRON_COMMON_SERVICE_URLs
REDIS_HOST: ${APP_INT_REDIS_HOST}
REDIS_PORT: ${APP_INT_REDIS_PORT}
SPRING_BOOT_ADMIN_URL: ${APP_INT_SPRING_BOOT_ADMIN_URL}
KRON_COMMONS_URL: ${APP_INT_KRON_COMMONS_URL}
NETWORK_SERVICE_SOCKET_URL: ${APP_INT_NETWORK_SERVICE_SOCKET_URL}
AUTH_SERVICE_URL: ${APP_INT_AUTH_SERVICE_URL}
LICENSE_SERVICE_URL: ${APP_INT_LICENSE_SERVICE_URL}
NETWORK_SERVICE_URL: ${APP_INT_NETWORK_SERVICE_URL}
NOTIFICATION_SERVICE_URL: ${APP_INT_NOTIFICATION_SERVICE_URL}
ALFRED_SERVICE_URL: ${APP_INT_ALFRED_SERVICE_URL}
PAM_AUTH_SERVICE_URL: ${APP_INT_PAM_AUTH_SERVICE_URL}
# KRON COMMONS
ALFRED_ENABLED: ${KRON_COMMONS_ALFRED_ENABLED}
LICENSE_ENABLED: ${KRON_COMMONS_LICENSE_ENABLED}
NETWORK_ENABLED: ${KRON_COMMONS_NETWORK_ENABLED}
# PAM COMMONS
PAM_COMMONS_AUTH_ENABLED: ${PAM_COMMONS_AUTH_ENABLED}
PAM_COMMONS_MOBILE_API_ENABLED: ${PAM_COMMONS_MOBILE_API_ENABLED}
# MOBILE APP
PAM_COMMONS_SSL_ENABLE: ${PAM_COMMONS_SSL_ENABLE}
PAM_COMMONS_SSL_ALIAS: ${PAM_COMMONS_CERT_FILE_ALIAS}
PAM_COMMONS_SSL_STORE_TYPE: ${PAM_COMMONS_CERT_FILE_STORE_TYPE}
PAM_COMMONS_SSL_STORE_PASSWORD: ${PAM_COMMONS_CERT_FILE_STORE_PASSWORD}
PAM_COMMONS_SSL_PASSWORD: ${PAM_COMMONS_CERT_FILE_PASSWORD}
# ===> REDIS CONFIGURATION
REDIS_USERNAME: pam-redis
REDIS_PASSWORD: '{cipher}537c807d7d7ea0516a368439579dcbfd9f9487e5cc39facf32e132ebce20add40c248bb0c36d659044cc34ade1394eeb'
# PAM
PAM_URL: ${APP_INT_PAM_APPLICATION_URL}
x-pam-db-variables: &pam-common-db-variables
<<: *pam-common-variables
DB_URL: ${PAM_DB_URL}
DB_USERNAME: ${PAM_DB_USERNAME}
DB_PASSWORD: ${PAM_DB_PASSWORD}
DB_SCHEMA: ${PAM_DB_SCHEMA}
DB_DRIVER: org.postgresql.Driver
BASE_URL: ${APP_INT_PAM_APPLICATION_URL}
PAM_BASE_LOGIN_URL: ${PAM_BASE_LOGIN_URL}
x-healthcheck-java: &healthcheck-java
test: curl -fsS -m 2 http://localhost:$$MANAGEMENT_PORT/actuator/health | grep -q '"status":"UP"' || exit 1
interval: 6s
retries: 20
start_period: 8s
timeout: 5s
x-no-new-privs: &no-new-privs "no-new-privileges:true"
services:
kron-commons:
image: dockerhub.kron.com.tr/kron-commons/kron-commons:26.12.4${OS_IMAGE_POSTFIX:-}
user: "0:65534"
security_opt:
- *no-new-privs
ports:
- "${KRON_COMMONS_CONFIG_PORT}:8001"
- "${KRON_COMMONS_PORT}:8443"
profiles:
- kron-commons
environment:
<<: *pam-common-db-variables
SPRING_APPLICATION_JSON: '{"spring.jpa.properties.hibernate.hbm2ddl.auto":"none","spring.boot.admin.client.enabled":false}'
AGGREGATOR_CONFIG_SERVER_ENABLED: true
volumes:
- *vol-config-repo
- *vol-certs
- *vol-db-certs
- *vol-security-config
- *vol-log4j2
- *vol-logs
- *vol-cold-logs
- *vol-license
- *vol-templates
- type: bind
source: ${DMI_DIRECTORY}
target: /etc/dmi
healthcheck: *healthcheck-java
restart: on-failure:10
networks:
- kron-network
extra_hosts:
- "host.docker.internal:${HOST_GATEWAY}"
- ""{PAM-INSTANCE NAME of 10.10.0.1}:10.10.0.1"
###-------------------------------
###CHANGE THIS: extra_hosts: e.g., - “pam-01:10.10.0.1”
###-------------------------------
pam-commons:
image: dockerhub.kron.com.tr/pam/pam-commons:3.9.0${OS_IMAGE_POSTFIX:-}
user: "0:65534"
security_opt:
- *no-new-privs
container_name: pam-commons
environment:
<<: *pam-common-db-variables
JAVA_TOOL_OPTIONS: "-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true"
ports:
- "${PAM_COMMONS_PORT}:8443"
profiles:
- pam-commons
volumes:
- *vol-config-repo
- *vol-log4j2
- *vol-certs
- *vol-db-certs
- *vol-security-config
- *vol-logs
- *vol-cold-logs
- *vol-license
- *vol-pam-commons-cert
healthcheck: *healthcheck-java
restart: on-failure:10
depends_on:
kron-commons:
condition: service_healthy
extra_hosts:
- "host.docker.internal:${HOST_GATEWAY}"
- ""{PAM-INSTANCE NAME of 10.10.0.1}:10.10.0.1"
networks:
- kron-network
###-------------------------------
###CHANGE THIS: extra_hosts: e.g., - “pam-01:10.10.0.1”
###-------------------------------
networks:
kron-network:
name: kron-network # creates this named network if it doesn't already exist
driver: bridge
------------------------------------------------------------------------------------------
9) ((PAM)) Using the RSA key pair created with the aioc alias, the environment configurations (kron-commons-config) in the Docker container on the Kron PAM server can be accessed by the Kron PAM Mobile App Server. For this, instead of using the customer's existing key pair, a self-signed certificate is used. This RSA key pair is stored in different formats and keystore files (PKCS#12 and JKS) but with the same alias (aioc). The jks and p12 files located at /pam/docker-mgmt/cert should be recreated with keytool commands, in this scenario. (If the Kron PAM server and Kron PAM Mobile App Server are installed on the same server, these files should stand as is).
*LISTING the certificates’ configurations: on 10.10.0.1
-JKS:
sudo keytool -list -v -keystore /pam/docker-mgmt/cert/aioc.jks -storepass krondev10
-P12:
sudo keytool -list -v -keystore /pam/docker-mgmt/cert/aioc.p12 -storepass krondev10 -storetype PKCS12
*DELETING the certificates’ configurations: on 10.10.0.1
-JKS:
sudo keytool -delete -alias aioc -keystore /pam/docker-mgmt/cert/aioc.jks -storepass krondev10
-P12:
sudo keytool -delete -alias aioc -keystore /pam/docker-mgmt/cert/aioc.p12 -storepass krondev10
*DELETING the certificate files: (Take the backup for these files) on 10.10.0.1
-JKS:
rm -rf /pam/docker-mgmt/cert/aioc.jks
-P12:
rm -rf /pam/docker-mgmt/cert/aioc.p12
*CREATING the certificate files and configurations: on 10.10.0.1
-JKS: (if the DMZ server’s domain name is used (mobile129.kron.com.tr), add it here as DNS: mobile129.kron.com.tr too)
sudo keytool -genkeypair -alias aioc -keyalg RSA -keysize 2048 -dname "CN=localhost,OU=Kron,O=Kron,C=TR" -ext "SAN:c=DNS:localhost,DNS:host.docker.internal,DNS:kron-commons,DNS:pam-commons,DNS:pam-addons,DNS:kai-mcp-bridge,DNS:mcp-bridge,DNS:redis,DNS:superset,DNS:nginx,DNS:kron-commons-aggregator,DNS:kron-commons-config,DNS:kron-commons-alfred,DNS:kron-commons-auth,DNS:kron-commons-license,DNS:kron-commons-network,DNS:kron-commons-notification,DNS:pta,DNS:auth,DNS:uba,DNS:mobile-api,DNS:tcp-proxy,DNS:kron-dam-metadata,DNS:kron-dam-portal,IP:127.0.0.1,IP:10.10.0.1,IP:10.10.0.2" -storepass krondev10 -keypass krondev10 -keystore /pam/docker-mgmt/cert/aioc.jks -validity 3650
-P12: (if the DMZ server’s domain name is used (mobile129.kron.com.tr), add it here as DNS: mobile129.kron.com.tr too)
sudo keytool -genkeypair -alias aioc -keyalg RSA -keysize 2048 -storetype PKCS12 -dname "CN=localhost,OU=Kron,O=Kron,C=TR" -ext "SAN:c=DNS:localhost,DNS:host.docker.internal,DNS:kron-commons,DNS:pam-commons,DNS:pam-addons,DNS:kai-mcp-bridge,DNS:mcp-bridge,DNS:redis,DNS:superset,DNS:nginx,DNS:kron-commons-aggregator,DNS:kron-commons-config,DNS:kron-commons-alfred,DNS:kron-commons-auth,DNS:kron-commons-license,DNS:kron-commons-network,DNS:kron-commons-notification,DNS:pta,DNS:auth,DNS:uba,DNS:mobile-api,DNS:tcp-proxy,DNS:kron-dam-metadata,DNS:kron-dam-portal,IP:127.0.0.1,IP:10.10.0.1,IP:10.10.0.2" -storepass krondev10 -keypass krondev10 -keystore /pam/docker-mgmt/cert/aioc.p12 -validity 3650
10) ((PAM)) The following keytool commands should be executed to import certificate on 10.10.0.1:
yes | sudo keytool -importkeystore -srckeystore /pam/docker-mgmt/cert/aioc.jks -srcstorepass krondev10 -destkeystore /pam/docker-mgmt/cert/aioc.p12 -deststoretype pkcs12 -storepass krondev10
yes | sudo keytool -importkeystore -noprompt \
-srckeystore /pam/docker-mgmt/cert/aioc.p12 -srcstoretype PKCS12 -srcstorepass krondev10 -srcalias aioc \
-destkeystore /pam/docker-mgmt/cert/aioc.jks -deststoretype JKS -deststorepass krondev10 -destkeypass krondev10 -destalias kron-commons
11) ((PAM)) The ownership and mode configurations should be changed for these files on 10.10.0.1:
sudo chown pamuser:pam-group /pam/docker-mgmt/cert/aioc.jks /pam/docker-mgmt/cert/aioc.p12 && sudo chmod 750 /pam/docker-mgmt/cert/aioc.jks /pam/docker-mgmt/cert/aioc.p12
12) ((PAM)) All of the docker services on the Kron PAM server should be restarted on 10.10.0.1:
sudo -u pamuser bash -c 'export PATH=/home/pamuser/.local/bin:/usr/local/bin:$PATH; if podman compose version > /dev/null 2>&1; then PC="podman compose"; elif /usr/bin/python3.14 -m podman_compose version > /dev/null 2>&1; then PC="/usr/bin/python3.14 -m podman_compose"; else echo "calisan podman-compose bulunamadi, islem yapilmadi"; exit 1; fi; echo "compose: $PC"; C=/pam/docker-mgmt/docker-compose.yml; P="--profile kron-commons --profile kron-redis --profile pam-commons --profile pam-addons --profile pam-mcp-bridge --profile pam-superset"; DBP=$(grep -E "^PAM_DB_PORT=" /pam/docker-mgmt/.env 2>/dev/null | cut -d= -f2); DBP=${DBP:-5444}; timeout 3 bash -c "</dev/tcp/127.0.0.1/$DBP" 2>/dev/null && echo "DB ($DBP) erisilebilir" || { echo "DB ($DBP) kapali! Once postgresql-15 servisini baslat, islem yapilmadi"; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); for name in $(podman ps -a --format "{{.Names}}" | grep -vxF "${KC:-__none__}") $KC; do podman stop $name > /dev/null 2>&1; podman rm -f $name > /dev/null 2>&1 && echo "$name stopped" || echo "$name stop failed"; done; echo "ALL SERVICES STOPPED"; $PC -f $C $P up -d kron-commons > /tmp/pam_restart.log 2>&1 && echo "kron-commons started" || { echo "kron-commons failed"; tail -30 /tmp/pam_restart.log; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); [ -z "$KC" ] && { echo "kron-commons container not found"; exit 1; }; SECONDS=0; until podman healthcheck run $KC > /dev/null 2>&1; do [ $SECONDS -ge 600 ] && { echo "kron-commons 600s icinde healthy olmadi"; podman logs --tail 50 $KC; exit 1; }; sleep 5; echo "kron-commons healthy waiting... (${SECONDS}s, $(podman inspect $KC --format "state={{.State.Status}} restarts={{.RestartCount}}"))"; done; echo "kron-commons healthy"; $PC -f $C $P up -d > /tmp/pam_restart.log 2>&1 && echo "ALL SERVICES STARTED" || { echo "ALL SERVICES FAILED"; tail -30 /tmp/pam_restart.log; }'
13) ((DMZ)) All of the pam-related services on the Kron PAM Mobile App Server should be stopped on 10.10.0.2:
ks
stop all services
14) ((PAM)) The certificate files (jks and p12) created in the 9th step (10.10.0.1) should be transferred to Kron PAM Mobile App Server (10.10.0.2).
Note that, jks and p12 files should be identical on both environments. To check this, the following commands should be run on both environments:
sha256sum /pam/docker-mgmt/cert/aioc.p12
sha256sum /pam/docker-mgmt/cert/aioc.jks
! If the files are not identical due to the 3rd party SSH/SFTP tool (e.g. MobaXterm) usage, sshpass command can be used for file transfer:
sshpass -p ‘your-password’ rsync -avz /pam/docker-mgmt/cert/aioc.p12 pamuser@10.10.0.2:/pam/docker-mgmt/cert
sshpass -p ‘your-password’ rsync -avz /pam/docker-mgmt/cert/aioc.jks pamuser@10.10.0.2:/pam/docker-mgmt/cert
15) ((DMZ)) After the file transfer from Kron PAM server to Kron PAM Mobile App Server, ownership and mode configurations should be changed for these files on 10.10.0.2:
sudo chown pamuser:pam-group /pam/docker-mgmt/cert/aioc.jks /pam/docker-mgmt/cert/aioc.p12 && sudo chmod 755 /pam/docker-mgmt/cert/aioc.jks /pam/docker-mgmt/cert/aioc.p12
16) ((DMZ)) All of the docker services on the Kron PAM Mobile App Server should be stopped and the mobile-api service should be started on 10.10.0.2:
sudo -u pamuser bash -c 'SERVICE="pam-commons"; export PATH=/home/pamuser/.local/bin:/usr/local/bin:$PATH; if podman compose version > /dev/null 2>&1; then PC="podman compose"; elif /usr/bin/python3.14 -m podman_compose version > /dev/null 2>&1; then PC="/usr/bin/python3.14 -m podman_compose"; else echo "calisan podman-compose bulunamadi, islem yapilmadi"; exit 1; fi; echo "compose: $PC"; C=/pam/docker-mgmt/docker-compose.yml; P="--profile kron-commons --profile kron-redis --profile pam-commons --profile pam-addons --profile pam-mcp-bridge --profile pam-superset"; DBP=$(grep -E "^PAM_DB_PORT=" /pam/docker-mgmt/.env 2>/dev/null | cut -d= -f2); DBP=${DBP:-5444}; timeout 3 bash -c "</dev/tcp/127.0.0.1/$DBP" 2>/dev/null && echo "DB ($DBP) erisilebilir" || { echo "DB ($DBP) kapali! Once postgresql-15 servisini baslat, islem yapilmadi"; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); for name in $(podman ps -a --format "{{.Names}}" | grep -vxF "${KC:-__none__}") $KC; do podman stop $name > /dev/null 2>&1; podman rm -f $name > /dev/null 2>&1 && echo "$name stopped" || echo "$name stop failed"; done; echo "ALL SERVICES STOPPED"; $PC -f $C $P up -d kron-commons > /tmp/pam_restart.log 2>&1 && echo "kron-commons started" || { echo "kron-commons failed"; tail -30 /tmp/pam_restart.log; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); [ -z "$KC" ] && { echo "kron-commons container not found"; exit 1; }; SECONDS=0; until podman healthcheck run $KC > /dev/null 2>&1; do [ $SECONDS -ge 600 ] && { echo "kron-commons 600s icinde healthy olmadi"; podman logs --tail 50 $KC; exit 1; }; sleep 5; echo "kron-commons healthy waiting... (${SECONDS}s, $(podman inspect $KC --format "state={{.State.Status}} restarts={{.RestartCount}}"))"; done; echo "kron-commons healthy"; $PC -f $C $P up -d $SERVICE > /tmp/pam_restart.log 2>&1 && echo "$SERVICE STARTED" || { echo "$SERVICE FAILED"; tail -30 /tmp/pam_restart.log; }'
17) ((DMZ)) Lastly, check pam-commons service on the Kron PAM Mobile App Server (10.10.0.2):
sudo -u pamuser bash -c 'podman logs -f --tail 1000 pam-commons'
18) ((PAM)) Last trick: Increase the log level on the pam-commons-default.yaml file under /pam/docker-mgmt/config-repo:
logging:
level:
com.kron.pam: ERROR
===>
logging:
level:
com.kron.pam: INFO