---
title: The steps for Kron PAM Server (within the Secure Zone) and Kron PAM Mobile App Server (on the DMZ)
slug: kron-pam-installation-guides-v3/the-steps-for-kron-pam-server-within-the-secure-zone-and-kron-pam-mobile-app-server-on-the-dmz
docTags:
createdAt: 2025-11-05T09:47:06.430Z
---
1\) **((PAM))** All required PAM services (including **pam-commons**) should be started **on 10.10.0.1 (PAM server)****.**
**The following command restarts all the services; this step might be skipped!!!**
sudo -u pamuser bash -c 'export PATH=/home/pamuser/.local/bin:/usr/local/bin:$PATH; if podman compose version > /dev/null 2>&1; then PC="podman compose"; elif /usr/bin/python3.14 -m podman\_compose version > /dev/null 2>&1; then PC="/usr/bin/python3.14 -m podman\_compose"; else echo "calisan podman-compose bulunamadi, islem yapilmadi"; exit 1; fi; echo "compose: $PC"; C=/pam/docker-mgmt/docker-compose.yml; P="--profile kron-commons --profile kron-redis --profile **pam-commons **--profile pam-addons --profile pam-mcp-bridge --profile pam-superset"; DBP=$(grep -E "^PAM\_DB\_PORT=" /pam/docker-mgmt/.env 2>/dev/null | cut -d= -f2); DBP=$\{DBP:-5444}; timeout 3 bash -c "\/dev/null && echo "DB ($DBP) erisilebilir" || \{ echo "DB ($DBP) kapali! Once postgresql-15 servisini baslat, islem yapilmadi"; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); for name in $(podman ps -a --format "{{.Names}}" | grep -vxF "$\{KC:-\_\_none\_\_}") $KC; do podman stop $name > /dev/null 2>&1; podman rm -f $name > /dev/null 2>&1 && echo "$name stopped" || echo "$name stop failed"; done; echo "ALL SERVICES STOPPED"; $PC -f $C $P up -d kron-commons > /tmp/pam\_restart.log 2>&1 && echo "kron-commons started" || \{ echo "kron-commons failed"; tail -30 /tmp/pam\_restart.log; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); \[ -z "$KC" ] && \{ echo "kron-commons container not found"; exit 1; }; SECONDS=0; until podman healthcheck run $KC > /dev/null 2>&1; do \[ $SECONDS -ge 600 ] && \{ echo "kron-commons 600s icinde healthy olmadi"; podman logs --tail 50 $KC; exit 1; }; sleep 5; echo "kron-commons healthy waiting... (${SECONDS}s, $(podman inspect $KC --format "state={{.State.Status}} restarts={{.RestartCount}}"))"; done; echo "kron-commons healthy"; $PC -f $C $P up -d > /tmp/pam\_restart.log 2>&1 && echo "ALL SERVICES STARTED" || \{ echo "ALL SERVICES FAILED"; tail -30 /tmp/pam\_restart.log; }'
2\) **((DMZ))** All required PAM services should be stopped and the **pam-commons** service should be started **on 10.10.0.2 (mobile app server)****.**
**The following command stops all the services; but starts pam-commons service!!!**
sudo -u pamuser bash -c 'SERVICE="**pam-commons**"; export PATH=/home/pamuser/.local/bin:/usr/local/bin:$PATH; if podman compose version > /dev/null 2>&1; then PC="podman compose"; elif /usr/bin/python3.14 -m podman\_compose version > /dev/null 2>&1; then PC="/usr/bin/python3.14 -m podman\_compose"; else echo "calisan podman-compose bulunamadi, islem yapilmadi"; exit 1; fi; echo "compose: $PC"; C=/pam/docker-mgmt/docker-compose.yml; P="--profile kron-commons --profile kron-redis --profile **pam-commons** --profile pam-addons --profile pam-mcp-bridge --profile pam-superset"; DBP=$(grep -E "^PAM\_DB\_PORT=" /pam/docker-mgmt/.env 2>/dev/null | cut -d= -f2); DBP=$\{DBP:-5444}; timeout 3 bash -c "\/dev/null && echo "DB ($DBP) erisilebilir" || \{ echo "DB ($DBP) kapali! Once postgresql-15 servisini baslat, islem yapilmadi"; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); for name in $(podman ps -a --format "{{.Names}}" | grep -vxF "$\{KC:-\_\_none\_\_}") $KC; do podman stop $name > /dev/null 2>&1; podman rm -f $name > /dev/null 2>&1 && echo "$name stopped" || echo "$name stop failed"; done; echo "ALL SERVICES STOPPED"; $PC -f $C $P up -d kron-commons > /tmp/pam\_restart.log 2>&1 && echo "kron-commons started" || \{ echo "kron-commons failed"; tail -30 /tmp/pam\_restart.log; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); \[ -z "$KC" ] && \{ echo "kron-commons container not found"; exit 1; }; SECONDS=0; until podman healthcheck run $KC > /dev/null 2>&1; do \[ $SECONDS -ge 600 ] && \{ echo "kron-commons 600s icinde healthy olmadi"; podman logs --tail 50 $KC; exit 1; }; sleep 5; echo "kron-commons healthy waiting... (${SECONDS}s, $(podman inspect $KC --format "state={{.State.Status}} restarts={{.RestartCount}}"))"; done; echo "kron-commons healthy"; $PC -f $C $P up -d $SERVICE > /tmp/pam\_restart.log 2>&1 && echo "$SERVICE STARTED" || \{ echo "$SERVICE FAILED"; tail -30 /tmp/pam\_restart.log; }'
3\) **((PAM))** On the System Configuration Man. page of the Kron PAM Web GUI **(10.10.0.1)**, **mobile.tomcat.url** should be set with Kron PAM Mobile App Server’s info. (E.g., **https\://10.10.0.2\:9443/mobile-api/rest**** OR ****https\://mobile129.kron.com.tr\:9443/mobile-api/rest**)
4\) **((PAM))** The following jobs related to push notification system should be defined on the Kron PAM Web GUI **(****10.10.0.1****)**: SCPolicyNotifierJob, SendPushMessageJob.
5\) **((DMZ))** The following lines should be changed on **.env** file **on ****10.10.0.2****.**
**vi /pam/docker-mgmt/.env**
· COMPOSE\_PROFILES=kron-commons,kron-redis,pam-commons,pam-addons,pam-nginx,pam-superset,pam-mcp-bridge** ===> COMPOSE\_PROFILES=kron-commons,pam-commons**
· HOST\_GATEWAY=**10.10.0.2**** ====>** HOST\_GATEWAY=**10.10.0.1**
· APP\_INT\_SPRING\_BOOT\_ADMIN\_URL=https\://kron-commons-aggregator:8443 **====>** APP\_INT\_SPRING\_BOOT\_ADMIN\_URL=**""**
· PAM\_DB\_PASSWORD='{cipher}**10.10.0.2’s DB PASSWORD as ciphertext**' **====>** PAM\_DB\_PASSWORD='{cipher}**10.10.0.1’s DB PASSWORD as ciphertext**’
· PAM\_COMMONS\_AUTH\_ENABLED=true **====> **PAM\_COMMONS\_AUTH\_ENABLED=**false**
· APP\_INT\_PAM\_APPLICATION\_URL=https\://host.docker.internal **===> APP\_INT\_PAM\_APPLICATION\_URL=https\://****10.10.0.1**
6\) **((DMZ))---optional for certificate---** If the customer has their own valid certificate for mobile service:
If the customer uses its own certificate for accessing mobile URL, the certificate should be uploaded to **/pam/gui/conf/cert** (e.g., **kron.com.tr.jks**). Note that, the purpose of using this certificate is different from the self signed certificate to access a specific docker service on the Kron PAM Server.
· Put the jks (e.g. **kron.com.tr.jks**) file to **/pam/gui/conf/cert** **on ****10.10.0.2****.**
· Edit the following lines of **vi /pam/docker-mgmt/.env** located under **/pam/docker-mgmt/****on 10.10.0.2****:**
PAM\_CERT\_FILE=\{**CUSTOMER’s JKS FILE NAME**}
PAM\_CERT\_FILE\_ALIAS=\{**CUSTOMER’s ALIAS-NAME**}
PAM\_CERT\_FILE\_STORE\_PASSWORD=\{**CUSTOMER’s STORE PASSWORD**}
PAM\_CERT\_FILE\_PASSWORD=\{**CUSTOMER’s SSL PASSWORD**}
PAM\_CERT\_FILE\_STORE\_TYPE=**jks**
MOBILE\_API\_CERT=\{**CUSTOMER’s JKS FILE NAME**}
**E.g.:**
PAM\_CERT\_FILE=**kron.com.tr.jks**
PAM\_CERT\_FILE\_ALIAS=**kron**
PAM\_CERT\_FILE\_STORE\_PASSWORD=**kr10ipsla**
PAM\_CERT\_FILE\_PASSWORD=**kr10ipsla**
PAM\_CERT\_FILE\_STORE\_TYPE=**jks**
** **
\*LISTING the certificates’ configurations: **on 10.10.0.2**
sudo keytool -list -v -keystore /pam/gui/conf/cert/**kron.com.tr.jks** -storepass **kr10ipsla**
7\) **((PAM))** The following line should be changed on **.env** file **on 10.10.0.1****.**
**vi /pam/docker-mgmt/.env**
· KRON\_COMMONS\_CONFIG\_PORT="127.0.0.1:8001"** ===> **KRON\_COMMONS\_CONFIG\_PORT="0.0.0.0:8001"
8\) **((DMZ))** The following **docker-compose.yml** file should be used **on 10.10.0.2** under /pam/docker-mgmt/.
**------------------------------------------------------------------------------------------**
x-int-paths:
log: \&p-log /app/logs
cold-log: \&p-cold-log /app/cold-logs
log-config: \&p-log-config /app/config-repo/log4j2.xml
security-config: \&p-security-config /app/security/security.properties
license: \&p-license /app/license
license-path: \&p-license-path /app/license/licence.properties
tools: \&p-tools /app/tools
reports: \&p-reports /app/reports
uploads: \&p-uploads /app/uploads
templates: \&p-templates /app/templates
config-repo: \&p-config-repo /app/config-repo
db-certs: \&p-db-certs /app/db-certs
certs: \&p-certs /app/certs
metadata: \&p-metadata /app/metadata
pam-certs: \&p-pam-certs /app/pam-certs
pam-commons-cert-path: \&p-pam-commons-cert-path /app/pam-certs/${PAM\_COMMONS\_CERT}
pam-commons-key-store: \&p-pam-commons-key-store file:/app/pam-certs/${PAM\_COMMONS\_CERT}
key-store: \&p-key-store file:/app/certs/aioc.jks
trust-store: \&p-trust-store file:/app/certs/aioc.p12
trust-store-path: \&p-trust-store-path /app/certs/aioc.p12
x-volumes:
config-repo: \&vol-config-repo
type: bind
source: ${CONFIG\_REPO\_DIRECTORY}
target: \*p-config-repo
certs: \&vol-certs
type: bind
source: ${APPLICATION\_CERTS\_DIRECTORY}
target: \*p-certs
db-certs: \&vol-db-certs
type: bind
source: ${DATABASE\_CERTS\_DIRECTORY}
target: \*p-db-certs
security-config: \&vol-security-config
type: bind
source: ${SECURITY\_FILES\_DIRECTORY}
target: \*p-security-config
log4j2: \&vol-log4j2
type: bind
source: ${LOG4J2\_PATH}
target: \*p-log-config
logs: \&vol-logs
type: bind
source: ${LOG\_DIRECTORY\_PATH}
target: \*p-log
cold-logs: \&vol-cold-logs
type: bind
source: ${COLD\_LOG\_DIRECTORY\_PATH}
target: \*p-cold-log
license: \&vol-license
type: bind
source: ${LICENSE\_FILE\_DIRECTORY}${LICENSE\_FILE\_NAME}
target: \*p-license-path
templates: \&vol-templates
type: bind
source: ${MAIL\_TEMPLATES\_DIRECTORY}
target: \*p-templates
pam-certs: \&vol-pam-certs
type: bind
source: ${PAM\_CERTS\_DIRECTORY}
target: \*p-pam-certs
pam-commons-cert: \&vol-pam-commons-cert
type: bind
source: ${PAM\_COMMONS\_SSL\_KEY\_STORE\_PATH}
target: \*p-pam-commons-cert-path
x-container-local-directories: \&container-local-directories
APP\_INT\_LOG\_DIRECTORY\_PATH: \*p-log
APP\_INT\_COLD\_LOG\_DIRECTORY\_PATH: \*p-cold-log
APP\_INT\_LOG\_CONFIG\_FILE\_PATH: \*p-log-config
APP\_INT\_SECURITY\_CONFIG\_PATH: \*p-security-config
APP\_INT\_LICENSE\_PATH: \*p-license
APP\_INT\_TOOL\_PATH: \*p-tools
APP\_INT\_REPORTS\_PATH: \*p-reports
APP\_INT\_UPLOAD\_DIRECTORY\_PATH: \*p-uploads
APP\_INT\_TEMPLATE\_FOLDER: \*p-templates
APP\_INT\_CONFIG\_REPO\_DIR: \*p-config-repo
APP\_INT\_DB\_CERTS\_PATH: \*p-db-certs
APP\_INT\_CERTS\_PATH: \*p-certs
APP\_INT\_METADATA\_DB\_DIRECTORY: \*p-metadata
APP\_INT\_PAM\_CERTS\_PATH: \*p-pam-certs
x-pam-common-directories: \&pam-common-directories
\<\<: \*container-local-directories
LOG\_DIRECTORY\_PATH: \*p-log
COLD\_LOG\_DIRECTORY\_PATH: \*p-cold-log
LOG\_CONFIG\_FILE\_PATH: \*p-log-config
SECURITY\_CONFIG\_PATH: \*p-security-config
TOOL\_PATH: \*p-tools
REPORTS\_PATH: \*p-reports
UPLOAD\_DIRECTORY\_PATH: \*p-uploads
TEMPLATE\_FOLDER: \*p-templates
CONFIG\_REPO\_DIR: \*p-config-repo
LICENSE\_PATH: \*p-license-path
PAM\_COMMONS\_SSL\_KEY\_STORE: \*p-pam-commons-key-store
x-pam-common-variables: \&pam-common-variables
\<\<: \*pam-common-directories
INSTANCE\_NAME: ${INSTANCE\_NAME}
TZ: ${TIME\_ZONE}
SPRING\_PROFILES\_ACTIVE: ${ACTIVE\_SPRING\_PROFILES}
LIQUIBASE\_ENABLED: $\{LIQUIBASE\_ENABLED:-false}
APPLICATION\_PORT: 8443
MANAGEMENT\_PORT: 8091
** ###-------------------------------**
** ###CHANGE THIS: CONFIG\_SERVER\_URI**
** ###-------------------------------**
\# Config Server Environment Values
CONFIG\_SERVER\_URI: https\://**10.10.0.1**:8001
CONFIG\_USER: aioc
CONFIG\_PASSWORD: aioc
\# SSL Environment Values
SSL\_ENABLE: true
SSL\_KEY\_STORE\_TYPE: PKCS12
KEY\_ALIAS: aioc
KEY\_STORE: \*p-key-store
TRUST\_STORE: \*p-trust-store
TRUSTSTORE\_RESOURCE\_FILE: \*p-trust-store-path
KEYSTORE\_RESOURCE\_FILE: \*p-trust-store-path
\#KRON\_COMMON\_SERVICE\_URLs
REDIS\_HOST: ${APP\_INT\_REDIS\_HOST}
REDIS\_PORT: ${APP\_INT\_REDIS\_PORT}
SPRING\_BOOT\_ADMIN\_URL: ${APP\_INT\_SPRING\_BOOT\_ADMIN\_URL}
KRON\_COMMONS\_URL: ${APP\_INT\_KRON\_COMMONS\_URL}
NETWORK\_SERVICE\_SOCKET\_URL: ${APP\_INT\_NETWORK\_SERVICE\_SOCKET\_URL}
AUTH\_SERVICE\_URL: ${APP\_INT\_AUTH\_SERVICE\_URL}
LICENSE\_SERVICE\_URL: ${APP\_INT\_LICENSE\_SERVICE\_URL}
NETWORK\_SERVICE\_URL: ${APP\_INT\_NETWORK\_SERVICE\_URL}
NOTIFICATION\_SERVICE\_URL: ${APP\_INT\_NOTIFICATION\_SERVICE\_URL}
ALFRED\_SERVICE\_URL: ${APP\_INT\_ALFRED\_SERVICE\_URL}
PAM\_AUTH\_SERVICE\_URL: ${APP\_INT\_PAM\_AUTH\_SERVICE\_URL}
\# KRON COMMONS
ALFRED\_ENABLED: ${KRON\_COMMONS\_ALFRED\_ENABLED}
LICENSE\_ENABLED: ${KRON\_COMMONS\_LICENSE\_ENABLED}
NETWORK\_ENABLED: ${KRON\_COMMONS\_NETWORK\_ENABLED}
\# PAM COMMONS
PAM\_COMMONS\_AUTH\_ENABLED: ${PAM\_COMMONS\_AUTH\_ENABLED}
PAM\_COMMONS\_MOBILE\_API\_ENABLED: ${PAM\_COMMONS\_MOBILE\_API\_ENABLED}
\# MOBILE APP
PAM\_COMMONS\_SSL\_ENABLE: ${PAM\_COMMONS\_SSL\_ENABLE}
PAM\_COMMONS\_SSL\_ALIAS: ${PAM\_COMMONS\_CERT\_FILE\_ALIAS}
PAM\_COMMONS\_SSL\_STORE\_TYPE: ${PAM\_COMMONS\_CERT\_FILE\_STORE\_TYPE}
PAM\_COMMONS\_SSL\_STORE\_PASSWORD: ${PAM\_COMMONS\_CERT\_FILE\_STORE\_PASSWORD}
PAM\_COMMONS\_SSL\_PASSWORD: ${PAM\_COMMONS\_CERT\_FILE\_PASSWORD}
\# ===> REDIS CONFIGURATION
REDIS\_USERNAME: pam-redis
REDIS\_PASSWORD: '{cipher}537c807d7d7ea0516a368439579dcbfd9f9487e5cc39facf32e132ebce20add40c248bb0c36d659044cc34ade1394eeb'
\# PAM
PAM\_URL: ${APP\_INT\_PAM\_APPLICATION\_URL}
x-pam-db-variables: \&pam-common-db-variables
\<\<: \*pam-common-variables
DB\_URL: ${PAM\_DB\_URL}
DB\_USERNAME: ${PAM\_DB\_USERNAME}
DB\_PASSWORD: ${PAM\_DB\_PASSWORD}
DB\_SCHEMA: ${PAM\_DB\_SCHEMA}
DB\_DRIVER: org.postgresql.Driver
BASE\_URL: ${APP\_INT\_PAM\_APPLICATION\_URL}
PAM\_BASE\_LOGIN\_URL: ${PAM\_BASE\_LOGIN\_URL}
x-healthcheck-java: \&healthcheck-java
test: curl -fsS -m 2 http\://localhost:$$MANAGEMENT\_PORT/actuator/health | grep -q '"status":"UP"' || exit 1
interval: 6s
retries: 20
start\_period: 8s
timeout: 5s
x-no-new-privs: \&no-new-privs "no-new-privileges\:true"
services:
** kron-commons:**
** image: dockerhub.kron.com.tr/kron-commons/kron-commons:26.12.4$\{OS\_IMAGE\_POSTFIX:-}**
user: "0:65534"
security\_opt:
\- \*no-new-privs
ports:
\- "${KRON\_COMMONS\_CONFIG\_PORT}:8001"
\- "${KRON\_COMMONS\_PORT}:8443"
profiles:
\- kron-commons
environment:
\<\<: \*pam-common-db-variables
SPRING\_APPLICATION\_JSON: '\{"spring.jpa.properties.hibernate.hbm2ddl.auto":"none","spring.boot.admin.client.enabled"\:false}'
AGGREGATOR\_CONFIG\_SERVER\_ENABLED: true
volumes:
\- \*vol-config-repo
\- \*vol-certs
\- \*vol-db-certs
\- \*vol-security-config
\- \*vol-log4j2
\- \*vol-logs
\- \*vol-cold-logs
\- \*vol-license
\- \*vol-templates
\- type: bind
source: ${DMI\_DIRECTORY}
target: /etc/dmi
healthcheck: \*healthcheck-java
restart: on-failure:10
networks:
\- kron-network
extra\_hosts:
\- "host.docker.internal:${HOST\_GATEWAY}"
** ****- ""\{PAM-INSTANCE NAME of 10.10.0.1\}\:10.10.0.1"**
**###-------------------------------**
**###CHANGE THIS: extra\_hosts: e.g., - ****“pam-01\:10.10.0.1”**
**###-------------------------------**
** pam-commons:**
** image: dockerhub.kron.com.tr/pam/pam-commons:3.9.0$\{OS\_IMAGE\_POSTFIX:-}**
user: "0:65534"
security\_opt:
\- \*no-new-privs
container\_name: pam-commons
environment:
\<\<: \*pam-common-db-variables
JAVA\_TOOL\_OPTIONS: "-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true"
ports:
\- "${PAM\_COMMONS\_PORT}:8443"
profiles:
\- pam-commons
volumes:
\- \*vol-config-repo
\- \*vol-log4j2
\- \*vol-certs
\- \*vol-db-certs
\- \*vol-security-config
\- \*vol-logs
\- \*vol-cold-logs
\- \*vol-license
\- \*vol-pam-commons-cert
healthcheck: \*healthcheck-java
restart: on-failure:10
depends\_on:
kron-commons:
condition: service\_healthy
extra\_hosts:
\- "host.docker.internal:${HOST\_GATEWAY}"
** ****- ""\{PAM-INSTANCE NAME of 10.10.0.1\}\:10.10.0.1"**
networks:
\- kron-network
**###-------------------------------**
**###CHANGE THIS: extra\_hosts: e.g., - ****“pam-01\:10.10.0.1”**
**###-------------------------------**
networks:
kron-network:
name: kron-network # creates this named network if it doesn't already exist
driver: bridge
**------------------------------------------------------------------------------------------**
9\) **((PAM))** Using the RSA key pair created with the **aioc** alias, the environment configurations (kron-commons-config) in the Docker container on the Kron PAM server can be accessed by the Kron PAM Mobile App Server. For this, instead of using the customer's existing key pair, **a self-signed certificate is used**. This RSA key pair is stored in different formats and keystore files (PKCS#12 and JKS) but with the same alias (**aioc**). The jks and p12 files located at /pam/docker-mgmt/cert should be recreated with keytool commands, in this scenario. **(If the Kron PAM server and Kron PAM Mobile App Server are installed on the same server, these files should stand as is).**
\*LISTING the certificates’ configurations: **on 10.10.0.1**
-JKS:
sudo keytool -list -v -keystore /pam/docker-mgmt/cert/**aioc.jks** -storepass **krondev10**
-P12:
sudo keytool -list -v -keystore /pam/docker-mgmt/cert/**aioc.p12** -storepass **krondev10** -storetype PKCS12
\*DELETING the certificates’ configurations: **on 10.10.0.1**
-JKS:
sudo keytool -delete -alias aioc -keystore /pam/docker-mgmt/cert/**aioc.jks** -storepass **krondev10**
-P12:
sudo keytool -delete -alias aioc -keystore /pam/docker-mgmt/cert/**aioc.p12** -storepass **krondev10**
\*DELETING the certificate files: (Take the backup for these files) **on 10.10.0.1**
-JKS:
rm -rf /pam/docker-mgmt/cert/**aioc.jks**
-P12:
rm -rf /pam/docker-mgmt/cert/**aioc.p12**
\*CREATING the certificate files and configurations: **on 10.10.0.1**
-JKS: (if the DMZ server’s domain name is used (**mobile129.kron.com.tr**), add it here as DNS: **mobile129.kron.com.tr** too)
sudo keytool -genkeypair -alias aioc -keyalg RSA -keysize 2048 -dname "CN=localhost,OU=Kron,O=Kron,C=TR" -ext "SAN\:c=DNS\:localhost,DNS\:host.docker.internal,DNS\:kron-commons,DNS\:pam-commons,DNS\:pam-addons,DNS\:kai-mcp-bridge,DNS\:mcp-bridge,DNS\:redis,DNS\:superset,DNS\:nginx,DNS\:kron-commons-aggregator,DNS\:kron-commons-config,DNS\:kron-commons-alfred,DNS\:kron-commons-auth,DNS\:kron-commons-license,DNS\:kron-commons-network,DNS\:kron-commons-notification,DNS\:pta,DNS\:auth,DNS\:uba,DNS\:mobile-api,DNS\:tcp-proxy,DNS\:kron-dam-metadata,DNS\:kron-dam-portal,IP:**127.0.0.1**,IP:**10.10.0.1**,IP:**10.10.0.2**" -storepass **krondev10** -keypass **krondev10** -keystore /pam/docker-mgmt/cert/**aioc.jks** -validity 3650
-P12: (if the DMZ server’s domain name is used (**mobile129.kron.com.tr**), add it here as DNS: **mobile129.kron.com.tr** too)
sudo keytool -genkeypair -alias aioc -keyalg RSA -keysize 2048 -storetype PKCS12 -dname "CN=localhost,OU=Kron,O=Kron,C=TR" -ext "SAN\:c=DNS\:localhost,DNS\:host.docker.internal,DNS\:kron-commons,DNS\:pam-commons,DNS\:pam-addons,DNS\:kai-mcp-bridge,DNS\:mcp-bridge,DNS\:redis,DNS\:superset,DNS\:nginx,DNS\:kron-commons-aggregator,DNS\:kron-commons-config,DNS\:kron-commons-alfred,DNS\:kron-commons-auth,DNS\:kron-commons-license,DNS\:kron-commons-network,DNS\:kron-commons-notification,DNS\:pta,DNS\:auth,DNS\:uba,DNS\:mobile-api,DNS\:tcp-proxy,DNS\:kron-dam-metadata,DNS\:kron-dam-portal,IP:**127.0.0.1**,IP:**10.10.0.1**,IP:**10.10.0.2**" -storepass **krondev10** -keypass **krondev10** -keystore /pam/docker-mgmt/cert/**aioc.p12** -validity 3650
10\) **((PAM)) **The following keytool commands should be executed to import certificate **on 10.10.0.1**:
yes | sudo keytool -importkeystore -srckeystore /pam/docker-mgmt/cert/**aioc.jks** -srcstorepass **krondev10** -destkeystore /pam/docker-mgmt/cert/**aioc.p12 **-deststoretype pkcs12 -storepass **krondev10**
yes | sudo keytool -importkeystore -noprompt \\
-srckeystore /pam/docker-mgmt/cert/**aioc.p12** -srcstoretype PKCS12 -srcstorepass **krondev10** -srcalias **aioc** \\
-destkeystore /pam/docker-mgmt/cert/**aioc.jks** -deststoretype JKS -deststorepass **krondev10** -destkeypass **krondev10** -destalias **kron-commons**
11\) **((PAM)) **The ownership and mode configurations should be changed for these files **on 10.10.0.1****:**
sudo chown pamuser\:pam-group /pam/docker-mgmt/cert/**aioc.jks** /pam/docker-mgmt/cert/**aioc.p12** && sudo chmod 750 /pam/docker-mgmt/cert/**aioc.jks** /pam/docker-mgmt/cert/**aioc.p12**
12\) **((PAM)) **All of the docker services on the Kron PAM server should be restarted **on 10.10.0.1**:
sudo -u pamuser bash -c 'export PATH=/home/pamuser/.local/bin:/usr/local/bin:$PATH; if podman compose version > /dev/null 2>&1; then PC="podman compose"; elif /usr/bin/python3.14 -m podman\_compose version > /dev/null 2>&1; then PC="/usr/bin/python3.14 -m podman\_compose"; else echo "calisan podman-compose bulunamadi, islem yapilmadi"; exit 1; fi; echo "compose: $PC"; C=/pam/docker-mgmt/docker-compose.yml; P="--profile kron-commons --profile kron-redis --profile **pam-commons **--profile pam-addons --profile pam-mcp-bridge --profile pam-superset"; DBP=$(grep -E "^PAM\_DB\_PORT=" /pam/docker-mgmt/.env 2>/dev/null | cut -d= -f2); DBP=$\{DBP:-5444}; timeout 3 bash -c "\/dev/null && echo "DB ($DBP) erisilebilir" || \{ echo "DB ($DBP) kapali! Once postgresql-15 servisini baslat, islem yapilmadi"; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); for name in $(podman ps -a --format "{{.Names}}" | grep -vxF "$\{KC:-\_\_none\_\_}") $KC; do podman stop $name > /dev/null 2>&1; podman rm -f $name > /dev/null 2>&1 && echo "$name stopped" || echo "$name stop failed"; done; echo "ALL SERVICES STOPPED"; $PC -f $C $P up -d kron-commons > /tmp/pam\_restart.log 2>&1 && echo "kron-commons started" || \{ echo "kron-commons failed"; tail -30 /tmp/pam\_restart.log; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); \[ -z "$KC" ] && \{ echo "kron-commons container not found"; exit 1; }; SECONDS=0; until podman healthcheck run $KC > /dev/null 2>&1; do \[ $SECONDS -ge 600 ] && \{ echo "kron-commons 600s icinde healthy olmadi"; podman logs --tail 50 $KC; exit 1; }; sleep 5; echo "kron-commons healthy waiting... (${SECONDS}s, $(podman inspect $KC --format "state={{.State.Status}} restarts={{.RestartCount}}"))"; done; echo "kron-commons healthy"; $PC -f $C $P up -d > /tmp/pam\_restart.log 2>&1 && echo "ALL SERVICES STARTED" || \{ echo "ALL SERVICES FAILED"; tail -30 /tmp/pam\_restart.log; }'
13\) **((DMZ)) **All of the pam-related services on the Kron PAM Mobile App Server should be stopped **on 10.10.0.2**:
**ks**
**stop all services**
14\) **((PAM)) **The certificate files (jks and p12) created in the 9th step (**10.10.0.1**) should be transferred to Kron PAM Mobile App Server (**10.10.0.2****)**.
**Note that, jks and p12 files should be identical on both environments. To check this, the following commands should be run on both environments:**
sha256sum /pam/docker-mgmt/cert/aioc.p12
sha256sum /pam/docker-mgmt/cert/aioc.jks
**! If the files are not identical due to the 3rd party SSH/SFTP tool (e.g. MobaXterm) usage, sshpass command can be used for file transfer:**
sshpass -p **‘your-password’ **rsync -avz /pam/docker-mgmt/cert/**aioc.p12 pamuser**@**10.10.0.2**:/pam/docker-mgmt/cert
sshpass -p **‘your-password’ **rsync -avz /pam/docker-mgmt/cert/**aioc.jks pamuser**@**10.10.0.2**:/pam/docker-mgmt/cert
15\) **((DMZ))** After the file transfer from Kron PAM server to Kron PAM Mobile App Server, ownership and mode configurations should be changed for these files **on 10.10.0.2****:**
sudo chown pamuser\:pam-group /pam/docker-mgmt/cert/**aioc.jks** /pam/docker-mgmt/cert/**aioc.p12** && sudo chmod 755 /pam/docker-mgmt/cert/**aioc.jks** /pam/docker-mgmt/cert/**aioc.p12**
16\) **((DMZ))** All of the docker services on the Kron PAM Mobile App Server should be stopped and the mobile-api service should be started on **10.10.0.2****:**
sudo -u pamuser bash -c 'SERVICE="**pam-commons**"; export PATH=/home/pamuser/.local/bin:/usr/local/bin:$PATH; if podman compose version > /dev/null 2>&1; then PC="podman compose"; elif /usr/bin/python3.14 -m podman\_compose version > /dev/null 2>&1; then PC="/usr/bin/python3.14 -m podman\_compose"; else echo "calisan podman-compose bulunamadi, islem yapilmadi"; exit 1; fi; echo "compose: $PC"; C=/pam/docker-mgmt/docker-compose.yml; P="--profile kron-commons --profile kron-redis --profile **pam-commons** --profile pam-addons --profile pam-mcp-bridge --profile pam-superset"; DBP=$(grep -E "^PAM\_DB\_PORT=" /pam/docker-mgmt/.env 2>/dev/null | cut -d= -f2); DBP=$\{DBP:-5444}; timeout 3 bash -c "\/dev/null && echo "DB ($DBP) erisilebilir" || \{ echo "DB ($DBP) kapali! Once postgresql-15 servisini baslat, islem yapilmadi"; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); for name in $(podman ps -a --format "{{.Names}}" | grep -vxF "$\{KC:-\_\_none\_\_}") $KC; do podman stop $name > /dev/null 2>&1; podman rm -f $name > /dev/null 2>&1 && echo "$name stopped" || echo "$name stop failed"; done; echo "ALL SERVICES STOPPED"; $PC -f $C $P up -d kron-commons > /tmp/pam\_restart.log 2>&1 && echo "kron-commons started" || \{ echo "kron-commons failed"; tail -30 /tmp/pam\_restart.log; exit 1; }; KC=$(podman ps -a --filter label=com.docker.compose.service=kron-commons --format "{{.Names}}" | head -1); \[ -z "$KC" ] && \{ echo "kron-commons container not found"; exit 1; }; SECONDS=0; until podman healthcheck run $KC > /dev/null 2>&1; do \[ $SECONDS -ge 600 ] && \{ echo "kron-commons 600s icinde healthy olmadi"; podman logs --tail 50 $KC; exit 1; }; sleep 5; echo "kron-commons healthy waiting... (${SECONDS}s, $(podman inspect $KC --format "state={{.State.Status}} restarts={{.RestartCount}}"))"; done; echo "kron-commons healthy"; $PC -f $C $P up -d $SERVICE > /tmp/pam\_restart.log 2>&1 && echo "$SERVICE STARTED" || \{ echo "$SERVICE FAILED"; tail -30 /tmp/pam\_restart.log; }'
17\) **((DMZ))** Lastly, check pam-commons service on the Kron PAM Mobile App Server **(****10.10.0.2****)**:
**sudo -u pamuser bash -c 'podman logs -f --tail 1000 pam-commons'**
18\) **((PAM)) **Last trick: Increase the log level on the **pam-commons-default.yaml** file under **/pam/docker-mgmt/config-repo**:
logging:
level:
com.kron.pam: ERROR
**===>**
logging:
level:
com.kron.pam: INFO