Webserver Configuration
The Webserver has a minimal JSON configuration file for service-level settings, while most operational settings are managed through the Web UI and stored in its embedded key-value database.
Service Configuration (webserver.json)
This file must be in the same directory as the executable.
{
"HTTPS": "true",
"PortAPI": "8050",
"PortWEB": "9090",
"RunUser": "mugnsoft",
"_sharedInternal": "<same-value-on-every-component>"
}
| Field | Type | Description | Default |
|---|---|---|---|
HTTPS |
string | Enable HTTPS for both API and Web servers. Set to "true" or "false" |
"true" |
PortAPI |
string | TCP port for the REST API server | "8050" |
PortWEB |
string | TCP port for the Web UI server | "9090" |
RunUser |
string | System user to run the service as (Linux only). Leave empty to use the current user | "" |
_sharedInternal |
string | Password of the internal adminMNS machine account. The Webserver uses it to authenticate to every component it drives (Enable, Push Settings, token resync), so it must match the value in each component’s config. When empty, adminMNS is not created. See Internal component secret |
empty: generated on first start (since 4.2.0) |
PdfBrowser |
string | Full path of the Chrome, Chromium or Edge executable that prints PDF reports. Optional (since 4.3.0) | "": found automatically |
_sharedInternal must hold the same value across webserver.json, monitor.json, integrator.json and discovery_agent.json. A mismatch makes the Webserver’s Enable / Push Settings actions fail with a bcrypt error in the target component’s log. Restarting a component re-hashes its stored adminMNS password to match its config, so a stale value self-heals.
PDF reports (PdfBrowser)
Since 4.3.0 a report can be emailed as a PDF (see Language and format). The Webserver still builds the HTML report, then starts a headless Chrome, Chromium or Edge that opens it, waits for the charts to be drawn and prints it to A4 landscape. Nothing else needs to be installed: the browser is driven directly, without a driver.
Which browser is used. When PdfBrowser is set, that executable and no other. A path that does not exist is not replaced by another browser: the report falls back to HTML with the error PdfBrowser "<path>" in webserver.json does not exist. When PdfBrowser is empty or absent, the Webserver looks for:
| OS | Locations checked, in order |
|---|---|
| Windows | Microsoft\Edge\Application\msedge.exe, then Google\Chrome\Application\chrome.exe, under %ProgramFiles(x86)%, %ProgramFiles% and %LocalAppData% |
| Linux | /usr/bin/chromium, /usr/bin/chromium-browser, /usr/bin/google-chrome, /usr/bin/google-chrome-stable, /usr/bin/microsoft-edge, /snap/bin/chromium, /headless-shell/headless-shell |
| Both | then chromium, chromium-browser, google-chrome, chrome, msedge, microsoft-edge on the PATH |
Windows 10/11 and Windows Server 2022 or later ship with Edge, so PDF works there without any setting. On Linux, install a browser, for example:
# Debian / Ubuntu
sudo apt install chromium
# RHEL / Rocky / Alma (EPEL)
sudo dnf install chromium
Set PdfBrowser when the browser is elsewhere, or to pin one browser when several are installed:
{
"HTTPS": "true",
"PortAPI": "8050",
"PortWEB": "9090",
"RunUser": "mugnsoft",
"_sharedInternal": "<same-value-on-every-component>",
"PdfBrowser": "/opt/google/chrome/chrome"
}
On Windows, escape the backslashes: "PdfBrowser": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe". The setting is read at start-up, so restart the Webserver after changing it.
How it runs.
- Each print uses a throwaway browser profile, deleted afterwards. Your browser profiles, cookies and extensions are never read.
- Running as
root(typical in a container), the browser is started with--no-sandbox, because Chrome refuses its sandbox as root. Run the service as a regular user (RunUser) to keep the sandbox. - At most two reports are printed at the same time; the others wait their turn. Allow 150–300 MB of memory per print.
- A print that does not finish in time (60 s for the charts to be drawn, 2 minutes in all) is abandoned, and the report is sent as HTML.
- No Internet access is needed. The report page asks for its libraries (Chart.js, UIkit, jQuery, moment…) from public CDNs; while printing, the Webserver answers those requests itself from the copies built into it, and refuses any other request. A Webserver on a closed network prints complete PDFs. For HTML reports read without Internet access, see Reports without Internet access.
- A page whose chart library did not load is not printed as empty panels: the report is sent as HTML with the reason
the report libraries did not load.
Docker. The mugnsoft/webserver image does not include a browser, so PDF reports fall back to HTML. To print PDFs, build an image from it that adds Chromium, and set PdfBrowser if it is not in one of the locations above.
Troubleshooting. When the PDF is missing, the send result shows PDF unavailable (reason) and the Webserver log has a sendReportEmail ... PDF not produced line with the cause:
| Reason | Fix |
|---|---|
no Chrome, Chromium or Edge found on the webserver host |
Install one, or set PdfBrowser. |
PdfBrowser "..." in webserver.json does not exist |
Correct the path and restart the Webserver. |
waiting for function failed: timeout or context deadline exceeded |
The report page did not finish drawing in time (60 s for the charts, 2 minutes in all): check the host’s load. |
the report libraries did not load |
The page’s chart library was missing. Should not happen with the built-in copies: send the Webserver log to support. |
| The browser exits at start (Linux) | Missing shared libraries: install the distribution’s chromium package rather than a copied binary, which brings its dependencies. |
Runtime Settings (via Web UI)
These settings are configured through the Settings page in the Web UI and stored encrypted in the embedded key-value store.
SMTP (Email)
| Setting | Description |
|---|---|
| SMTP Server | Mail server hostname |
| SMTP Port | Mail server port (25, 465, 587) |
| SMTP Username | Authentication username |
| SMTP Password | Authentication password |
| SMTP TLS | Enable TLS encryption |
| Sender Email | Email address for outgoing messages |
Slack Integration
| Setting | Description |
|---|---|
| Slack Token | Bot token for Slack API |
| Slack Channel | Default channel for notifications |
GitLab Integration
| Setting | Description |
|---|---|
| GitLab URL | GitLab server URL |
| GitLab Token | Personal access token |
| GitLab Project | Project ID for monitor script import |
LDAP Integration
| Setting | Description |
|---|---|
| LDAP Server | LDAP/AD server hostname |
| LDAP Port | Server port (389, 636) |
| LDAP Base DN | Base distinguished name for searches |
| LDAP Bind DN | Bind user distinguished name |
| LDAP Bind Password | Bind user password |
| LDAP TLS | Enable TLS |
Logging
| Setting | Description | Default |
|---|---|---|
| Log Level | debug, info, warn, error |
info |
| Max Log Size | Maximum log file size (MB) | 10 |
| Max Backups | Number of rotated log files | 5 |
| Max Age | Days to keep log files | 28 |
| Compress Logs | Compress rotated files | true |
JWT Authentication Settings
These are compiled into the binary and cannot be changed via configuration:
| Setting | Value |
|---|---|
| Signing Algorithm | RS256 |
| User Token Lifetime | 15 minutes |
| Component Token Lifetime | 60 days (1440 hours) |
| Token Lookup | header: Authorization, cookie: jwt |
| Token Header | Bearer |
| Cookie Name | jwt |
| Cookie HTTPOnly | true |
| Cookie SameSite | Lax |
File Locations
| File/Directory | Purpose |
|---|---|
webserver.json |
Service configuration |
license_MNS.dat |
License file (required) |
config/sec/mugnsoft_webserver.key |
RSA private key (JWT signing) |
config/sec/mugnsoft_webserver.key.pub |
RSA public key (JWT verification) |
config/ssl/certificates/ |
TLS certificates |
config/ssl/private/ |
TLS private keys |
dbs/webserver.db |
Main embedded key-value database |
dbs/backup/ |
Automated backups |
log/ |
Application logs |