Webserver Configuration

The Webserver has a minimal JSON configuration file for service-level settings, while most operational settings are managed through the Web UI and stored in its embedded key-value database.

Service Configuration (webserver.json)

This file must be in the same directory as the executable.

{
  "HTTPS": "true",
  "PortAPI": "8050",
  "PortWEB": "9090",
  "RunUser": "mugnsoft",
  "_sharedInternal": "<same-value-on-every-component>"
}
Field Type Description Default
HTTPS string Enable HTTPS for both API and Web servers. Set to "true" or "false" "true"
PortAPI string TCP port for the REST API server "8050"
PortWEB string TCP port for the Web UI server "9090"
RunUser string System user to run the service as (Linux only). Leave empty to use the current user ""
_sharedInternal string Password of the internal adminMNS machine account. The Webserver uses it to authenticate to every component it drives (Enable, Push Settings, token resync), so it must match the value in each component’s config. When empty, adminMNS is not created. See Internal component secret empty: generated on first start (since 4.2.0)
PdfBrowser string Full path of the Chrome, Chromium or Edge executable that prints PDF reports. Optional (since 4.3.0) "": found automatically
Important: Changing the ports or HTTPS setting requires a service restart. Other settings (SMTP, Slack, LDAP, etc.) are configured through the Web UI and do not require edits to this file.
_sharedInternal must hold the same value across webserver.json, monitor.json, integrator.json and discovery_agent.json. A mismatch makes the Webserver’s Enable / Push Settings actions fail with a bcrypt error in the target component’s log. Restarting a component re-hashes its stored adminMNS password to match its config, so a stale value self-heals.

PDF reports (PdfBrowser)

Since 4.3.0 a report can be emailed as a PDF (see Language and format). The Webserver still builds the HTML report, then starts a headless Chrome, Chromium or Edge that opens it, waits for the charts to be drawn and prints it to A4 landscape. Nothing else needs to be installed: the browser is driven directly, without a driver.

Which browser is used. When PdfBrowser is set, that executable and no other. A path that does not exist is not replaced by another browser: the report falls back to HTML with the error PdfBrowser "<path>" in webserver.json does not exist. When PdfBrowser is empty or absent, the Webserver looks for:

OS Locations checked, in order
Windows Microsoft\Edge\Application\msedge.exe, then Google\Chrome\Application\chrome.exe, under %ProgramFiles(x86)%, %ProgramFiles% and %LocalAppData%
Linux /usr/bin/chromium, /usr/bin/chromium-browser, /usr/bin/google-chrome, /usr/bin/google-chrome-stable, /usr/bin/microsoft-edge, /snap/bin/chromium, /headless-shell/headless-shell
Both then chromium, chromium-browser, google-chrome, chrome, msedge, microsoft-edge on the PATH

Windows 10/11 and Windows Server 2022 or later ship with Edge, so PDF works there without any setting. On Linux, install a browser, for example:

# Debian / Ubuntu
sudo apt install chromium
# RHEL / Rocky / Alma (EPEL)
sudo dnf install chromium

Set PdfBrowser when the browser is elsewhere, or to pin one browser when several are installed:

{
  "HTTPS": "true",
  "PortAPI": "8050",
  "PortWEB": "9090",
  "RunUser": "mugnsoft",
  "_sharedInternal": "<same-value-on-every-component>",
  "PdfBrowser": "/opt/google/chrome/chrome"
}

On Windows, escape the backslashes: "PdfBrowser": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe". The setting is read at start-up, so restart the Webserver after changing it.

How it runs.

  • Each print uses a throwaway browser profile, deleted afterwards. Your browser profiles, cookies and extensions are never read.
  • Running as root (typical in a container), the browser is started with --no-sandbox, because Chrome refuses its sandbox as root. Run the service as a regular user (RunUser) to keep the sandbox.
  • At most two reports are printed at the same time; the others wait their turn. Allow 150–300 MB of memory per print.
  • A print that does not finish in time (60 s for the charts to be drawn, 2 minutes in all) is abandoned, and the report is sent as HTML.
  • No Internet access is needed. The report page asks for its libraries (Chart.js, UIkit, jQuery, moment…) from public CDNs; while printing, the Webserver answers those requests itself from the copies built into it, and refuses any other request. A Webserver on a closed network prints complete PDFs. For HTML reports read without Internet access, see Reports without Internet access.
  • A page whose chart library did not load is not printed as empty panels: the report is sent as HTML with the reason the report libraries did not load.

Docker. The mugnsoft/webserver image does not include a browser, so PDF reports fall back to HTML. To print PDFs, build an image from it that adds Chromium, and set PdfBrowser if it is not in one of the locations above.

Troubleshooting. When the PDF is missing, the send result shows PDF unavailable (reason) and the Webserver log has a sendReportEmail ... PDF not produced line with the cause:

Reason Fix
no Chrome, Chromium or Edge found on the webserver host Install one, or set PdfBrowser.
PdfBrowser "..." in webserver.json does not exist Correct the path and restart the Webserver.
waiting for function failed: timeout or context deadline exceeded The report page did not finish drawing in time (60 s for the charts, 2 minutes in all): check the host’s load.
the report libraries did not load The page’s chart library was missing. Should not happen with the built-in copies: send the Webserver log to support.
The browser exits at start (Linux) Missing shared libraries: install the distribution’s chromium package rather than a copied binary, which brings its dependencies.

Runtime Settings (via Web UI)

These settings are configured through the Settings page in the Web UI and stored encrypted in the embedded key-value store.

SMTP (Email)

Setting Description
SMTP Server Mail server hostname
SMTP Port Mail server port (25, 465, 587)
SMTP Username Authentication username
SMTP Password Authentication password
SMTP TLS Enable TLS encryption
Sender Email Email address for outgoing messages

Slack Integration

Setting Description
Slack Token Bot token for Slack API
Slack Channel Default channel for notifications

GitLab Integration

Setting Description
GitLab URL GitLab server URL
GitLab Token Personal access token
GitLab Project Project ID for monitor script import

LDAP Integration

Setting Description
LDAP Server LDAP/AD server hostname
LDAP Port Server port (389, 636)
LDAP Base DN Base distinguished name for searches
LDAP Bind DN Bind user distinguished name
LDAP Bind Password Bind user password
LDAP TLS Enable TLS

Logging

Setting Description Default
Log Level debug, info, warn, error info
Max Log Size Maximum log file size (MB) 10
Max Backups Number of rotated log files 5
Max Age Days to keep log files 28
Compress Logs Compress rotated files true

JWT Authentication Settings

These are compiled into the binary and cannot be changed via configuration:

Setting Value
Signing Algorithm RS256
User Token Lifetime 15 minutes
Component Token Lifetime 60 days (1440 hours)
Token Lookup header: Authorization, cookie: jwt
Token Header Bearer
Cookie Name jwt
Cookie HTTPOnly true
Cookie SameSite Lax

File Locations

File/Directory Purpose
webserver.json Service configuration
license_MNS.dat License file (required)
config/sec/mugnsoft_webserver.key RSA private key (JWT signing)
config/sec/mugnsoft_webserver.key.pub RSA public key (JWT verification)
config/ssl/certificates/ TLS certificates
config/ssl/private/ TLS private keys
dbs/webserver.db Main embedded key-value database
dbs/backup/ Automated backups
log/ Application logs

Translations