Production

Metaport in Production

Introduction

Metaport CE is the on-premise Metaprt solution. If you need a hands-off managed solution, then the SaaS is probably more appropriate.

On-Premise

Your infra options for on-premise Metaprt set-ups are as follows.

Dcentrica offers support plans tailored to your requirements. Get in touch to see what's on offer.

Option	Requirements	Notes
Docker	Docker-aware compute (Bare Metal, EC2 variants, SiteHost Cloud Containers, Digital Ocean Droplets) Metaport Docker image Nginx image Managed MariaDB/MySQL Valkey or DragonFly cache service Secrets Manager (Hashicorp Vault)	Example Dockerfile. (Path to mounted secrets manager set in MP_MASTER_KEY_PATH)
Standalone VM	Codebase PHP 8.3+ MariaDB/MySQL Nginx Valkey or DragonFly Hashicorp Vault	N/A
Kubernetes	Metaport Helm Chart	Planned

Procedure

Without Docker

Requirements:

• Composer v2+
• Git
• PHP v8.3+
• A recent version of MariaDB or MySQL
• Nginx or Apache Httpd configured with PHP
• Valkey or DragonFly configured with PHP
• Hashicorp Vault (or rely on the default global metaport.key)
• A means of injecting environment variables. See the full list here. (Use a .env file only if you have to)

Instructions:

• git clone https://gitlab.com/dcentrica/metaport/metaport-server/ metaport && cd metaport (pick a recent, tagged version)
• composer install
• Set the appropriate environment variables (Adapt this example .env.example file).
• ./bin/setup.sh

Troubleshooting:

• If you wish to omit composer's dev dependencies, run composer install --no-dev and delete the app/tests directory.
• See the Troubleshooting docs.

With Docker

Regardless of your selected on-premise hosting solution, there are some additional considerations:

The official Metaport Docker image only contains the Metaport application. You'll also need to run a webserver in front to access the application - we recommend Nginx. You can find a boilerplate nginx config in the .dev/services/www directory. You'll also need to configure team/org specific environment variables.

Metaport relies heavily on environment variables which are built into custom images using the Dockerfile ARG directive*. This can be done with stored secrets which are injected into the image when building your custom image within a CI pipeline.

* Note This is obviously not secure if you're likely to want to share the built image.

You can base your changes on this example Dockerfile which also bundles nginx, Valkey, and configures your Metaport server uniquely for your team.

"Deployment" is achieved in different ways, depending on the level of automation/orchestration available to you in your hosting provider. In general, the final - once-off - step is in initialising Metaport via a build script which does the following:

stop existing container ---> pull latest image ---> create volume(s) ---> start container ---> run setup.sh

Cron

Metaport relies on handful of automated, background tasks to be run for its custom policy feature, refreshing its product, EPSS, and KEV catalogues, as well as fetching reports sent to it by agents via the "Email" transport method. See agent docs).

See the top-level cron directory for drop-in crontab entries.

Tip

Setup Script The setup.sh script does two things:

1. Scaffolds Metaport's database schema.
2. Generates a new global encryption key (if the MP_VAULT_* environment variables aren't set).

Tip

Shared Volumes Depending on requirements, at least one F/S volume is required if you're using e.g. Let's Encrypt for SSL. Even though some host providers bundle an SSL offering into their services, you'll still need to bind-mount a volume on the host machine with the container running on it.

Tip

Example Configuration Files

See the example Dockerfile which combines Metaport Server with Nginx.
See the example nginx config file.
See the default .env.example file.

Port each variable as required into your pipeline config.

Tip

Master Key: In the absence of MP_VAULT_* environment variables, Metaport will default to a single shared encryption key. The lengths you go to secure this key are dependent on how sensitive your business considers its data and data-loss. If the key is lost, deleted or otherwise removed and cannot be recovered, a subset of team and application data cannot be used within Metaport. In this instance, data will need to be extracted, new keys generated manually and re-imported into Metaport's database. Metaport uses the paragonie/halite for PHP to package to manage encryption. We do recommend the use of a secrets manager. Hashicorp Vault is supported out-of-the-box. See the section on secrets for more.

Troubleshooting

Refer to the troubleshooting guide, submit an issue or join our community Slack.

SaaS

For a managed Metaport solution or an enterprise offering, Metaport SaaS is the way to go.