如何在Docker中部署WSO2 API Manager(wso2am)至远程服务器及配置？

1. 主机名与端口配置 #

• 修改[server]块下的hostname为远程服务器的公网IP或域名，替换默认的localhost，确保外部能正常访问：

  [server]
  hostname = "your-server-ip-or-domain"
  

• 若服务器有端口限制，调整HTTP/HTTPS服务的端口绑定（需确保端口在远程服务器已开放防火墙规则）：

  [transport.http]
  port = 8280
  
  [transport.https]
  port = 8243
  

2. 数据库连接配置 #

注意：远程部署必须切换到生产级数据库（如MySQL、PostgreSQL），禁止使用默认的内嵌H2数据库，避免数据丢失风险

• 以MySQL为例，修改apim_db和shared_db的数据库连接配置：

  [database.apim_db]
  type = "mysql"
  url = "jdbc:mysql://your-db-host:3306/APIM_DB?useSSL=false&requireSSL=false"
  username = "your-db-username"
  password = "your-db-password"
  driver = "com.mysql.cj.jdbc.Driver"
  
  [database.shared_db]
  type = "mysql"
  url = "jdbc:mysql://your-db-host:3306/SHARED_DB?useSSL=false&requireSSL=false"
  username = "your-db-username"
  password = "your-db-password"
  driver = "com.mysql.cj.jdbc.Driver"
  

3. 网关与API访问配置 #

• 调整网关环境的服务地址，指向远程服务器的实际域名/IP：

  [[apim.gateway.environment]]
  name = "Production"
  type = "production"
  service_url = "https://your-server-ip-or-domain:8243/services/"
  ws_service_url = "wss://your-server-ip-or-domain:8291/services/"
  

• 确保密钥管理器的服务地址正确配置，避免API密钥验证失败：

  [apim.key_manager]
  service_url = "https://your-server-ip-or-domain:9443/services/"
  

4. 身份认证与会话配置 #

• 修改会话域名和Cookie域名，适配远程服务器的访问域名：

  [identity.auth.session]
  domain = "your-server-domain"
  cookie_domain = ".your-server-domain" # 若存在多子域名，使用通配符格式
  

• 若使用外部身份提供者（如LDAP），更新user_store配置确保远程服务器能连接到身份源：

  [user_store]
  type = "ldap"
  connection_url = "ldap://your-ldap-host:389"
  user_search_base = "ou=Users,dc=example,dc=com"
  username = "ldap-admin-user"
  password = "ldap-admin-password"
  

5. 安全与证书配置 #

• 替换默认的SSL证书为远程服务器的有效证书，避免浏览器或客户端的安全告警：

  [keystore.primary]
  file_name = "${carbon.home}/repository/resources/security/your-custom-keystore.jks"
  password = "your-keystore-password"
  alias = "your-certificate-alias"
  key_password = "your-key-password"
  
  [truststore]
  file_name = "${carbon.home}/repository/resources/security/your-custom-truststore.jks"
  password = "your-truststore-password"
  

6. 日志路径配置（可选） #

• 确保日志输出目录在远程服务器有足够的写入权限，可调整日志文件路径：

  [logging]
  appenders = ["CONSOLE", "FILE"]
  log_file = "${carbon.home}/repository/logs/wso2carbon.log"
  

内容的提问来源于stack exchange，提问作者Prabin Ojha