FDO

Stack

FDO

Configuration

Type

Compose

Platform

linux

Env vars

owner_api_user=''owner_api_password=''

Source

Repo

Template by portainer·Source

Services

pri-fdo-rv

Configuration

Image

portainer/pri-fidoiot:rv-master

Ports

8040:80408041:8041

Volumes

/home/fdo/target : rv-target

Env vars

rv_ssl_keystore-password=Sw2cqdcc1IMrv_port=8040rv_database_connection_url=jdbc:h2:tcp://localhost:8050/./target/data/rvsrv_database_username=sarv_database_password=rv_database_port=8050catalina_home=./target/tomcatrv_https_port=8041rv_protocol_scheme=httpsrv_ssl_keystore=certs/ssl.p12log4j_configuration_file=log4j2.xml

Image details

Pulls: 4k

User: yiportainer

Created: Jan 10, 2022

Updated: 4 years ago

Status: active

pri-fdo-owner

Configuration

Image

portainer/pri-fidoiot:owner-master

Ports

8042:80428043:8043

Volumes

/home/fdo/target : owner-target

Env vars

owner_keystore_password=JPmYuPdSYOG8U3aowner_api_password=${owner_api_password}owner_ssl_keystore-password=Sw2cqdcc1IMssl_truststore_password=Sw2cqdcc1IMowner_to2_port=8042owner_database_connection_url=jdbc:h2:tcp://localhost:8051/./target/data/opsowner_database_username=saowner_database_password=owner_database_port=8051catalina_home=./target/tomcatowner_keystore=./owner_keystore.p12owner_to0_scheduling_enabled=trueowner_to0_scheduling_interval=60owner_to0_rv_blob=http://localhost:8042?ipaddress=127.0.0.1owner_svi_values=./serviceinfo/sample-valuesowner_svi_string=./serviceinfo/sample-svi.csvowner_api_user=${owner_api_user}ondie_cache=file:///home/fdo/ondie_cache/ondie_autoupdate=falseondie_zip_artifact=https://tsci.intel.com/content/csme.zipondie_check_revocations=falseowner_protocol_scheme=httpsowner_https_port=8043owner_ssl_keystore=certs/ssl.p12ssl_truststore=certs/truststoressl_truststore_type=PKCS12fido_ssl_mode=TESTowner_pub_key_path=owner_pub_keys.pemowner2_pub_key_path=owner2_pub_keys.pemlog4j_configuration_file=log4j2.xml

Image details

Pulls: 4k

User: yiportainer

Created: Jan 10, 2022

Updated: 4 years ago

Status: active

pri-fdo-manufacturer

Configuration

Image

portainer/pri-fidoiot:manufacturer-master

Ports

8039:8039

Volumes

/home/fdo/target : manufacturer-target

Env vars

manufacturer_keystore_password=RabSIZz43lympm8zmanufacturer_api_password=05EV9CbHbAQANc1tmanufacturer_ssl_keystore-password=Sw2cqdcc1IMmanufacturer_di_port=8039manufacturer_database_connection_url=jdbc:h2:tcp://localhost:8049/./target/data/mfgmanufacturer_database_username=samanufacturer_database_password=manufacturer_database_port=8049catalina_home=./target/tomcatmanufacturer_api_user=apiUsermanufacturer_session_check_interval=60ondie_cache=file:///home/fdo/ondie_cache/ondie_autoupdate=falseondie_zip_artifact=https://tsci.intel.com/content/csme.zipondie_check_revocations=falsemanufacturer_protocol_scheme=httpsmanufacturer_https_port=8038manufacturer_keystore=manufacturer_keystore.p12manufacturer_ssl_keystore=certs/ssl.p12owner_pub_key_path=owner_pub_keys.pemreseller_pub_key_path=reseller_pub_keys.pemlog4j_configuration_file=log4j2.xml

Image details

Pulls: 4k

User: yiportainer

Created: Jan 10, 2022

Updated: 4 years ago

Status: active

Standalone Install

Select an install method, to see config/commands for deploying FDO

Installation method

Docker Run

Docker Compose

Install on Portainer

Import all app templates into your Portainer instance, for easy 1-click deploys

Ensure both Docker and Portainer are installed, and up-to-date
Log into your Portainer web UI
Under Settings → App Templates, paste the below URL
Head to Home → App Templates, and the list of apps will show up
Select FDO, fill in any config options, and hit Deploy

Template Import URL

https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json

Show Me

Original stackfile

The compose file this template deploys, straight from its repo:

version: "3.2"

services:
  pri-fdo-rv:
    image: portainer/pri-fidoiot:rv-master
    expose:
      - "8040"
    ports:
      - "8040:8040"
      - "8041:8041"
    environment:
      rv_ssl_keystore-password: Sw2cqdcc1IM
      rv_port: 8040
      rv_database_connection_url: jdbc:h2:tcp://localhost:8050/./target/data/rvs
      rv_database_username: sa
      rv_database_password: ""
      rv_database_port: 8050
      catalina_home: ./target/tomcat
      rv_https_port: 8041
      rv_protocol_scheme: https
      rv_ssl_keystore: certs/ssl.p12
      log4j_configuration_file: log4j2.xml
    volumes:
      - rv-target:/home/fdo/target
    network_mode: host

  pri-fdo-owner:
    image: portainer/pri-fidoiot:owner-master
    expose:
      - "8042"
    ports:
      - "8042:8042"
      - "8043:8043"
    environment:
      owner_keystore_password: JPmYuPdSYOG8U3a
      owner_api_password: ${owner_api_password}
      owner_ssl_keystore-password: Sw2cqdcc1IM
      ssl_truststore_password: Sw2cqdcc1IM
      owner_to2_port: 8042
      owner_database_connection_url: jdbc:h2:tcp://localhost:8051/./target/data/ops
      owner_database_username: sa
      owner_database_password: ""
      owner_database_port: 8051
      catalina_home: ./target/tomcat
      owner_keystore: ./owner_keystore.p12
      owner_to0_scheduling_enabled: "true"
      owner_to0_scheduling_interval: 60
      owner_to0_rv_blob: http://localhost:8042?ipaddress=127.0.0.1
      owner_svi_values: ./serviceinfo/sample-values
      owner_svi_string: ./serviceinfo/sample-svi.csv
      owner_api_user: ${owner_api_user}
      ondie_cache: file:///home/fdo/ondie_cache/
      ondie_autoupdate: "false"
      ondie_zip_artifact: https://tsci.intel.com/content/csme.zip
      ondie_check_revocations: "false"
      owner_protocol_scheme: https
      owner_https_port: 8043
      owner_ssl_keystore: certs/ssl.p12
      ssl_truststore: certs/truststore
      ssl_truststore_type: PKCS12
      fido_ssl_mode: TEST
      owner_pub_key_path: owner_pub_keys.pem
      owner2_pub_key_path: owner2_pub_keys.pem
      log4j_configuration_file: log4j2.xml
    volumes:
      - owner-target:/home/fdo/target
    network_mode: host

  pri-fdo-manufacturer:
    image: portainer/pri-fidoiot:manufacturer-master
    expose:
      - "8039"
    ports:
      - "8039:8039"
    environment:
      manufacturer_keystore_password: RabSIZz43lympm8z
      manufacturer_api_password: 05EV9CbHbAQANc1t
      manufacturer_ssl_keystore-password: Sw2cqdcc1IM
      manufacturer_di_port: 8039
      manufacturer_database_connection_url: jdbc:h2:tcp://localhost:8049/./target/data/mfg
      manufacturer_database_username: sa
      manufacturer_database_password: ""
      manufacturer_database_port: 8049
      catalina_home: ./target/tomcat
      manufacturer_api_user: apiUser
      manufacturer_session_check_interval: 60
      ondie_cache: file:///home/fdo/ondie_cache/
      ondie_autoupdate: "false"
      ondie_zip_artifact: https://tsci.intel.com/content/csme.zip
      ondie_check_revocations: "false"
      manufacturer_protocol_scheme: https
      manufacturer_https_port: 8038
      manufacturer_keystore: manufacturer_keystore.p12
      manufacturer_ssl_keystore: certs/ssl.p12
      owner_pub_key_path: owner_pub_keys.pem
      reseller_pub_key_path: reseller_pub_keys.pem
      log4j_configuration_file: log4j2.xml
    volumes:
      - manufacturer-target:/home/fdo/target
    network_mode: host

volumes:
  rv-target:
  owner-target:
  manufacturer-target:

Or deploy it directly from the source:

git clone https://github.com/portainer/templates
cd templates
docker compose -f stacks/fdo/docker-stack.yml up -d

More install options in our documentation.

Serve FDO on your own domain behind Caddy, Nginx or Traefik. Fill in your domain and copy the result. It's a starting point, some apps need their own base URL or extra headers set too.

Proxy Domain App port Upstream

Proxying fdo.example.com to http://pri-fdo-rv:8040

Add this to your Caddyfile

fdo.example.com {
	reverse_proxy http://pri-fdo-rv:8040
}

Check the logs first

Nine times out of ten the logs tell you exactly what went wrong.

In Portainer, go to Containers, click the container, then Logs. Or run docker logs <container>
Exit codes help too: 137 means killed, usually out of memory. 126 or 127 means the command inside the image is broken.

Port already in use

If deployment fails with "Bind for 0.0.0.0:8040 failed: port is already allocated", something else on your server is using that port.

Find what's using it: sudo ss -tlnp | grep :8040
Stop the other service, or pick a different host port. In 8040:8040 only the left number is yours to change, the right one belongs to the app.

Running but the page won't load

The container is up but nothing appears in your browser.

Use your server's real IP: http://your-server-ip:8040. The 0.0.0.0 link Portainer shows isn't a real address.
Give it a minute after first deploy, pri-fdo-rv can take a while to initialise.
Make sure your firewall allows the port, e.g. sudo ufw allow 8040

Image won't pull

Test the pull directly on the host: docker pull portainer/pri-fidoiot:rv-master

"manifest unknown" means the tag no longer exists.
"toomanyrequests" is the Docker Hub rate limit. Log in with docker login to raise it.
"no space left on device" means a full disk. Reclaim space with docker system prune

"exec format error"

This means the image was built for a different CPU architecture than your server.

Check yours with uname -m: x86_64 is amd64, aarch64 is arm64. Raspberry Pi and other ARM boards are the usual culprits.

Required settings are blank

rv_database_password, owner_database_password, manufacturer_database_password have no default value, and pri-fdo-rv may crash or misbehave if left empty.

Fill them in on the deploy screen before hitting deploy.

Stack won't deploy

Compose stacks fail fast on small mistakes, and Portainer shows the reason just above the editor.

YAML only accepts spaces for indentation, a single tab breaks the whole file.

Raise an issue

Found something which isn't working as it should? Here's how to report it.

Bug within the app: Open an issue within pri-fdo-rv's repo
Template not working: Open an issue on portainer/templates
This website not working: Open an issue on lissy93/portainer-templates

A Compose stack

FDO is a Compose stack, a set of containers (3 of them) defined in one file and brought up together by Portainer, then started and stopped as a single app.

The services

This stack is built from 3 containers that run side by side. Here's each one, with the image it runs and anything it waits for first:

pri-fdo-rv runs portainer/pri-fidoiot:rv-master
pri-fdo-owner runs portainer/pri-fidoiot:owner-master
pri-fdo-manufacturer runs portainer/pri-fidoiot:manufacturer-master

Ports

A port is the door the app answers on. A mapping like 8040:8040 means it's reachable on port 8040 of your server, where the left number is yours to change and the right one belongs to the app. It opens:

8040:8040
8041:8041
8042:8042
8043:8043
8039:8039

Volumes

A volume is where FDO keeps its files so they survive an update or a restart. Without one, anything it saves would sit inside the container and vanish the moment it's recreated. This template mounts:

/home/fdo/target kept in the rv-target volume Docker manages
/home/fdo/target kept in the owner-target volume Docker manages
/home/fdo/target kept in the manufacturer-target volume Docker manages

Environment variables

Environment variables are the settings you hand over when you deploy, things like a password or a timezone. FDO takes 54 of them, and 3 need a value before it'll start properly:

rv_ssl_keystore-password, defaults to Sw2cqdcc1IM
rv_port, defaults to 8040
rv_database_connection_url, defaults to jdbc:h2:tcp://localhost:8050/./target/data/rvs
rv_database_username, defaults to sa
rv_database_password, needs a value
rv_database_port, defaults to 8050
catalina_home, defaults to ./target/tomcat
rv_https_port, defaults to 8041
rv_protocol_scheme, defaults to https
rv_ssl_keystore, defaults to certs/ssl.p12
log4j_configuration_file, defaults to log4j2.xml
owner_keystore_password, defaults to JPmYuPdSYOG8U3a
owner_api_password, pulled from your own environment
owner_ssl_keystore-password, defaults to Sw2cqdcc1IM
ssl_truststore_password, defaults to Sw2cqdcc1IM
owner_to2_port, defaults to 8042
owner_database_connection_url, defaults to jdbc:h2:tcp://localhost:8051/./target/data/ops
owner_database_username, defaults to sa
owner_database_password, needs a value
owner_database_port, defaults to 8051
owner_keystore, defaults to ./owner_keystore.p12
owner_to0_scheduling_enabled, defaults to true
owner_to0_scheduling_interval, defaults to 60
owner_to0_rv_blob, defaults to http://localhost:8042?ipaddress=127.0.0.1
owner_svi_values, defaults to ./serviceinfo/sample-values
owner_svi_string, defaults to ./serviceinfo/sample-svi.csv
owner_api_user, pulled from your own environment
ondie_cache, defaults to file:///home/fdo/ondie_cache/
ondie_autoupdate, defaults to false
ondie_zip_artifact, defaults to https://tsci.intel.com/content/csme.zip
ondie_check_revocations, defaults to false
owner_protocol_scheme, defaults to https
owner_https_port, defaults to 8043
owner_ssl_keystore, defaults to certs/ssl.p12
ssl_truststore, defaults to certs/truststore
ssl_truststore_type, defaults to PKCS12
fido_ssl_mode, defaults to TEST
owner_pub_key_path, defaults to owner_pub_keys.pem
owner2_pub_key_path, defaults to owner2_pub_keys.pem
manufacturer_keystore_password, defaults to RabSIZz43lympm8z
manufacturer_api_password, defaults to 05EV9CbHbAQANc1t
manufacturer_ssl_keystore-password, defaults to Sw2cqdcc1IM
manufacturer_di_port, defaults to 8039
manufacturer_database_connection_url, defaults to jdbc:h2:tcp://localhost:8049/./target/data/mfg
manufacturer_database_username, defaults to sa
manufacturer_database_password, needs a value
manufacturer_database_port, defaults to 8049
manufacturer_api_user, defaults to apiUser
manufacturer_session_check_interval, defaults to 60
manufacturer_protocol_scheme, defaults to https
manufacturer_https_port, defaults to 8038
manufacturer_keystore, defaults to manufacturer_keystore.p12
manufacturer_ssl_keystore, defaults to certs/ssl.p12
reseller_pub_key_path, defaults to reseller_pub_keys.pem

Networking

Portainer puts these services on one shared private network, so they can find each other by name (like pri-fdo-rv) while only the ports above are open to you.

Platform

The platform is linux, the kind of system the container is built to run on. Docker and Portainer handle this on a normal Linux server.

Portainer app templates

Zooming out, this whole page comes from a Portainer app template: a short recipe telling Portainer how to set FDO up. Add the template list to Portainer once, then deploying FDO is a click rather than a wall of config.

FDO

Configuration

Services

pri-fdo-rv

Configuration

Image details

pri-fdo-owner

Configuration

Image details

pri-fdo-manufacturer

Configuration

Image details

Standalone Install

Install on Portainer

Template Import URL

Proxy configurator

Troubleshooting

Check the logs first

Port already in use

Running but the page won't load

Image won't pull

"exec format error"

Required settings are blank

Stack won't deploy

Raise an issue

Config glossary

A Compose stack

The services

Ports

Volumes

Environment variables

Networking

Platform

Portainer app templates