Configuring your Commerce+ environment using Vault

You can use Vault for secure and dynamic configuration management of your Commerce+ deployment.

HCL Commerce+ requires a robust and secure mechanism for managing configuration data, such as database credentials, API keys, and other sensitive information. Vault is an ideal tool to achieve these goals. Using Vault to manage Commerce+ enhances security, flexibility, and operational efficiency.

Vault
Vault is a secure tool for storing and managing sensitive key-value pairs, such as database credentials, API keys, and other configuration details. It provides a secure and dynamic way to supply configuration data to Docker containers during startup, enhancing security and flexibility by avoiding hardcoded values.
Purpose

The purpose of using Vault for environment data is to:

  • Secure Sensitive Data: Prevent unauthorized access to sensitive configuration information.
  • Enable Dynamic Configuration: Fetch environment-specific data during container startup.
  • Improve Scalability and Consistency: Provide a centralized method for managing configuration data across multiple environments.
Without Vault, sensitive data must be embedded in the Docker container or provided through less secure mechanisms, increasing the risk of data security. Using Vault ensures:
  1. Centralized Management: Secrets are stored in one place, making them easier to update and manage.
  2. Role-Based Access Control: Access can be limited to specific users or services.
  3. Flexibility Across Environments: Different data can be fetched for production and non-production environments.

Configuring Vault for the Commerce+

  1. Set Configuration Mode: To enable Vault-based configuration, set the CONFIGURE_MODE parameter to Vault. This instructs the startup scripts to fetch environment-related data from Vault during Docker container initialization.
  2. Organize Data in Vault.
    Structure the data in using the following hierarchy:
    • Tenant: Represents your company, (For example, MyCompany).
    • Environment Name: Represents the deployment stage, (For example, Non-production).
    • Environment Type: Represents the specific service or role, (For example, auth).
  3. Storing key-value pairs in Vault.

    To store key-value pairs, follow these steps:

    1. Create a Mount Point: Mount points act as logical namespaces for secrets.
      curl -X POST -H "X-Vault-Token:vaultToken" \
     -H "Content-Type:application/json" \
     -d '{"type":"generic","description":"description","config":{"max_lease_ttl":"876000"}}' \ 
http://VaultIP:VaultPort/v1/sys/mounts/tenant
      For example, 
      curl -X POST -H "X-Vault-Token:7f47efbb" \
     -H "Content-Type:application/json" \
     -d '{"type":"generic","description":"Tenant mount point","config":{"max_lease_ttl":"876000"}}' \ 
http://127.0.0.1:8200/v1/sys/mounts/MyCompany
    2. Store Key-Value Data.

      Use the following command to store secrets: 

      curl -X POST -H "X-Vault-Token:vaultToken" \
     -d '{"value":"value"}' \ 
http://Vaultip:VaultPort/v1/tenant/environmentName/environmentType/targetKey
      For example, 
      curl -X POST -H "X-Vault-Token:7f47efbb" \ 
     -d '{"value":"mall"}' \ 
http://myhostname.com:8200/v1/MyCompany/Non-production/auth/dbName
  4. Retrieve Key-Value Pairs from Vault.

    Retrieve stored secrets with the following command:

    curl -X GET -H "X-Vault-Token:vaultToken" \
     http://VaultIP:VaultPort/v1/tenant/environmentName/environmentType/targetKey | jq -r .data.value
    For example, 
    curl -X GET -H "X-Vault-Token:7f47efbb" \
     http://127.0.0.1:8200/v1/MyCompany/Non-production/auth/dbName | jq -r .data.value

Key-value data structure in Vault

Note:
  • This document provides a general overview of using Vault with the Commerce+.
  • Specific implementation details and configurations may vary depending on your environment and requirements.
  • Always refer to the official Vault documentation for the latest information and best practices.
Default Key-Value Paths

Name, port, security scheme, and certificate configurations

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/domainName Optional

Specify the internal service domain name. If the deployed environment is on a special namespace on Kubernetes, then the domain name should be .svc.cluster.local.

If no value is specified, then the default,

default.svc.cluster.local, is used.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/externalDomainName Optional

This value specifies the store-web external domain name,

which can be recognized by your browser.

For example, in the hostname store.demo4qaauth.hcl.com,

hcl.com is the external domain name.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/storeDomainMapping Mandatory

This value specifies the store name to domain name mapping. Using this value can map one store to multiple domain names.

The format that is used is sitename=domainname;sitename=domainname; ....

For example, 
AuroraESite=www.mycompany.com;AuroraESite=www.mycompany1.com;AuroraB2BESite=www.mycompany.b2b.com;
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/zookeeperHost Mandatory

Specify a value if you want to set a zookeeperHost value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/zookeeperPort Optional

Specify a value if you want to set a zookeeperPort value, instead of using the default value.

The default value is 2181.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/zookeeperScheme Optional

Specify a value if you want to set a zookeeperScheme value, instead of using the default value.

The default value is http.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/redisHost Mandatory Specify the Redis hostname that NiFi will connect to for event messages.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/redisPort Optional Specify the Redis port number that NiFi will connect to for event messages.

The default value is 6379.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/redisPasswordEncrypt Optional The encrypted Redis server password.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/txHost Optional Specify a value if you want to set txHost, instead of using the default value ${TENANT}${ENVIRONMENT}${ENVTYPE}ts-app.${DOMAIN_NAME}.
Note: This value is used for all containers other than the Transaction server Docker container. To set the value for the Transaction server Docker container, use the txnHost value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/txPort Optional Specify a value if you want to set txPort, instead of using the default value 5443.
Note: This value is used for all containers other than the Transaction server Docker container. To set the value for the Transaction server Docker container, use the txnPort value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/xcHost Optional Specify a value if you want to set a host name for the Customization server, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/xcPort Optional Specify a value if you want to set a port number for the Customization server, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/reactStoreHost Optional Specify a value if you want to set reactStoreHost, instead of using the default value.

The default value:

www.${TENANT}${ENVIRONMENT}${ENVTYPE}${EXTERNAL_DOMAIN_NAME}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/reactStorePort Optional Specify a value if you want to set reactStorePort, instead of using the default value.

The default value is 443.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/reactStoreServiceHost Optional Specify a value if you want to set reactStoreServiceHost, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/reactStoreServicePort Optional Specify a value if you want to set reactStoreServicePort, instead of using the default value.

The default value is 443.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/reactStorePreviewHost Optional Specify a value if you want to set reactStorePreviewHost, instead of using the default value.

The default value is store-preview.${TENANT}${ENVIRONMENT}${ENVTYPE}${EXTERNAL_DOMAIN_NAME}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/reactStorePreviewPort Optional Specify a value if you want to set reactStorePreviewPort, instead of using the default value.

The default value is 443.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/queryHost Optional The Search server host name for the Elastic-based search solution. Specify a value if you want to set queryHost, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/queryPort Optional The Search server port number for the Elastic-based search solution. Specify a value if you want to set queryPort, instead of using the default value.

The default value is 30901.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/queryScheme Mandatory The Search server scheme for the Elastic-based search solution. Specify a value if you want to set queryScheme, instead of using the default value.

The default value is https.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiHost Optional Specify a value if you want to set a nifiHost value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiPort Optional Specify a value if you want to set a nifiPort value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiScheme Optional Specify a value if you want to set a nifiScheme value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiWebHttpPort Optional Specify a value if you want to set a nifiWebHttpPort value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/registryHost Optional Specify a value if you want to set a registryHost value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/registryPort Optional Specify a value if you want to set a registryPort value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/registryScheme Optional Specify a value if you want to set a registryScheme value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/queryHost Optional Specify a value if you want to set a queryHost value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/queryPort Optional Specify a value if you want to set a queryPort value, instead of using the default value 443.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/queryScheme Optional Specify a value to set a queryScheme value, the default value https.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/ingestHost Optional Specify a value if you want to set an ingestHost value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/ingestPort Mandatory Specify a value if you want to set an ingestPort value, instead of using the default value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/ingestScheme Mandatory Specify a value if you want to set an ingestScheme value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/elasticSearchHost Mandatory Specify an elasticSearchHost value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/elasticSearchPort Mandatory The elasticSearchPort value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/elasticSearchScheme Mandatory The elasticSearchScheme value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/toolingBaseUrl Mandatory This value is used by Commerce Lab to load tooling single page application (SPA) from the tooling web server.

https://tooling-web-host:port/path-to-tooling-spa
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/certs/CertName Optional Specify third-party certificate records.
demo2/qa/certs/demo2qa-test={‘certificate’: ‘asdfadsfadsfads’, 
‘destination_host’: ‘adsfadsf’, ‘issuing_ca’: ‘fadsfadsfads’, ‘keystorepass’: 
‘adsfadsfads’, ‘private_key’: ‘adsfadsfasd’}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/certsBundle Optional Specify third-party certificate records.
demo2/qa/certsBundle={‘crsapp’: ‘demo2qa-testky’, 
‘searchapp’: ‘demo2qa-test’, ‘storeapp’: ‘’, ‘tsapp’: ‘demo2qa-test’, 
‘tsweb’: ‘’, ‘xcapp’: ‘’}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/allowedHost Mandatory Specify white-listed host names for an associated module name. Host names are delineated by a comma, modules are delineated by a semi-colon.

Stores:host1.domain.com,host2.domain.com;LoBTools:host3.domain2.com,host4.domain2.com
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/allowedDomain Mandatory Specify white-listed domain names for an associated module name. Domain names are delineated by a comma, modules are delineated by a semi-colon.

Stores:domain1.com,domain2.com;LoBTools:domain3.com,domain4.com
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/authJWKS Mandatory Specify a value to set the JSON Web Key Set (JWKS) and key ID on the Transaction server. This is used to sign and validate the JSON Web Token (JWT).

To generate a JWKS, see the Generate JWKS utility.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/spiUserName Optional The spiuser user name.

If the value is not defined, then spiuser is used.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/spiUserPwd Mandatory The ASCII encrypted spiuser user password.

To set the password in your custom Docker containers, see Configuring the spiuser password for Commerce+ Kubernetes Deployment.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/adminSpiUserPwd Mandatory The plain text spiuser user password.

The ADMIN_SPIUSER_PWD must be the same value as SPIUSER_PWD but kept as plain text.

To set the password in your custom Docker containers, see Configuring the spiuser password for Commerce+ Kubernetes Deployment.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/merchantKeyEncrypted Mandatory The encrypted merchant key, encrypted with the key encryption key. The merchant key was created when you or an administrator loaded the Commerce+ database schema.
For more information, see:
Important: You must specify your own merchant key and key encryption key values for the security of your Commerce+ installation. Do not use the default values contained within the provided sample configuration files and documentation examples.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/keyEncryptionKey Optional The plain text key that is used to encrypt the merchant key. The key encryption key is required to be 32 characters.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/sessionKeyEncrypt Mandatory

The encrypted session key value is generated using wcs_encrypt.sh utility to encrypt 32 random hexadecimal characters.

Note: Do not specify an encryption key when running wcs_encrypt.sh.

The Session key is used to encrypt cookies and sensitive customer facing data. For example, the krypto URL parameter.

Important: You must specify your own session key for the security of your Commerce+ installation. Do not use the default values contained within the provided sample configuration files and documentation examples.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/xmlParserFeatureList Mandatory Specify XML parser feature list.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/xmlParserWhiteListDomains Mandatory Specify XML parser white list domain.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/xmlParserWhiteListSchemes Mandatory Specify XML parser white list schemes.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/xmlPraserLocalEntityEnabled Mandatory Specify if XML parser local entity is enabled.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/xmlParserSanitizationEnabled Mandatory Specify if XML parser sanitization is enabled.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/gaServiceAccount Mandatory Google Analytics service account.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/adminPassword Mandatory The password for user configadmin, which is used to access the Open Liberty Server Administrative Console.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/verifyHostName Optional This value specifies hostname verification on SSL configuration.

The default value is true.

Database configurations

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/jdbcUrl Optional Specify the database connection URL.

The URL is constructed based on the database type and whether or not SSL is enabled.

Postgres
  • With SSL: 
    {ENVTYPE}_JDBC_URL="jdbc:postgresql://"${ENVTYPE}_DBHOST}":"${ENVTYPE}_DBPORT}"/
"${ENVTYPE}_DBNAME}"?ssl=true&sslmode=verify-ca&sslfactory=org.postgresql.ssl.DefaultJavaSSLFactory"
  • Without SSL
    {ENVTYPE}_JDBC_URL="jdbc:postgresql://"${ENVTYPE}_DBHOST}":"${ENVTYPE}_DBPORT}"/
"${ENVTYPE}_DBNAME}"
DB2
  • With SSL: 
    {ENVTYPE}_JDBC_URL="jdbc:db2://${ENVTYPE}_DBHOST}:{ENVTYPE}_DBPORT/
{ENVTYPE}_DBNAME}:sslConnection=true;"
  • Without SSL: 
    {ENVTYPE}_JDBC_URL="jdbc:db2://${ENVTYPE}_DBHOST}:{ENVTYPE}_DBPORT/
{ENVTYPE}_DBNAME}
Oracle
  • With SSL: 
    {ENVTYPE}_JDBC_URL="jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)
(HOST="${ENVTYPE}_DBHOST}")(PORT="${ENVTYPE}_DBPORT}"))(CONNECT_DATA=(SERVICE_NAME="${ENVTYPE_DBNAME}")))"
  • Without SSL
    {ENVTYPE}_JDBC_URL="jdbc:oracle:thin:@"${ENVTYPE}_DBHOST":"${ENVTYPE}_DBPORT}"/
"${ENVTYPE}_DBNAME}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/jdbcDriver Optional Specify a value if you want to change the default database driver location for NiFi.
The default values are:
  • Postgres: /opt/nifi/nifi-current/lib/postgresql.jar
  • DB2: /opt/nifi/nifi-current/lib/db2jcc4.jar
  • Oracle: /opt/nifi/nifi-current/lib/ojdbc8.jar
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/jdbcDriverClass Optional Specify a value if you want to change the default database driver class for NiFi.
The default values are:
  • Postgres: org.postgresql.Driver
  • DB2: com.ibm.db2.jcc.DB2Driver
  • Oracle: oracle.jdbc.driver.OracleDriver
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbSSLEnable Mandatory Specify whether the database connection uses SSL.
Accepted values are:
  • true for an SSL connection.
  • false for an unencrypted connection.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbHost Mandatory The database host name for the environment.
Note: The dbHost name corresponds to the database host for the respective service.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbName Mandatory The database name.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbPort Mandatory The database port number.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbUser Mandatory The Commerce+ database user name.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbPassword Mandatory The Commerce+ database user password.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbPassEncrypt Mandatory The encrypted Commerce+ database user password.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbaUser Mandatory The database administrator user name.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbaPassEncrypt Mandatory The encrypted database administrator user password.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbType Mandatory The database type.
Accepted values are:
  • postgres for PostgreSQL Database.
  • db2 for IBM Db2 database.
  • oracle for Oracle database.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbSchema Optional The database schema.

By default, the database schema is set to DBUSER.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/dbXA Optional Specify if the XA function is enabled for the database.
Accepted values are:
  • true for enabled.
  • false for disabled.
The default value is false.
Note: You can also specify datasource credentials through the start up command if you do not want to retrieve the datasource values from Vault.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/WCPublishDataSource/maxIdleTime Optional Amount of time a connection can be unused or idle.

A value of -1 disables this timeout.

Default value 30m.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/WCPublishDataSource/maxPoolSize Optional Maximum number of physical connections for a pool.

A value of 0 means unlimited.

Default value 50.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/WCPublishDataSource/minPoolSize Optional Minimum number of physical connections to maintain in the pool.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/WCDataSource/maxIdleTime Optional Amount of time a connection can be unused or idle.

A value of -1 disables this timeout.

Default value 30m.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/WCDataSource/maxPoolSize Optional Maximum number of physical connections for a pool.

A value of 0 means unlimited.

Default value 50
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/WCDataSource/minPoolSize Optional Minimum number of physical connections to maintain in the pool.

Solr Search Configurations

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/searchOrchestrationBaseUrl Mandatory Specify the base URL for the Solr search orchestration service.

The Transaction Server uses this URL to communicate with the Solr orchestration application for search index management operations.

Format: https://orchestration-hostname:port
Examples:
  • Auth: https://orchestration-{tenant}{env}auth.{externalDomain}
  • Live:https://orchestration-{tenant}{env}live.{externalDomain}
Note: Configure this property only for Solr environments. Do not configure it for Elasticsearch environments.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/searchQueryBaseUrl Optional Specify the base URL for the Solr search gateway.

Specify the Solr search gateway domain instead of the Elasticsearch query service.

Format: https://search-hostname

Example:
  • Auth: https://search-{tenant}{env}auth.{externalDomain}
Note: This property is required only for Solr authoring (auth) environments. Live environments use search-app-slave or search-app-repeater directly.

ES Search configuration

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/elasticSearchEnabled Mandatory Specify whether the environment uses the Commerce Search-based search.
Accepted values are:
  • true for the Elasticsearch-based search.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/searchQueryBaseUrl Mandatory The search query base URL.

The format of the Search Query base URL is https://query-domain:port.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/searchDataQueryBaseUrl Mandatory Specify the Search Data Query server to be used by Tooling.

The format of the Search Data Query base URL is https://data-query-domain:port.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/queryScanPackages Optional Specify an additional comma separated list of Java package names that the Query service should scan for processing.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/enableFeatureNlp Optional Specify a value if you want to set the natural language processing feature.
Note: This feature requires the elastic based search solution.
Accepted values are:
  • true to enable natural language processing in search queries.
  • false to expressly disable natural language processing in search queries.
Note: NLP is now specified using nlpEnableLanguageCode.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nlpEnableLanguageCode Mandatory The language code for the Natural Language Processing (NLP) feature. Specify a comma separated list of language codes for natural language processing. For example, en,es. In this example, NLP is enabled for both English and Spanish.
  • You must specify a value if you want to enable NLP. If you do not set this value, or leave it empty, NLP remains disabled.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nlpLemmatizationFeature Mandatory Specify whether or not to enable the lemmatization feature for natural language processing.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiClusterIsNode Optional Specify whether the NiFi installation is a standalone installation.
Accepted values are:
  • true for a node in a NiFi cluster.
  • false for standalone installation.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiClusterNodeProtocalPort Optional Specify a value for the NiFi cluster node port. The default value is 8082.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiElectionMaxWait Optional Specify a value if you want to if you want to set the maximum wait time for the NiFi election node service.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiJvmHeapInit Optional Specify a value if you want to set a nifiJvmHeapInit value, instead of using the default value 4096m.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nifiJvmHeapMax Optional Specify a value for the maximum JVM heap size for NiFi. The default value is 4096m.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/elasticSearchShardCount Optional Specify the number of shards to store the indexes for that environment, within the service. The default value is 1.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/elasticSearchReplicaCount Optional Specify the number of replicas for indexes for that environment, within the service. The default value is 0.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/autoUpdatePipeVersion Optional Specify whether to automatically update the Ingest server pipe version.
  • If set to true, then automatic upgrades to the latest version in the registry will occur during an Ingest restart, reverting all local changes.
  • If set to false, then no automatic upgrades will take place. You can still use Ingest APIs to reset and upgrade any pipe.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/search-registry-app/schedulerWaitSeconds Optional

The registry service scheduler job run interval, in seconds.

The default value is 300 seconds (5 minutes).

The NiFi Registry container is now run as a non-root user. However, the cron job that is used to run the scheduler is required to run as the root user. Therefore, this mechanism is introduced to run scheduled_job.sh. You can check the log at the following path, /SETUP/scheduler/job.log.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/indexingModel Optional The indexing model for the NiFi server is optional. By default, it is set to empty. The following options are available:
  • empty: It is applied for both CAS and eSite indexing models.
  • CAS: Uses the CAS indexing model.
  • eSite: Uses the eSite indexing model.
    Note: Ensure that the wc.search.CASIndexModel value for store 0 in the storeconf table is set correctly based on the indexing model.
  • If the indexing model is empty: Both esite and cas Ingest Connectors will be created in NiFi. In this case, wc.search.CASIndexModel for store 0 can be set to either true or false.
  • If the indexing model is set to esite: Only esite Ingest Connectors will be created in NiFi. The wc.search.CASIndexModel for store 0 must be set to false (default). If set to true, the build index will fail because cas Ingest Connectors are not created.
  • If the indexing model is set to cas: Only cas Ingest Connectors will be created in NiFi. The wc.search.CASIndexModel for store 0 must be set to true (default). If set to false, the build index will fail because esite Ingest Connectors are not created.

Tooling configuration

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/toolingRoot Optional The Tooling root value which is used by Commerce Lab to load tooling SPA from the tooling web server.

If toolingRoot is not specified, will use toolingOrigin.

For example, TOOLING_ROOT="${TOOLING_ORIGIN}/tooling
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/toolingOrigin Mandatory The Tooling Origin value. This is only used when TOOLING_ROOT is null.

For example, tooling.demoqa.mycompany.com.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/txToolingPort Mandatory The transaction tooling port for jwt authentication check.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/allowTelemetry Mandatory

This information assists HCL in the development of new features and the enhancement of existing business user tools.

Accepted values are:
  • yes, to enable Google Analytics.
  • no, to disable Google Analytics.

The default value is yes.

If enabled, the deploymentType parameter is required to be specified.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/deploymentType Mandatory The deployment type.

This value is required when allowTelemetry value is yes, but is ignored if the allowTelemetry value is set to no.

Accepted values are:
  • development
  • staging
  • production
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/reactStoreBaseUrl Optional The auth React store base URL.

If left blank, it will fall back to the following value:

https://AUTHREACTSTOREHOST:AUTHR AUTH_REACT_STORE_HOST:{AUTH_REACT_STORE_PORT}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/transactionBaseUrl Optional The auth transaction base URL.

The default: https://${AUTH_TRANSACTION_HOST}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/transactionHost Optional The auth transaction host.

If left blank, it will fall back to the following value:

cmc.${TENANT}${ENVIRONMENT}auth.${EXTERNAL_DOMAIN_NAME}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/live/transactionHost Optional The live transaction host.

If left blank, it will fall back to the following value:

cmc.${TENANT}${ENVIRONMENT}live.${EXTERNAL_DOMAIN_NAME}

${VAULT_URL}/${TENANT}/${ENVIRONMENT}${ENVTYPE}/transactionPort Optional Specify the transaction port.

The default value is 5443.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}${ENVTYPE}/transactionWebHost Optional

Specify the transaction web host.

If left blank or not specified, it will fall back to the following value:

${TENANT}${ENVIRONMENT}${ENVTYPE}ts−web.{DOMAIN_NAME}

${VAULT_URL}/${TENANT}/${ENVIRONMENT}${ENVTYPE}/transactionWebPort Optional

Specify the transaction web port.

The default value is 8000.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/toolingCommonDomainName
Note: This Vault key is a mandatory Vault configuration if the tooling web is being deployed on the cloud using the tooling bootstrap Docker image.
 Optional This key specifies the URL of the cloud-based Tooling Common deployment. For example: tooling-common.prd.hclcommercecloud.com
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/toolingCommonPort Optional The tooling common port.

The default value is 443.
${TENANT}/${ENVIRONMENT}/tooling-web/extraContentSecurityPolicySource Optional The extra content security policy source.

Store, order, and inventory configuration

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/store-web/extraContentSecurityPolicySource Optional

Specify additional host names for the Content Security Policy (CSP) for the store-web container. The format of these values must conform to the Content Security Policy source list standard.

Failure to correctly specify CSP values will trigger Cross-Site Scripting (XSS) protection in browsers. This means that third-party analytics, images, style sheets, or other scripts hosted on a secondary or third-party domain will fail to load, causing some features of your site to malfunction or fail gracefully.

The default values provided by Commerce+ include your domain (EXTERNAL_DOMAIN_NAME), as well as analytics and file hosting from Google. Additional hostnames specified via this variable apply to the following CSP directives:

  • frame-ancestors
  • frame-src
  • default-src
  • child-src
  • script-src
  • connect-src
  • style-src
  • font-src
  • img-src
definitions.

For example: *.seconddomain.comor*.seconddomain.com *.thirdpartydomain.com
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/ts-web/extraContentSecurityPolicySource Optional

Specify additional host names for the Content Security Policy (CSP) for the ts-web container. The format of these values must conform to the Content Security Policy source list standard.

Failure to correctly specify CSP values will trigger Cross-Site Scripting (XSS) protection in browsers. This means that third-party analytics, images, style sheets, or other scripts hosted on a secondary or third-party domain will fail to load, causing some features of your site to malfunction or fail gracefully.

The default values provided by Commerce+ include your domain (EXTERNAL_DOMAIN_NAME), as well as analytics and file hosting from Google. Additional hostnames specified via this variable apply to the following CSP directives:

  • frame-ancestors
  • frame-src
  • default-src
  • child-src
  • script-src
  • connect-src
  • style-src
  • font-src
  • img-src
definitions.

For example: *.seconddomain.comor*.seconddomain.com *.thirdpartydomain.com
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/autoOrderCommentEventListenerEnabled Mandatory Enable or disable the auto order comment event listener.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/useSemiColonForMarketplaceCSVDelimiter Optional Enable or disable the use of a semi-colon ';' as the Marketplace CSV file delimiter.

By default this value is set to false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/inventoryShowActualQuantity Mandatory

In a non-ATP inventory system with the noCheck

parameter set for a catentry inventory (a value of 2 in the database), the API returns 1.0 as the quantity.

To show the actual quantity, set this value to true.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/adminUser Mandatory The Administrator user.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/adminPassowrd Mandatory The Administrator password.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/ toolingOrigin Mandatory The tooling origin url.

For example, https://tooling.demoqa.mycompany.com
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/reactStoreOrigin Optional The authoring react store origin.

If AUTH_STORE_ORIGIN is null or not specified.

The default: https://${AUTH_REACT_STORE_HOST}:${AUTH_REACT_STORE_PORT}

${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/reactStoreHost Optional The authoring react store host.

If AUTH_STORE_ORIGIN is null or not specified.

The default: www.${TENANT}${ENVIRONMENT}auth${EXTERNAL_DOMAIN_NAME}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/reactStorePort Optional The authoring react store port.

If AUTH_STORE_ORIGIN is null or not specified.

The default value is 443.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/live/reactStoreOrigin Optional The live store origin.

If LIVE_STORE_ORIGIN is null or not specified.

The default: https://${LIVE_REACT_STORE_HOST}:${LIVE_REACT_STORE_PORT}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/live/reactStoreHost Optional The live react store host.

If LIVE_STORE_ORIGIN is nullor not specified.

The default: www.${TENANT}${ENVIRONMENT}live${EXTERNAL_DOMAIN_NAME}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/live/reactStorePort Optional The live react store port.

If LIVE_STORE_ORIGIN is null or not specified.

The default value is 443.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/reactStorePreviewHost Optional

The React store preview base URL.

If left blank, it will fall back to the following value:

https://${REACT_STORE_PREVIEW_HOST}:${REACT_STORE_PREVIEW_PORT}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/auth/reactStorePreviewPort Optional

The React store preview port.

The default value is 443.

Ruby storefront configuration

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nodeInstanceNumber/nextjs-app Optional Defines the maximum number of concurrent Node processes that can be run by the Node.js cluster API.
Note: The value that is specified in Vault takes precedence over other configuration methods.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/reactStoreMapApiKey Mandatory The Google Maps API key that is used by the React store.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/logLevel/nextjs-app Optional The log level used for troubleshooting purposes.
Available log levels are:
  • trace
  • debug
  • info
  • warn
  • error
  • fatal
Note:
  • When configured as trace, all messages are displayed.
  • When configured as debug, all messages are displayed except those tagged as trace.
  • When configured as info, all messages at levels info through fatal are displayed.
By default, server-side API client log messages are displayed at level:
  • info
  • trace
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/logSensorString/nextjs-app Optional

Defines the masking string that is used in logs to mask sensitive information, for example, messages with GDPR-related content. The set of values to mask are identified by their keys in the logging/core/redactionKeys.ts configuration file. For more information, see Redaction. The default value given in the template is **GDPR COMPLIANT**. If the value is empty, or not set, then the censor string that is used is ****.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/traceSpecification/nextjs-app Optional

If you want to change the trace specification for the Next.js server, specify a value.

${VAULT_URL}/${TENANT}/${ENVIRONMENT}/storeConfigurationFile/nextjs-app Mandatory Specify the store configuration file for the Next.js application.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/startupArgument/nextjs-app Mandatory Specify the startup arguments for the Next.js application.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/nodeInstanceNumber/nextjs-app Mandatory Specify the node instance number for the Next.js application.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/inventoryOrigin Mandatory

Specify the inventory origin if inventory is enabled.

CRS (Aurora Storefront) configurations

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/storeDomainMapping Mandatory

Must include both the React storefront domain (www- prefix) and CRS domain (store- prefix) for each store.

Example:AuroraESite=store-{tenant}{env}auth.{externalDomain};EmeraldSite=www-{tenant}{env}auth.{externalDomain};

Ensures each storefront resolves to the correct ingress/gateway route.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/allowedHost Mandatory Whitelist must include the CRS hostname in addition to React storefront and tooling hostnames.

Example: Stores:www-{tenant}{env}auth.{externalDomain},store-{tenant}{env}auth.{externalDomain};LoBTools:cmc-{tenant}{env}auth.{externalDomain}
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/allowedDomain Mandatory Ensure the external domain covers both www- and store- hostnames.

Example: Stores:{externalDomain};LoBTools:{externalDomain}

Logging and health configuration

Vault path Requirement Description
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/enableJsonLogging Mandatory Enable JSON logging.
Accepted values are
  • true to enable JSON logging.
  • false to disable JSON logging.

The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/jdbcMonitorEnable/ts-app Optional Specify whether to enable the JDBC monitor.
Accepted values are:
  • true to enable the JDBC monitor.
  • false for disable the JDBC monitor.

The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/healthCenterEnable/ts-app Optional Specify a value if you want to enable Health Center.
Accepted values are:
  • true for enabling Health Center.
  • false for not enabling Heather Center.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/healthCenterEnable/xc-app Optional Specify a value if you want to enable Health Center.
Accepted values are:
  • true for enabling Health Center.
  • false for not enabling Heather Center.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/healthCenterEnable/cache-app Optional Specify a value if you want to enable Health Center.
Accepted values are:
  • true for enabling Health Center.
  • false for not enabling Heather Center.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/healthCenterEnable/search-query-app Optional Specify a value if you want to enable Health Center.
Accepted values are:
  • true for enabling Health Center.
  • false for not enabling Heather Center.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/healthCenterEnable/search-ingest-app Optional Specify a value if you want to enable Health Center.
Accepted values are:
  • true for enabling Health Center.
  • false for not enabling Heather Center.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/ts-app Optional If you want to change the trace specification for the Transaction server, specify a value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceFileMaximumNumber/ts-app Optional The size of the trace log file, in MB. The accepted value is an integer in the range from 1 to 20000 (20,000). By default this value is set to 20.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceFileMaximumSize/ts-app Optional The maximum number of historical trace files. The accepted range is from 1 to 50. By default this value is set to 5.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/xc-app Optional If you want to change the trace specification for the Customization server, specify a value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/search-ingest-app Optional If you want to change the trace specification for the Ingest server, specify a value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/search-query-app Optional If you want to change the trace specification for the Query server, specify a value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/cache-manager Optional If you want to change the trace specification for the Cache Manager application, specify a value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/nextjs-app Optional Defines which API methods are logged.
Functions can be filtered using a comma-separated list.
TRACE_DETAILS=findProducts,getV2CategoryResources
This specification will display the log messages from the findProducts and the getV2CategoryResources functions only.
By default, this value is left empty. This implies that all functions are logged.
TRACE_DETAILS=
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/threadMonitorEnable/ts-app Optional Specify a value if you want to enable Thread Monitor.
Accepted values are:
  • true for enabling Thread Monitor.
  • false for not enabling Thread Monitor.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/threadMonitorEnable/xc-app Optional Specify a value if you want to enable Thread Monitor.
Accepted values are:
  • true for enabling Thread Monitor.
  • false for not enabling Thread Monitor.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/threadMonitorEnable/search-ingest-app Optional Specify a value if you want to enable Thread Monitor.
Accepted values are:
  • true for enabling Thread Monitor.
  • false for not enabling Thread Monitor.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/threadMonitorEnable/search-query-app Optional Specify a value if you want to enable Thread Monitor.
Accepted values are:
  • true for enabling Thread Monitor.
  • false for not enabling Thread Monitor.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/threadMonitorEnable/cache-app Optional Specify a value if you want to enable Thread Monitor.
Accepted values are:
  • true for enabling Thread Monitor.
  • false for not enabling Thread Monitor.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/search-app Optional If you want to change the trace specification for the Search server, specify a value.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/orchestration-app Optional Set trace specification for the Solr orchestration-app server.

${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/traceSpecification/crs-app

 Optional Set trace specification for the CRS (Aurora) application server.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/healthCenterEnable/search-app Optional Specify a value if you want to enable Health Center.
Accepted values are:
  • true for enabled.
  • false for disabled.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/healthCenterEnable/orchestration-app Optional Specify whether to enable Health Center for the Solr orchestration application.
Accepted values are:
  • true for enabled.
  • false for disabled.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/healthCenterEnable/crs-app Optional Specify whether to enable Health Center for the CRS (Aurora) application.
Accepted values are:
  • true for enabled.
  • false for disabled.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/threadMonitorEnable/search-app Optional Specify whether to enable the Thread Monitor for the Solr search application.
Accepted values are:
  • true for enabled.
  • false for disabled.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/threadMonitorEnable/orchestration-app Optional Specify whether to enable the Thread Monitor for the Solr orchestration application.
Accepted values are:
  • true for enabled.
  • false for disabled.
The default value is false.
${VAULT_URL}/${TENANT}/${ENVIRONMENT}/${ENVTYPE}/threadMonitorEnable/crs-app Optional Specify a value if you want to enable Thread Monitor.
Accepted values are:
  • true for enabling Thread Monitor.
  • false for not enabling Thread Monitor.
The default value is false.