Deployment Instructions

Infrastructure Prerequisites

Web server and SQL server:

Environments	Web Server	SQL Server
Production	Windows Server 2019 Version 1809. CPU: 8 core RAM: 16 GB Free disk space: 100 GB Enable outbound internet connection	SQL Server (dedicated or shared instance) SQL Server 2016 or later Databases: onelist_p comms_p rolemanager_p SQL log in with db_owner role of the databases
Non-production	Windows Server 2019 Version 1809. CPU: 8 core RAM: 16 GB Free disk space: 100 GB Enable outbound internet connection	SQL Server (dedicated or shared instance) SQL Server 2016 or later Databases for each non-prod environment: the "x" represents the environment tag, e.g. d for Development, q for QA. onelist_x comms_x rolemanager_x SQL log in with db_owner role of the database

Determine the DNS for each OneList environment, e.g. onelist.company.com, onelist-dev.company.com, onelist-test.company.com;
Configure reverse proxy to enable access to OneList URL's
Enable outbound firewall rules for the Web Servers to the following destinations:
- Apple and Google messaging services to send mobile push notifications:
  - https://api.push.apple.com on port: 443;
  - https://fcm.googleapis.com/fcm/send on ports: 443, 5228-5230;
- https://iqx.onelistapprovals.com to retrieve the current push notification certificates;
- iqxbusiness.azureacr.io to download the Docker images as required.
- Installing Docker Enterprise Engine:
  - https://go.microsoft.com/
  - https://www.powershellgallery.com
Provision SSL certificate:
- Wildcard or site specific SSL certificate for each environment;
- Key size 2048 bits;
- Issued by public certificate authority;
SMTP server connection detail and dedicated or shared email address for OneList.
If the server is a VMware VM, VMware Tools must be version 11.0.6 or above.

Deployment Prerequisites

Domain user account requirements:
- Local Administrator of the Web Server;
- Has VPN and RDP access to the Web Server;
Define the label for the OneList environment to be deployed. This is a short label, e.g. dev, qa, prod. The first letter must be unique in all the environments planned and it is used as the suffix of the database names.
- Use this value to replace the <environment> placeholder in the instructions below.
Request for login to IQX container registry;
Generate the Machine key for each environment. This is a Base64 string representing an array of 50 bytes;
- Use tools like https://generate.plus/en/base64 to generate a random string of the required length.

Deployment Instructions

Install Docker Engine - Enterprise

Open PowerShell console as Administrator. Run 2 commands below.

Install-Module DockerMsftProvider -Force

Install-Package Docker -ProviderName DockerMsftProvider -Force

Restart server.

Install docker-compose

Run command:

Invoke-WebRequest "https://github.com/docker/compose/releases/download/1.25.0/docker-compose-Windows-x86_64.exe" -UseBasicParsing -OutFile $Env:ProgramFiles\Docker\docker-compose.exe

Prepare the deployment file

Create a new folder. Name it as the <environment> value. Download and save docker-compose.yml and .env file to the folder.

Open the ".env" file in notepad and update the following fields with the actual value.

RoleManager__MachineKey
The value is the generated machine key.
Database__ConnectionString
The value is the SQL Server connection string. The name of the databases will be automatically specified by the services.
ASPNETCORE_ENVIRONMENT
The value is <environment>.
Smtp__UserName
Smtp__Password
Smtp__From
This is the sender email address of notifications from OneList
Smtp__Host
This is the SMTP server OneList use to send notifications.
Smtp__Port
This is the port of SMTP server.
Smtp__UseSsl
Define if SMTP server uses SSL connection. For Office365 SMTP service, the value is always false.

Save the ".env" file then run the command below.

Start OneList applications

Open PowerShell console from the folder created in previous step then run following commands.

Login to IQX container registry: docker login -u <username> --password-stdin iqxbusiness.azurecr.io

Pull images: docker-compose pull

Start OneList applications: docker-compose up -d

Configure IIS Proxy

Enable WebSocket Protocol and Dynamic Content Compression feature.

Open "Server Manager" → Select "Add Roles and Features" → "Server Roles" → "Web Server"

→ "Application Development" → Check "WebSocket Protocol"
→ "Performance" → Check "Dynamic Content Compression"

Install IIS modules

Download and Install URL Rewrite and Application Request Routing IIS module.

Stop the default web site and create OneList site on IIS

Right click Sites → select "Add Website...".

Fill in details as below and click OK.

Select OneList site → Click "Bindings..." → Create HTTP/HTTPS binding

Activate reverse proxy

Select IIS root → Open “Application Request Routing Cache”

Select “Server Proxy Settings”

Check the box “Enable Proxy”, uncheck "Reverse rewrite host in response headers" and click Apply

Configure URL Rewrite rules

Select OneList site → Open URL Rewrite

Select "View Server Variables"

Add following variables: HTTP_X_Forwarded_Host, HTTP_X_Forwarded_Port, HTTP_X_Forwarded_Proto, HTTP_X_Original_URI

Setup the OneList site

Place web.config file to root folder of the IIS site.

The web.config file contains:

URL rewrite rules that route inbound traffic to OneList containers.
Add following request headers:
- X_Forwarded_Host
- X_Original_URI
- X_Forwarded_Port
- X_Forwarded_Proto

Create the administrator user account

Navigate to the OneList URL in the browser, you will be presented to the following page to create the first user account. The System Administrator access is automatically granted to this user account.

Log on using the email and password of the newly created user account to complete the application configuration steps.